Edit tour

Windows Analysis Report
105vjMVwfJ.dll

Overview

General Information

Sample name:	105vjMVwfJ.dll renamed because original name is a hash value
Original sample name:	e25e0bada18fdf7b3e954445179f5905267bf6d8331f7a9260a8f44c2f949da1.exe
Analysis ID:	1568432
MD5:	be5df0fee4e84ccc38a4ec67ad130759
SHA1:	1b540a57166401c1b6dffc8c75378fbf83a7f58a
SHA256:	e25e0bada18fdf7b3e954445179f5905267bf6d8331f7a9260a8f44c2f949da1
Tags:	exeuser-JAMESWT_MHT
Infos:

Detection

CobaltStrike

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file does not import any functions

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 2268 cmdline: loaddll64.exe "C:\Users\user\Desktop\105vjMVwfJ.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 2820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6416 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 3212 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1588 cmdline: rundll32.exe C:\Users\user\Desktop\105vjMVwfJ.dll,D3DAssemble MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2872 cmdline: rundll32.exe C:\Users\user\Desktop\105vjMVwfJ.dll,D3DCompile MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7044 cmdline: rundll32.exe C:\Users\user\Desktop\105vjMVwfJ.dll,D3DCompile2 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5112 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DAssemble MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6788 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompile MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2544 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompile2 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3352 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",IEX MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1948 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",DebugSetMute MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6976 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DWriteBlobToFile MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1060 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DStripShader MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3620 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DSetBlobPart MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3608 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReturnFailure1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4512 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReflectLibrary MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1292 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReflect MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6712 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReadFileToBlob MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6600 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DPreprocess MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5328 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DLoadModule MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4904 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetTraceInstructionOffsets MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5536 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetOutputSignatureBlob MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6260 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetInputSignatureBlob MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6228 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetInputAndOutputSignatureBlob MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1808 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetDebugInfo MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5564 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetBlobPart MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3976 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassembleRegion MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6656 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassemble11Trace MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6184 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassemble10Effect MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4916 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassemble MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2852 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDecompressShaders MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3804 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCreateLinker MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2724 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCreateFunctionLinkingGraph MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6804 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCreateBlob MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1208 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompressShaders MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3424 cmdline: rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompileFromFile MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 18500, "MaxGetSize": 2140839, "Jitter": 35, "C2Server": "163.5.169.26,/broadcast", "HttpPostUri": "/1/events/com.amazon.csm.csa.prod", "Malleable_C2_Instructions": ["Remove 1308 bytes from the end", "Remove 1 bytes from the end", "Remove 194 bytes from the beginning", "Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\wermgr.exe", "Spawnto_x64": "%windir%\\sysnative\\wermgr.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 12345, "bStageCleanup": "True", "bCFGCaution": "True", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 24576, "ProcInject_PrependAppend_x86": ["REBLQ0xIkGaQDx8AZg8fBAAPHwQADx8ADx8A", "Empty"], "ProcInject_PrependAppend_x64": ["REBLQ0xIkGaQDx8AZg8fBAAPHwQADx8ADx8A", "Empty"], "ProcInject_Execute": ["ntdll.dll:RtlUserThreadStart", "SetThreadContext", "NtQueueApcThread-s", "kernel32.dll:LoadLibraryA", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "False", "HostHeader": ""}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.4390842892.0000024BB68AC000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000003.00000002.2635114835.0000012E5460C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000008.00000002.2712283227.000001D327A8C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000004.00000002.2645352424.000001EFEFB2C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000006.00000002.2701342655.000001BFCAC0C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: loaddll64.exe PID: 2268	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: loaddll64.exe PID: 2268	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 1588	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 1588	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 3212	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 3212	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 2872	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 2872	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 7044	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 7044	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author
4.3.rundll32.exe.1efef930000.0.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
4.3.rundll32.exe.1efef930000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
4.3.rundll32.exe.1efef930000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.3.loaddll64.exe.24bb66e0000.0.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.3.loaddll64.exe.24bb66e0000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.3.loaddll64.exe.24bb66e0000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
8.3.rundll32.exe.1d3260e0000.0.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
8.3.rundll32.exe.1d3260e0000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
8.3.rundll32.exe.1d3260e0000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
3.3.rundll32.exe.12e52d60000.0.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
3.3.rundll32.exe.12e52d60000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
3.3.rundll32.exe.12e52d60000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
6.3.rundll32.exe.1bfc9310000.0.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
6.3.rundll32.exe.1bfc9310000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
6.3.rundll32.exe.1bfc9310000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Click to see the 10 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T16:19:56.729219+0100	2028765	3	Unknown Traffic	192.168.2.6	49826	163.5.169.26	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 18500, "MaxGetSize": 2140839, "Jitter": 35, "C2Server": "163.5.169.26,/broadcast", "HttpPostUri": "/1/events/com.amazon.csm.csa.prod", "Malleable_C2_Instructions": ["Remove 1308 bytes from the end", "Remove 1 bytes from the end", "Remove 194 bytes from the beginning", "Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\wermgr.exe", "Spawnto_x64": "%windir%\\sysnative\\wermgr.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 12345, "bStageCleanup": "True", "bCFGCaution": "True", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 24576, "ProcInject_PrependAppend_x86": ["REBLQ0xIkGaQDx8AZg8fBAAPHwQADx8ADx8A", "Empty"], "ProcInject_PrependAppend_x64": ["REBLQ0xIkGaQDx8AZg8fBAAPHwQADx8ADx8A", "Empty"], "ProcInject_Execute": ["ntdll.dll:RtlUserThreadStart", "SetThreadContext", "NtQueueApcThread-s", "kernel32.dll:LoadLibraryA", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "False", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Source: 105vjMVwfJ.dll

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Source: 105vjMVwfJ.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 163.5.169.26

Source: Joe Sandbox View

ASN Name: EPITECHFR EPITECHFR

Source: Network traffic

Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49826 -> 163.5.169.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.169.26

Source: 105vjMVwfJ.dll	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 105vjMVwfJ.dll	String found in binary or memory: http://ocsp.thawte.com0
Source: 105vjMVwfJ.dll	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 105vjMVwfJ.dll	String found in binary or memory: http://s2.symcb.com0
Source: 105vjMVwfJ.dll	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: 105vjMVwfJ.dll	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 105vjMVwfJ.dll	String found in binary or memory: http://sv.symcd.com0&
Source: 105vjMVwfJ.dll	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 105vjMVwfJ.dll	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 105vjMVwfJ.dll	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 105vjMVwfJ.dll	String found in binary or memory: http://www.symauth.com/cps0(
Source: 105vjMVwfJ.dll	String found in binary or memory: http://www.symauth.com/rpa00
Source: loaddll64.exe, 00000000.00000003.3374781978.0000024BB67C5000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3822596909.0000024BB67E9000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3374781978.0000024BB67E9000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.4387902884.0000024BB67E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://163.5.169.26/
Source: loaddll64.exe, 00000000.00000003.3374781978.0000024BB67C5000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3374781978.0000024BB67DA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.4387902884.0000024BB67DA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.4387902884.0000024BB67C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://163.5.169.26/broadcast
Source: loaddll64.exe, 00000000.00000003.3374781978.0000024BB67C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://163.5.169.26/l
Source: loaddll64.exe, 00000000.00000003.3822596909.0000024BB67E9000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3374781978.0000024BB67E9000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.4387902884.0000024BB67E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://163.5.169.26/t
Source: 105vjMVwfJ.dll	String found in binary or memory: https://d.symcb.com/cps0%
Source: 105vjMVwfJ.dll	String found in binary or memory: https://d.symcb.com/rpa0
Source: rundll32.exe, 00000008.00000002.2710960968.000001D32619F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_0000024BB6728750	0_3_0000024BB6728750
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_0000024BB6719F34	0_3_0000024BB6719F34
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_0000024BB671B544	0_3_0000024BB671B544
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_0000024BB66E9680	0_3_0000024BB66E9680
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_0000024BB671AC60	0_3_0000024BB671AC60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_0000024BB6725900	0_3_0000024BB6725900
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_0000024BB671F9E4	0_3_0000024BB671F9E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_0000024BB66E916C	0_3_0000024BB66E916C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_0000024BB66FB1F4	0_3_0000024BB66FB1F4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_0000024BB6724AA8	0_3_0000024BB6724AA8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000012E52D99F34	3_3_0000012E52D99F34
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000012E52DA8750	3_3_0000012E52DA8750
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000012E52D69680	3_3_0000012E52D69680
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000012E52D9AC60	3_3_0000012E52D9AC60
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000012E52D9B544	3_3_0000012E52D9B544
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000012E52D7B1F4	3_3_0000012E52D7B1F4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000012E52D9F9E4	3_3_0000012E52D9F9E4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000012E52DA4AA8	3_3_0000012E52DA4AA8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000012E52D6916C	3_3_0000012E52D6916C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000012E52DA5900	3_3_0000012E52DA5900
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000012E545FBFCC	3_2_0000012E545FBFCC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000012E545FB860	3_2_0000012E545FB860
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000012E545FCB5C	3_2_0000012E545FCB5C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000012E546005E4	3_2_0000012E546005E4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000012E545F9D70	3_2_0000012E545F9D70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001EFEF974AA8	4_3_000001EFEF974AA8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001EFEF96F9E4	4_3_000001EFEF96F9E4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001EFEF94B1F4	4_3_000001EFEF94B1F4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001EFEF93916C	4_3_000001EFEF93916C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001EFEF975900	4_3_000001EFEF975900
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001EFEF969F34	4_3_000001EFEF969F34
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001EFEF978750	4_3_000001EFEF978750
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001EFEF939680	4_3_000001EFEF939680
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001EFEF96B544	4_3_000001EFEF96B544
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001EFEF96AC60	4_3_000001EFEF96AC60
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001EFEFB273D0	4_2_000001EFEFB273D0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001EFEFB1CB5C	4_2_000001EFEFB1CB5C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001EFEFB1B860	4_2_000001EFEFB1B860
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001EFEFB1BFCC	4_2_000001EFEFB1BFCC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001EFEFB205E4	4_2_000001EFEFB205E4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001EFEFB27D40	4_2_000001EFEFB27D40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001EFEFB19D70	4_2_000001EFEFB19D70
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001BFC932B1F4	6_3_000001BFC932B1F4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001BFC934F9E4	6_3_000001BFC934F9E4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001BFC9354AA8	6_3_000001BFC9354AA8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001BFC934B544	6_3_000001BFC934B544
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001BFC934AC60	6_3_000001BFC934AC60
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001BFC9358750	6_3_000001BFC9358750
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001BFC9349F34	6_3_000001BFC9349F34
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001BFC9319680	6_3_000001BFC9319680
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001BFC9355900	6_3_000001BFC9355900
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000001BFC931916C	6_3_000001BFC931916C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001BFCABFB860	6_2_000001BFCABFB860
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001BFCAC005E4	6_2_000001BFCAC005E4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001BFCABFBFCC	6_2_000001BFCABFBFCC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000001D3260E9680	8_3_000001D3260E9680
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000001D326128750	8_3_000001D326128750
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000001D326119F34	8_3_000001D326119F34
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000001D32611AC60	8_3_000001D32611AC60
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000001D32611B544	8_3_000001D32611B544
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000001D32611F9E4	8_3_000001D32611F9E4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000001D3260FB1F4	8_3_000001D3260FB1F4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000001D326124AA8	8_3_000001D326124AA8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000001D326125900	8_3_000001D326125900
Source: C:\Windows\System32\rundll32.exe	Code function: 8_3_000001D3260E916C	8_3_000001D3260E916C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000001D327A79D70	8_2_000001D327A79D70
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000001D327A87D40	8_2_000001D327A87D40
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000001D327A873D0	8_2_000001D327A873D0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000001D327A7CB5C	8_2_000001D327A7CB5C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000001D327A7B860	8_2_000001D327A7B860
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000001D327A7BFCC	8_2_000001D327A7BFCC

Source: 105vjMVwfJ.dll

Static PE information: invalid certificate

Source: 105vjMVwfJ.dll

Static PE information: No import functions for PE file found

Source: 105vjMVwfJ.dll

Binary or memory string: OriginalFilenameiisexpress.exe\ vs 105vjMVwfJ.dll

Source: classification engine

Classification label: mal92.troj.evad.winDLL@72/0@0/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2820:120:WilError_03

Source: 105vjMVwfJ.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\105vjMVwfJ.dll,D3DAssemble

Source: 105vjMVwfJ.dll

ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\105vjMVwfJ.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\105vjMVwfJ.dll,D3DAssemble
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\105vjMVwfJ.dll,D3DCompile
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\105vjMVwfJ.dll,D3DCompile2
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DAssemble
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompile
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompile2
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",IEX
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",DebugSetMute
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DWriteBlobToFile
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DStripShader
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DSetBlobPart
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReturnFailure1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReflectLibrary
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReflect
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReadFileToBlob
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DPreprocess
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DLoadModule
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetTraceInstructionOffsets
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetOutputSignatureBlob
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetInputSignatureBlob
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetInputAndOutputSignatureBlob
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetDebugInfo
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetBlobPart
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassembleRegion
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassemble11Trace
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassemble10Effect
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassemble
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDecompressShaders
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCreateLinker
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCreateFunctionLinkingGraph
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCreateBlob
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompressShaders
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompileFromFile
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\105vjMVwfJ.dll,D3DAssemble	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\105vjMVwfJ.dll,D3DCompile	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\105vjMVwfJ.dll,D3DCompile2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DAssemble	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompile	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompile2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",IEX	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",DebugSetMute	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DWriteBlobToFile	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DStripShader	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DSetBlobPart	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReturnFailure1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReflectLibrary	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReflect	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReadFileToBlob	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DPreprocess	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DLoadModule	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetTraceInstructionOffsets	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetOutputSignatureBlob	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetInputSignatureBlob	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetInputAndOutputSignatureBlob	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetDebugInfo	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetBlobPart	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassembleRegion	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassemble11Trace	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassemble10Effect	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassemble	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDecompressShaders	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCreateLinker	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCreateFunctionLinkingGraph	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCreateBlob	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompressShaders	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompileFromFile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: 105vjMVwfJ.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: 105vjMVwfJ.dll

Static file information: File size 1050144 > 1048576

Source: 105vjMVwfJ.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000012E545CA35D push edi; iretd	3_2_0000012E545CA35E
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000012E5460252E push es; iretd	3_2_0000012E5460252F
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000012E545CBD58 push ebp; iretd	3_2_0000012E545CBD59
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000012E545CA71E push cs; retf	3_2_0000012E545CA71F
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001EFEFAEA35D push edi; iretd	4_2_000001EFEFAEA35E
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001EFEFAEA71E push cs; retf	4_2_000001EFEFAEA71F
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001EFEFB2A5D8 push ebp; iretd	4_2_000001EFEFB2A5DD
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001EFEFB2252E push es; iretd	4_2_000001EFEFB2252F
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001EFEFAEBD58 push ebp; iretd	4_2_000001EFEFAEBD59
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001BFCABCBD58 push ebp; iretd	6_2_000001BFCABCBD59
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001BFCABCA35D push edi; iretd	6_2_000001BFCABCA35E
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001BFCABCA71E push cs; retf	6_2_000001BFCABCA71F
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000001D327A4A71E push cs; retf	8_2_000001D327A4A71F
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000001D327A8252E push es; iretd	8_2_000001D327A8252F
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000001D327A4BD58 push ebp; iretd	8_2_000001D327A4BD59
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000001D327A4A35D push edi; iretd	8_2_000001D327A4A35E
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000001D327A85890 push ebp; iretd	8_2_000001D327A85891
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000001D327A85867 push ebp; iretd	8_2_000001D327A85868
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000001D327A85847 push ebp; iretd	8_2_000001D327A85848

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe TID: 5636

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: rundll32.exe, 00000004.00000002.2645242685.000001EFEF9FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%KnQ
Source: rundll32.exe, 00000006.00000002.2701240727.000001BFC922F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&Km
Source: loaddll64.exe, 00000000.00000003.3822596909.0000024BB67FA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.4387902884.0000024BB67FA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3374781978.0000024BB67FA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.4354404600.0000024BB677C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000003.00000002.2634991507.0000012E52B8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll64.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x24BB68700E6	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQueryVolumeInformationFile: Direct from: 0x24BB68A21A7	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQuerySystemInformation: Direct from: 0x24BB687020B	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FFDA366FBDD	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x24BB68994C3	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FFDA3674543	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQueryInformationToken: Direct from: 0x24BB6877DB0	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x24BB686F716	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x24BB66FD169	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x7FFDA3670E67	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FF79F1315F3	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtDelayExecution: Direct from: 0x7FFDA3671B34	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtSetSecurityObject: Direct from: 0x7FFDB43E26A1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x24BB66FD0DC	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtClose: Direct from: 0x7FFDA36623B0
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x7FFDB4404B5E	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x7FF79F131CF4	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x24BB66FD1B2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FFDA366EE28	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x24BB66FCBBB	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtSetInformationThread: Direct from: 0x7FF79F13D459	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x24BB68611BE	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtClose: Direct from: 0x24BB68701D0
Source: C:\Windows\System32\loaddll64.exe	NtQueryInformationToken: Direct from: 0x24BB686FA82	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x24BB686FB61	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtCreateThreadEx: Direct from: 0x7FFDA36745D2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x7FF79F131957	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtDeviceIoControlFile: Direct from: 0x24BB6870141	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x7FFDA3673D00	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x7FF79F13154B	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQuerySystemInformation: Direct from: 0x24BB66FCD31	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtUnmapViewOfSection: Direct from: 0x7FFDA36633F2	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",#1

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_0000012E545D7CFC GetUserNameA,strrchr,_snprintf,

3_2_0000012E545D7CFC

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 4.3.rundll32.exe.1efef930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll64.exe.24bb66e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.rundll32.exe.1d3260e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.12e52d60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.1bfc9310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4390842892.0000024BB68AC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2635114835.0000012E5460C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2712283227.000001D327A8C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2645352424.000001EFEFB2C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2701342655.000001BFCAC0C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 2268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 1588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 3212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7044, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	11 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
105vjMVwfJ.dll	45%	ReversingLabs	Win64.Backdoor.Cobeacon

Source	Detection	Scanner	Label
https://163.5.169.26/	0%	Avira URL Cloud	safe
https://163.5.169.26/l	0%	Avira URL Cloud	safe
163.5.169.26	0%	Avira URL Cloud	safe
https://163.5.169.26/broadcast	0%	Avira URL Cloud	safe
https://163.5.169.26/t	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
163.5.169.26	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://163.5.169.26/	loaddll64.exe, 00000000.00000003.3374781978.0000024BB67C5000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3822596909.0000024BB67E9000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3374781978.0000024BB67E9000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.4387902884.0000024BB67E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://163.5.169.26/t	loaddll64.exe, 00000000.00000003.3822596909.0000024BB67E9000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3374781978.0000024BB67E9000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.4387902884.0000024BB67E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://163.5.169.26/broadcast	loaddll64.exe, 00000000.00000003.3374781978.0000024BB67C5000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3374781978.0000024BB67DA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.4387902884.0000024BB67DA000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.4387902884.0000024BB67C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	105vjMVwfJ.dll	false		high
http://www.symauth.com/cps0(	105vjMVwfJ.dll	false		high
http://www.symauth.com/rpa00	105vjMVwfJ.dll	false		high
https://www.amazon.com	rundll32.exe, 00000008.00000002.2710960968.000001D32619F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://163.5.169.26/l	loaddll64.exe, 00000000.00000003.3374781978.0000024BB67C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	105vjMVwfJ.dll	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
163.5.169.26	unknown	France		56339	EPITECHFR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568432
Start date and time:	2024-12-04 16:16:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	105vjMVwfJ.dll renamed because original name is a hash value
Original Sample Name:	e25e0bada18fdf7b3e954445179f5905267bf6d8331f7a9260a8f44c2f949da1.exe
Detection:	MAL
Classification:	mal92.troj.evad.winDLL@72/0@0/1
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 100% Number of executed functions: 17 Number of non-executed functions: 338
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): crl.edge.digicert.com, client.wns.windows.com, ts-crl.ws.symantec.com, crl-symcprod.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target loaddll64.exe, PID 2268 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 105vjMVwfJ.dll

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
163.5.169.26	7RDTQuL8WF.exe	Get hash	malicious	CobaltStrike	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	5LZZEXBpNE.exe	Get hash	malicious	FormBook, GuLoader	Browse	192.229.221.95
	3861227PDF.exe	Get hash	malicious	AZORult	Browse	192.229.221.95
	Order_DEC2024.wsf	Get hash	malicious	Remcos	Browse	192.229.221.95
	lnvoice-1620804301.pdf .js	Get hash	malicious	RHADAMANTHYS	Browse	192.229.221.95
	lnvoice-1620804301.pdf (1).js	Get hash	malicious	RHADAMANTHYS	Browse	192.229.221.95
	P102462 INVOICE.exe	Get hash	malicious	FormBook	Browse	192.229.221.95
	30550107002876429834.js	Get hash	malicious	Strela Downloader	Browse	192.229.221.95
	file.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.229.221.95
	ft.exe	Get hash	malicious	LummaC Stealer	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EPITECHFR	7RDTQuL8WF.exe	Get hash	malicious	CobaltStrike	Browse	163.5.169.26
	botx.spc.elf	Get hash	malicious	Mirai	Browse	163.5.176.64
	spc.elf	Get hash	malicious	Mirai	Browse	163.5.130.180
	m68k.elf	Get hash	malicious	Mirai	Browse	163.5.176.71
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	163.5.152.99
	SecuriteInfo.com.Win32.MalwareX-gen.20028.17631.exe	Get hash	malicious	AsyncRAT	Browse	163.5.160.86
	jNA5BK2z12.exe	Get hash	malicious	AsyncRAT	Browse	163.5.160.86
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	163.5.63.254
	https://zupimages.net/up/24/42/ol13.jpg?d6mSMvU0ZvpGwffnuqPHYMR7NvlxIzVjDfTD4YJjdRSCOcc	Get hash	malicious	Unknown	Browse	163.5.194.37
	Farahexperiences.com_Report_52288.pdf	Get hash	malicious	Unknown	Browse	163.5.194.34

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.47410437444631
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	105vjMVwfJ.dll
File size:	1'050'144 bytes
MD5:	be5df0fee4e84ccc38a4ec67ad130759
SHA1:	1b540a57166401c1b6dffc8c75378fbf83a7f58a
SHA256:	e25e0bada18fdf7b3e954445179f5905267bf6d8331f7a9260a8f44c2f949da1
SHA512:	46bac30b70a819bbcf1240dcc99abcb6d626e1e34f2a7a71022049ea672c60324702f3f51dc894a69e9cad6cdbcba8cf8a0cce9ac10feec998cc99727411f424
SSDEEP:	12288:EIDvCzFdigSVXfIG1gb73dhbWK9WTHUIkM5QeLDoK5PLcJFihLt3A+Y:ZCF1G1gyb951LDnLSkhhZY
TLSH:	F5256A666E73C829E529A0BE645A43C145343F7919E412FB12E4176B2FF318C4B8F36B
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....V(e.........." .........8......-........................................`............`........................................

File Icon


Icon Hash:	1a1de1e5e1239e38

Static PE Info

General

Entrypoint:	0x18003af2d
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6528569E [Thu Oct 12 20:27:10 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/04/2015 20:00:00 13/04/2018 19:59:59
Subject Chain	CN="Oracle America, Inc.", OU=Code Signing Bureau, O="Oracle America, Inc.", L=Redwood Shores, S=California, C=US
Version:	3
Thumbprint MD5:	7F2E08A290C8767AFAFAFFFE09BE1149
Thumbprint SHA-1:	3B75816D15A6D8F4598E9CF5603F1839EE84D73D
Thumbprint SHA-256:	9D9365087330DF525292796A656A389C13E4F37ADA62693F4A951C0CB1B8B0BC
Serial:	12F0277E0F233B39F9419B06E8CDE352

Entrypoint Preview

Instruction
push ebp
inc ecx
push edi
inc ecx
push esi
inc ecx
push ebp
inc ecx
push esp
push esi
push edi
push ebx
dec eax
sub esp, 000000F8h
dec eax
lea ebp, dword ptr [esp+00000080h]
mov dword ptr [ebp+5Ch], edx
xorps xmm0, xmm0
movups dqword ptr [ebp+3Ch], xmm0
movaps ebp+30h, dqword ptr [xmm0]
movaps ebp+20h, dqword ptr [xmm0]
movaps ebp+10h, dqword ptr [xmm0]
movaps ebp+00h, dqword ptr [xmm0]
movaps ebp-10h, dqword ptr [xmm0]
movaps ebp-20h, dqword ptr [xmm0]
cmp dword ptr [000AB10Bh], 0Ah
mov eax, dword ptr [000AB101h]
setl cl
lea edx, dword ptr [eax+01h]
imul edx, eax
test dl, 00000001h
sete al
mov edx, ecx
and dl, al
mov byte ptr [ebp+77h], dl
xor cl, al
mov byte ptr [ebp+76h], cl
xor eax, eax
dec eax
lea ecx, dword ptr [0001EBA5h]
dec eax
arpl word ptr [eax+ecx], dx
xor dword ptr [ebp+edx*4-20h], 00001E27h
dec eax
add eax, 04h
dec eax
cmp eax, 68h
jne 00007F56711DFFECh
mov eax, 000008C0h
xor ecx, ecx
dec eax
mov dword ptr [ebp-58h], ecx
dec eax
lea esi, dword ptr [0001ECFDh]
dec eax
lea edi, dword ptr [0001ED5Ah]
dec esp
lea esi, dword ptr [0001ED5Bh]
dec esp
lea ecx, dword ptr [0001EAF8h]
dec esp
lea edx, dword ptr [0001EC31h]
dec esp
lea edi, dword ptr [0001ED36h]
dec esp
lea ebp, dword ptr [0001ED27h]
dec esp
lea esp, dword ptr [0001ED18h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x509c6	0x386	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe9000	0x1b758	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x50d4c	0x4f8	.text
IMAGE_DIRECTORY_ENTRY_SECURITY	0xfee00	0x1820	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x105000	0x2c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5b5b0	0x140	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5b104	0x5b200	d943478eebdc6fcb7301e02c5972a6ae	False	0.34970582561728397	data	5.890325051671784	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x5d000	0x8afd8	0x87c00	2cb1ccd3c6c9f43bdcd9e6c8ad27f56c	False	0.3396621057780847	data	6.105931540080737	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.sdata	0xe8000	0x30	0x200	f927ec16777b24dc4dfb58c1c73b2751	False	0.056640625	data	0.41911781941489346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xe9000	0x1b758	0x1b800	28bd58503c3e58848ffcef5b44b72905	False	0.8856001420454546	data	7.577434366625928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x105000	0x2c	0x200	dd37af5637020c49f853952bd28448ab	False	0.10546875	data	0.5163459669794561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xe96e8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3445121951219512
RT_ICON	0xe9d50	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.5067204301075269
RT_ICON	0xea038	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.5676229508196722
RT_ICON	0xea220	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.625
RT_ICON	0xea348	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6284648187633263
RT_ICON	0xeb1f0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7766245487364621
RT_ICON	0xeba98	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.8358294930875576
RT_ICON	0xec160	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.5939306358381503
RT_ICON	0xec6c8	0x13b8e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9997895570795474
RT_ICON	0x100258	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5776970954356846
RT_ICON	0x102800	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6177298311444653
RT_ICON	0x1038a8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6778688524590164
RT_ICON	0x104230	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6879432624113475
RT_GROUP_ICON	0x104698	0xbc	data	English	United States	0.6170212765957447
RT_VERSION	0xe9340	0x3a4	data	English	United States	0.45493562231759654

Exports

Name	Ordinal	Address
D3DAssemble	1	0x18003d768
D3DCompile	2	0x18003d9d2
D3DCompile2	3	0x18003d89b
D3DCompileFromFile	4	0x18003c63d
D3DCompressShaders	5	0x18003c3c5
D3DCreateBlob	6	0x18003d28e
D3DCreateFunctionLinkingGraph	7	0x18003b9ec
D3DCreateLinker	8	0x18003cc62
D3DDecompressShaders	9	0x18003c280
D3DDisassemble	10	0x18003d012
D3DDisassemble10Effect	11	0x18003bed1
D3DDisassemble11Trace	12	0x18003c008
D3DDisassembleRegion	13	0x18003c14d
D3DGetBlobPart	14	0x18003cedb
D3DGetDebugInfo	15	0x18003cb2f
D3DGetInputAndOutputSignatureBlob	16	0x18003b8a7
D3DGetInputSignatureBlob	17	0x18003bd9e
D3DGetOutputSignatureBlob	18	0x18003bc65
D3DGetTraceInstructionOffsets	19	0x18003bb1f
D3DLoadModule	20	0x18003d4f4
D3DPreprocess	21	0x18003d3c1
D3DReadFileToBlob	22	0x18003c9ec
D3DReflect	23	0x18003db17
D3DReflectLibrary	24	0x18003c782
D3DReturnFailure1	25	0x18003c8b5
D3DSetBlobPart	26	0x18003cd95
D3DStripShader	27	0x18003d149
D3DWriteBlobToFile	28	0x18003c4f8
DebugSetMute	29	0x18003d635
IEX	30	0x18003dc5a

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-04T16:19:56.729219+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49826	163.5.169.26	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 16:19:11.640450954 CET	49826	443	192.168.2.6	163.5.169.26
Dec 4, 2024 16:19:11.640515089 CET	443	49826	163.5.169.26	192.168.2.6
Dec 4, 2024 16:19:11.640602112 CET	49826	443	192.168.2.6	163.5.169.26
Dec 4, 2024 16:19:12.684220076 CET	49826	443	192.168.2.6	163.5.169.26
Dec 4, 2024 16:19:12.684252977 CET	443	49826	163.5.169.26	192.168.2.6
Dec 4, 2024 16:19:56.729146004 CET	443	49826	163.5.169.26	192.168.2.6
Dec 4, 2024 16:19:56.729218960 CET	49826	443	192.168.2.6	163.5.169.26
Dec 4, 2024 16:19:57.340583086 CET	49826	443	192.168.2.6	163.5.169.26
Dec 4, 2024 16:19:57.340635061 CET	443	49826	163.5.169.26	192.168.2.6
Dec 4, 2024 16:19:57.359637022 CET	49863	443	192.168.2.6	163.5.169.26
Dec 4, 2024 16:19:57.359707117 CET	443	49863	163.5.169.26	192.168.2.6
Dec 4, 2024 16:19:57.359781027 CET	49863	443	192.168.2.6	163.5.169.26
Dec 4, 2024 16:19:57.360069990 CET	49863	443	192.168.2.6	163.5.169.26
Dec 4, 2024 16:19:57.360081911 CET	443	49863	163.5.169.26	192.168.2.6
Dec 4, 2024 16:20:41.433383942 CET	443	49863	163.5.169.26	192.168.2.6
Dec 4, 2024 16:20:41.433454990 CET	49863	443	192.168.2.6	163.5.169.26
Dec 4, 2024 16:20:42.120392084 CET	49863	443	192.168.2.6	163.5.169.26
Dec 4, 2024 16:20:42.120425940 CET	443	49863	163.5.169.26	192.168.2.6
Dec 4, 2024 16:20:42.125854015 CET	49899	443	192.168.2.6	163.5.169.26
Dec 4, 2024 16:20:42.125886917 CET	443	49899	163.5.169.26	192.168.2.6
Dec 4, 2024 16:20:42.125952005 CET	49899	443	192.168.2.6	163.5.169.26
Dec 4, 2024 16:20:42.126024008 CET	49899	443	192.168.2.6	163.5.169.26
Dec 4, 2024 16:20:42.126086950 CET	443	49899	163.5.169.26	192.168.2.6
Dec 4, 2024 16:20:42.126138926 CET	49899	443	192.168.2.6	163.5.169.26

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 4, 2024 16:17:48.357119083 CET	1.1.1.1	192.168.2.6	0x77de	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:17:48.357119083 CET	1.1.1.1	192.168.2.6	0x77de	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	10:17:53
Start date:	04/12/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\105vjMVwfJ.dll"
Imagebase:	0x7ff79f130000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.4390842892.0000024BB68AC000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:17:53
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:17:53
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",#1
Imagebase:	0x7ff7326c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:17:53
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\105vjMVwfJ.dll,D3DAssemble
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000003.00000002.2635114835.0000012E5460C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:17:53
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",#1
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000004.00000002.2645352424.000001EFEFB2C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:17:56
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\105vjMVwfJ.dll,D3DCompile
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000006.00000002.2701342655.000001BFCAC0C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:17:59
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\105vjMVwfJ.dll,D3DCompile2
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000008.00000002.2712283227.000001D327A8C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DAssemble
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompile
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompile2
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",IEX
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",DebugSetMute
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DWriteBlobToFile
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DStripShader
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DSetBlobPart
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReturnFailure1
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReflectLibrary
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReflect
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DReadFileToBlob
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DPreprocess
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DLoadModule
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetTraceInstructionOffsets
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetOutputSignatureBlob
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetInputSignatureBlob
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetInputAndOutputSignatureBlob
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetDebugInfo
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	10:18:51
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DGetBlobPart
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	10:18:52
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassembleRegion
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	10:18:52
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassemble11Trace
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	10:18:52
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassemble10Effect
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	10:18:52
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDisassemble
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	10:18:52
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DDecompressShaders
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	10:18:52
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCreateLinker
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	10:18:52
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCreateFunctionLinkingGraph
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	10:18:52
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCreateBlob
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	10:18:52
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompressShaders
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	10:18:52
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\105vjMVwfJ.dll",D3DCompileFromFile
Imagebase:	0x7ff6439c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 0000024BB66FD107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000024BB66FD166
VirtualProtect.KERNELBASE ref: 0000024BB66FD1AF

Strings

DCBA, xrefs: 0000024BB66FD141

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: DCBA
API String ID: 544645111-2222620526
Opcode ID: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction ID: 4c904f155e75298daa491a866bb448199684d1f5135abbed3ae12335ec0b3928
Opcode Fuzzy Hash: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction Fuzzy Hash: F941E476206B858EDB21CF79D8847D837A1E748BACF119215EE1D87B98EB34DD448740

Non-executed Functions

Function 0000024BB671F9E4 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0000024BB671FA3A
_errno.LIBCMT ref: 0000024BB671FA41
_invalid_parameter_noinfo.LIBCMT ref: 0000024BB671FA4C

Strings

U, xrefs: 0000024BB671FFAE

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction ID: addfcb3cb4c19bfcde7e1c001670ba036784bb0c7881d627b50224d5b807f2b3
Opcode Fuzzy Hash: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction Fuzzy Hash: 07121272214A8186FB228F3AD48C3AA77A1F786F5CF500116EE89477A5DB3DCC45CB52

Function 0000024BB671B544 Relevance: 25.1, APIs: 13, Strings: 1, Instructions: 594COMMON

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0000024BB671B966
write_multi_char.LIBCMT ref: 0000024BB671BA8F
write_string.LIBCMT ref: 0000024BB671BAAC
write_multi_char.LIBCMT ref: 0000024BB671BAC9
write_string.LIBCMT ref: 0000024BB671BB28
write_string.LIBCMT ref: 0000024BB671BB5F
write_multi_char.LIBCMT ref: 0000024BB671BB81
free.LIBCMT ref: 0000024BB671BB95
_isleadbyte_l.LIBCMT ref: 0000024BB671BC66
write_char.LIBCMT ref: 0000024BB671BC7C
write_char.LIBCMT ref: 0000024BB671BC9D
_errno.LIBCMT ref: 0000024BB671BD97
_invalid_parameter_noinfo.LIBCMT ref: 0000024BB671BDA2

Strings

, xrefs: 0000024BB671BA63

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: write_multi_charwrite_string$write_char$_errno_invalid_parameter_noinfo_isleadbyte_l_malloc_crtfree
String ID:
API String ID: 2600834739-3916222277
Opcode ID: 95db6e67095b1cff7f5ed97d2d1907cd3ce88e16966fe85260d16a5165bf001e
Instruction ID: 02a9ab35319098613f10ea9c900553ca02c5bfa36e5d414320048a88237f3781
Opcode Fuzzy Hash: 95db6e67095b1cff7f5ed97d2d1907cd3ce88e16966fe85260d16a5165bf001e
Instruction Fuzzy Hash: 9D32CE6260868586FB7A8E37D19C37E6BA1F745F8CF241007DE4656AE8DB38CD418F42

Function 0000024BB6725900 Relevance: 5.9, Strings: 4, Instructions: 884COMMON

Download Yara Rule

Strings

uctDir, xrefs: 0000024BB6726583, 0000024BB67265FC, 0000024BB6726675, 0000024BB67266EE
<, xrefs: 0000024BB6725FBE
Changing the code in this way will not affect the quality of the resulting optimized code., xrefs: 0000024BB672656F, 0000024BB67265E8, 0000024BB6726661, 0000024BB67266DA
, xrefs: 0000024BB6725FB3

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: $<$Changing the code in this way will not affect the quality of the resulting optimized code.$uctDir
API String ID: 0-3812399124
Opcode ID: 8608a6510d78ded6d7b72b0d922fa4575634e3d77ec576b96213c711cfdf47ce
Instruction ID: 8add3fb97c254f8a7028640e26f48127781d8cd1cec9ecf2d5c291f3602e0bee
Opcode Fuzzy Hash: 8608a6510d78ded6d7b72b0d922fa4575634e3d77ec576b96213c711cfdf47ce
Instruction Fuzzy Hash: 6892EFB2325A8087DB58CB1DE4A573AB7A1F3C8B84F54512AEB9B87794CA3CC551CB04

Function 0000024BB66FB1F4 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 564COMMON

Download Yara Rule

Strings

h, xrefs: 0000024BB66FB5E3

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 17c874fdfca0e46784307bd0b6e64768fd4c1a3d89b12e191bda19c005753cbd
Instruction ID: ad79bb265cebb31afcfc61b66ed2dd0107e7ed98a01f53f1010eb15157f15529
Opcode Fuzzy Hash: 17c874fdfca0e46784307bd0b6e64768fd4c1a3d89b12e191bda19c005753cbd
Instruction Fuzzy Hash: 4A52FF35208140C7E672DB68E4596EEB760F3D6B4CF104612EE9B02AA9CB79CD45CF47

Function 0000024BB66E9680 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 428beff660b2dd63aba7e3c02aee92ffa63a6193adce4ad15022cc3a3e5488b1
Instruction ID: b41fd1e42fd595cc97cfeab8719781f68d65cec9e3d5fad7a1511e83d65d326a
Opcode Fuzzy Hash: 428beff660b2dd63aba7e3c02aee92ffa63a6193adce4ad15022cc3a3e5488b1
Instruction Fuzzy Hash: 10F18572704A4296EB22CB35E4983EE77A1FB94B9CF500215EF4A87699EF34CD05CB41

Function 0000024BB66E916C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1f6ea64bb700f135ef9746f642ebdda6f198d38bec0304a88397afe1d72f797d
Instruction ID: 0b4932cd6f7deb4f757078ebe020f4427d904ad8cdf36dd3d423dd7f1468b821
Opcode Fuzzy Hash: 1f6ea64bb700f135ef9746f642ebdda6f198d38bec0304a88397afe1d72f797d
Instruction Fuzzy Hash: 4DE1A172314A4291EF229A76D4983EE77A1FB95B8CF900212DF4F87699EB34CD05C742

Function 0000024BB671B3CC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000024BB671B42D

Part of subcall function 0000024BB671B324: _getptd.LIBCMT ref: 0000024BB671B33A
Part of subcall function 0000024BB671B324: __updatetlocinfo.LIBCMT ref: 0000024BB671B36F
Part of subcall function 0000024BB671B324: __updatetmbcinfo.LIBCMT ref: 0000024BB671B396

_fileno.LIBCMT ref: 0000024BB671B45F

Part of subcall function 0000024BB671EA24: _errno.LIBCMT ref: 0000024BB671EA2D
Part of subcall function 0000024BB671EA24: _invalid_parameter_noinfo.LIBCMT ref: 0000024BB671EA38

write_multi_char.LIBCMT ref: 0000024BB671BA8F
write_string.LIBCMT ref: 0000024BB671BAAC
_errno.LIBCMT ref: 0000024BB671B432

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

_errno.LIBCMT ref: 0000024BB671BD97
_invalid_parameter_noinfo.LIBCMT ref: 0000024BB671BDA2

Strings

@, xrefs: 0000024BB671B44B
-, xrefs: 0000024BB671BA40

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$@
API String ID: 3246410048-1222683799
Opcode ID: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction ID: 303ce88236fbf2da7aa2565abc9d6d96ba25fe837bee0d2ae9beb167b51e5d77
Opcode Fuzzy Hash: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction Fuzzy Hash: 26B1F372604A8085FB66CF7794883AE6BA1F785F98F240107DE4947AD9DB38CD418F42

Function 0000024BB6718F1C Relevance: 16.6, APIs: 11, Instructions: 82COMMON

Download Yara Rule

APIs

__crtCorExitProcess.LIBCMT ref: 0000024BB6718F24
free.LIBCMT ref: 0000024BB6718F62

Part of subcall function 0000024BB6718828: _errno.LIBCMT ref: 0000024BB6718848

free.LIBCMT ref: 0000024BB6718F77
free.LIBCMT ref: 0000024BB6718F98
free.LIBCMT ref: 0000024BB6718FAD
free.LIBCMT ref: 0000024BB6718FC1
free.LIBCMT ref: 0000024BB6718FCD
free.LIBCMT ref: 0000024BB6718FF8
free.LIBCMT ref: 0000024BB6719019
free.LIBCMT ref: 0000024BB6719032
free.LIBCMT ref: 0000024BB6719063

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$ExitProcess__crt_errno
String ID:
API String ID: 1362684943-0
Opcode ID: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction ID: 9a13a05d335a5accaeb179e6d7ab03ad909bd350bdb7af21e4231f1965bbd6dc
Opcode Fuzzy Hash: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction Fuzzy Hash: B3411C62621A0482FF579F33E96C3682361EB44FACF580666ED2A066D5CF7CCC458743

Function 0000024BB67202EC Relevance: 16.6, APIs: 11, Instructions: 81COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000024BB672031E

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

__doserrno.LIBCMT ref: 0000024BB6720315

Part of subcall function 0000024BB671AAA4: _getptd_noexit.LIBCMT ref: 0000024BB671AAA8

__doserrno.LIBCMT ref: 0000024BB672037B
_errno.LIBCMT ref: 0000024BB6720382
_invalid_parameter_noinfo.LIBCMT ref: 0000024BB67203E6

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction ID: 87445cf059692fac9fb6cf1c0a1c418b3e7eb9a25bf490335501394a227a5d94
Opcode Fuzzy Hash: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction Fuzzy Hash: AB319E62310A8487E717AF77998976D3691FB82FA8F45421AAE21477D3CB78CC41C722

Function 0000024BB6720F60 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000024BB6720F8B

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

__doserrno.LIBCMT ref: 0000024BB6720F83

Part of subcall function 0000024BB671AAA4: _getptd_noexit.LIBCMT ref: 0000024BB671AAA8

__lock_fhandle.LIBCMT ref: 0000024BB6720FCF
_lseek_nolock.LIBCMT ref: 0000024BB6720FE8
_unlock_fhandle.LIBCMT ref: 0000024BB6721009

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction ID: 9feb5db4d573c981118839238f2b6a331a8ca2b198aa15f60a092b599c605661
Opcode Fuzzy Hash: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction Fuzzy Hash: D4219D62620A8086F6276F37984936D6651FB82FA9F1A4115AE150B3D3CB7CCC419726

Function 0000024BB67210D8 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000024BB6721103

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

__doserrno.LIBCMT ref: 0000024BB67210FB

Part of subcall function 0000024BB671AAA4: _getptd_noexit.LIBCMT ref: 0000024BB671AAA8

__lock_fhandle.LIBCMT ref: 0000024BB6721147
_lseeki64_nolock.LIBCMT ref: 0000024BB6721160
_unlock_fhandle.LIBCMT ref: 0000024BB6721183

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction ID: 4eb959a89e02ef0969039dd281e4b409bb2acc77531e6b74670d18f36b26489c
Opcode Fuzzy Hash: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction Fuzzy Hash: F8217C22620A8446FA136F3798493AD6A51EB91FB9F1A4315AE350B7D3C73CCC818626

Function 0000024BB67292A0 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000024BB67292C6
_errno.LIBCMT ref: 0000024BB67292BB

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction ID: 619606878ecbab29a453aeb03ac86577904006545e0f45e9cb89ac1c5d43f31f
Opcode Fuzzy Hash: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction Fuzzy Hash: A741E771600B9982FF62EB3395483A936E1F756FACF984125EFA8436C6D728CC419712

Function 0000024BB671F904 Relevance: 13.6, APIs: 9, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000024BB671F92F

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

__doserrno.LIBCMT ref: 0000024BB671F927

Part of subcall function 0000024BB671AAA4: _getptd_noexit.LIBCMT ref: 0000024BB671AAA8

__lock_fhandle.LIBCMT ref: 0000024BB671F973
_unlock_fhandle.LIBCMT ref: 0000024BB671F9AD

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction ID: 13ef43b2fc70bf6281d9c4666d61c991a74ff4581a3275284dcf09ea416012b6
Opcode Fuzzy Hash: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction Fuzzy Hash: EA21CD6270068096F6136F37985936D6691EB80FA8F194216EE194B3D3CB7CCC41C7A2

Function 0000024BB671EC28 Relevance: 13.6, APIs: 9, Instructions: 57COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000024BB671EC49

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

__doserrno.LIBCMT ref: 0000024BB671EC41

Part of subcall function 0000024BB671AAA4: _getptd_noexit.LIBCMT ref: 0000024BB671AAA8

__lock_fhandle.LIBCMT ref: 0000024BB671EC8D
_close_nolock.LIBCMT ref: 0000024BB671ECA0
_unlock_fhandle.LIBCMT ref: 0000024BB671ECB9

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction ID: 0c1d4b278a752ad4a888aadb95e4133c75ea370cc23dcb1fe4ff7e0ac9883458
Opcode Fuzzy Hash: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction Fuzzy Hash: 6811D02271068082F617AF37AC8D36C7A52EB80FA9F190726AE1A073D3C778CC408716

Function 0000024BB66E3A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000024BB66E3AA9

Part of subcall function 0000024BB6718868: _FF_MSGBANNER.LIBCMT ref: 0000024BB6718898
Part of subcall function 0000024BB6718868: _NMSG_WRITE.LIBCMT ref: 0000024BB67188A2
Part of subcall function 0000024BB6718868: _callnewh.LIBCMT ref: 0000024BB67188D6
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188E1
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188EC

malloc.LIBCMT ref: 0000024BB66E3AB3

Part of subcall function 0000024BB6718868: _callnewh.LIBCMT ref: 0000024BB67188FC
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB6718901

malloc.LIBCMT ref: 0000024BB66E3ABE
free.LIBCMT ref: 0000024BB66E3C7E
free.LIBCMT ref: 0000024BB66E3C86
free.LIBCMT ref: 0000024BB66E3C8E

Part of subcall function 0000024BB66E48F0: malloc.LIBCMT ref: 0000024BB66E493A
Part of subcall function 0000024BB66E48F0: malloc.LIBCMT ref: 0000024BB66E4945
Part of subcall function 0000024BB66E48F0: free.LIBCMT ref: 0000024BB66E4A2C
Part of subcall function 0000024BB66E48F0: free.LIBCMT ref: 0000024BB66E4A34

free.LIBCMT ref: 0000024BB66E3C9A
free.LIBCMT ref: 0000024BB66E3CA7
free.LIBCMT ref: 0000024BB66E3CB4

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction ID: 906518769f2686682477d5c3a8a79d0ae0c204ce2e8ce07a3434b042cb2fdafd
Opcode Fuzzy Hash: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction Fuzzy Hash: 2671BD2271479546EB269E3694487EE7B91FB95FCCF404025DE4B6BB86DB38CC06CB02

Function 0000024BB6716C8C Relevance: 10.6, APIs: 7, Instructions: 145stringCOMMON

Download Yara Rule

APIs

_time64.LIBCMT ref: 0000024BB6716CA8
malloc.LIBCMT ref: 0000024BB6716CF3
strtok.LIBCMT ref: 0000024BB6716D5B
strtok.LIBCMT ref: 0000024BB6716D9B
_time64.LIBCMT ref: 0000024BB6716DB3
_time64.LIBCMT ref: 0000024BB6716E6B
_time64.LIBCMT ref: 0000024BB6716F2A

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _time64$strtok$malloc
String ID:
API String ID: 2141844861-0
Opcode ID: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction ID: 915ba175497ae88a0e2bd773c9321b67e58308550af64b949e0c030431497d98
Opcode Fuzzy Hash: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction Fuzzy Hash: 93911C72105B84CAE762CF26E8AC32577B0F344F5CF21422ADD99827A8DB7DC945DB02

Function 0000024BB671B198 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0000024BB671B1B5

Part of subcall function 0000024BB671EA24: _errno.LIBCMT ref: 0000024BB671EA2D
Part of subcall function 0000024BB671EA24: _invalid_parameter_noinfo.LIBCMT ref: 0000024BB671EA38

_errno.LIBCMT ref: 0000024BB671B1C5

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

_errno.LIBCMT ref: 0000024BB671B1E1
_isatty.LIBCMT ref: 0000024BB671B242
_getbuf.LIBCMT ref: 0000024BB671B24E

Strings

, xrefs: 0000024BB671B1D0

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-3916222277
Opcode ID: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction ID: 1147b452acc7e456f0ade73d58601659af8fd52e44c4f3e1a6a87f554745060b
Opcode Fuzzy Hash: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction Fuzzy Hash: 1F41F772610B4486EB6ADF3AD45936C37A0E744F9CF144216DE6A473D6DB38CC51CB82

Function 0000024BB6718DD8 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000024BB6718DFE

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000024BB6718E0A
__crtIsPackagedApp.LIBCMT ref: 0000024BB6718E1B
_dosmaperr.LIBCMT ref: 0000024BB6718E65

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction ID: 09063686a2f47f8471e62bc0b23b143a561c8d52c6f37a99a0cb2058abe0059b
Opcode Fuzzy Hash: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction Fuzzy Hash: F5315A62710B4486FB22AF77E80832966E1EB84F9CF14466A9E49477E6DF3CC9048706

Function 0000024BB6729120 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000024BB6729154

Part of subcall function 0000024BB671B324: _getptd.LIBCMT ref: 0000024BB671B33A
Part of subcall function 0000024BB671B324: __updatetlocinfo.LIBCMT ref: 0000024BB671B36F
Part of subcall function 0000024BB671B324: __updatetmbcinfo.LIBCMT ref: 0000024BB671B396

_errno.LIBCMT ref: 0000024BB672916F
_invalid_parameter_noinfo.LIBCMT ref: 0000024BB672917A

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction ID: a3e095acc66ad6d2f29334e769e31577c2063220aaaa4e6c0d75d2f1d4f6d76b
Opcode Fuzzy Hash: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction Fuzzy Hash: 21319372604B8886E7229F23948C79DB6A9F745FE8F584125EF5807BC5DB34CC81C701

Function 0000024BB6719AD0 Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000024BB6719B0C

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000024BB6719B17
memcpy_s.LIBCMT ref: 0000024BB6719BDC
_fileno.LIBCMT ref: 0000024BB6719C47
_filbuf.LIBCMT ref: 0000024BB6719C75
_errno.LIBCMT ref: 0000024BB6719CC5

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction ID: ccf995e59cd409313c857fc7b8cd177823c1d5cc3e0eef36d439bdcac7ef93f0
Opcode Fuzzy Hash: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction Fuzzy Hash: C651F33170524082FA6A8E37550876966D2F794FFCF184726AF7943BD5CB38CC938642

Function 0000024BB66F1C54 Relevance: 9.1, APIs: 6, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 0000024BB66F7380: malloc.LIBCMT ref: 0000024BB66F7397

Part of subcall function 0000024BB67195E8: _errno.LIBCMT ref: 0000024BB671953F
Part of subcall function 0000024BB67195E8: _invalid_parameter_noinfo.LIBCMT ref: 0000024BB671954A

fseek.LIBCMT ref: 0000024BB66F1D29
_ftelli64.LIBCMT ref: 0000024BB66F1D33
fseek.LIBCMT ref: 0000024BB66F1D47
fclose.LIBCMT ref: 0000024BB66F1D7E
fclose.LIBCMT ref: 0000024BB66F1DD3
malloc.LIBCMT ref: 0000024BB66F1DE2

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction ID: 0a1ec5f6b6d56895f06732d222480603eecd11ff14bb6ce4e0dfe11203c4b3e3
Opcode Fuzzy Hash: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction Fuzzy Hash: A4612D32218A8482E761DB26E45439EB761F7C5B98F104116FE9E43BA9DF3CC945CF42

Function 0000024BB67195E8 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000024BB671953F

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000024BB671954A
_getstream.LIBCMT ref: 0000024BB671956A
_errno.LIBCMT ref: 0000024BB671957C
_errno.LIBCMT ref: 0000024BB671958E
_openfile.LIBCMT ref: 0000024BB67195BC

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction ID: 1b500a3d899257c3eb8f77739184ac067bd33d2a6c646677ed0659f1215314f0
Opcode Fuzzy Hash: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction Fuzzy Hash: 9C21756131578685FB639F33A80935EA695EB44FC8F044422AE89977D6EB3CCD828712

Function 0000024BB66F0480 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000024BB66F0497

Part of subcall function 0000024BB6718868: _FF_MSGBANNER.LIBCMT ref: 0000024BB6718898
Part of subcall function 0000024BB6718868: _NMSG_WRITE.LIBCMT ref: 0000024BB67188A2
Part of subcall function 0000024BB6718868: _callnewh.LIBCMT ref: 0000024BB67188D6
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188E1
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188EC

free.LIBCMT ref: 0000024BB66F04E0

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction ID: 622c5b9692645c2aab3cf9f79b8d2fcda2cca19f3b06190fd8de1f9f29827f0f
Opcode Fuzzy Hash: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction Fuzzy Hash: 2D213872518A4081DA21EB22E45539E6761F7D4F9CF101216BEDF43AEADF3CC941CB42

Function 0000024BB671CE24 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 0000024BB671CE41

Part of subcall function 0000024BB671ABEC: _set_error_mode.LIBCMT ref: 0000024BB671ABF5
Part of subcall function 0000024BB671ABEC: _set_error_mode.LIBCMT ref: 0000024BB671AC04
Part of subcall function 0000024BB671ABEC: _NMSG_WRITE.LIBCMT ref: 0000024BB671AC1B
Part of subcall function 0000024BB671ABEC: _NMSG_WRITE.LIBCMT ref: 0000024BB671AC25

_NMSG_WRITE.LIBCMT ref: 0000024BB671CE4B

Part of subcall function 0000024BB671AC60: _set_error_mode.LIBCMT ref: 0000024BB671ACA5
Part of subcall function 0000024BB671AC60: _set_error_mode.LIBCMT ref: 0000024BB671ACB6
Part of subcall function 0000024BB671AC60: __crtMessageBoxW.LIBCMT ref: 0000024BB671ADC9

Part of subcall function 0000024BB6718F1C: __crtCorExitProcess.LIBCMT ref: 0000024BB6718F24
Part of subcall function 0000024BB6718F1C: free.LIBCMT ref: 0000024BB6718F62
Part of subcall function 0000024BB6718F1C: free.LIBCMT ref: 0000024BB6718F77
Part of subcall function 0000024BB6718F1C: free.LIBCMT ref: 0000024BB6718F98
Part of subcall function 0000024BB6718F1C: free.LIBCMT ref: 0000024BB6718FAD
Part of subcall function 0000024BB6718F1C: free.LIBCMT ref: 0000024BB6718FC1
Part of subcall function 0000024BB6718F1C: free.LIBCMT ref: 0000024BB6718FCD
Part of subcall function 0000024BB6718F1C: free.LIBCMT ref: 0000024BB6718FF8
Part of subcall function 0000024BB6718F1C: free.LIBCMT ref: 0000024BB6719019
Part of subcall function 0000024BB6718F1C: free.LIBCMT ref: 0000024BB6719032
Part of subcall function 0000024BB6718F1C: free.LIBCMT ref: 0000024BB6719063

_malloc_crt.LIBCMT ref: 0000024BB671CE77

Part of subcall function 0000024BB671D778: malloc.LIBCMT ref: 0000024BB671D7A3

_errno.LIBCMT ref: 0000024BB671CE84
_lock.LIBCMT ref: 0000024BB671CE98
free.LIBCMT ref: 0000024BB671CEB9

Part of subcall function 0000024BB6718828: _errno.LIBCMT ref: 0000024BB6718848

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_set_error_mode$__crt_errno$ExitMessageProcess_lock_malloc_crtmalloc
String ID:
API String ID: 2751257304-0
Opcode ID: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction ID: 67da883d038527e617eee726ce847b51ae266335c000f533a4b9b0b77e4de2b1
Opcode Fuzzy Hash: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction Fuzzy Hash: 4011A121220A8482F763AFB3E44E36923A1EB80F8CF041527ED4A466E2CF7CCD459753

Function 0000024BB66E3570 Relevance: 8.9, APIs: 7, Instructions: 115COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000024BB66E35BD

Part of subcall function 0000024BB6718868: _FF_MSGBANNER.LIBCMT ref: 0000024BB6718898
Part of subcall function 0000024BB6718868: _NMSG_WRITE.LIBCMT ref: 0000024BB67188A2
Part of subcall function 0000024BB6718868: _callnewh.LIBCMT ref: 0000024BB67188D6
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188E1
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188EC

malloc.LIBCMT ref: 0000024BB66E35C8

Part of subcall function 0000024BB6718868: _callnewh.LIBCMT ref: 0000024BB67188FC
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB6718901

free.LIBCMT ref: 0000024BB66E36AF
free.LIBCMT ref: 0000024BB66E36B7
free.LIBCMT ref: 0000024BB66E36BF
free.LIBCMT ref: 0000024BB66E36CB
free.LIBCMT ref: 0000024BB66E36D8

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction ID: c1a39cadc0ad6cbcffe72f3a71cec99547bdf3bc19a06a6fb9cfe134874f59d8
Opcode Fuzzy Hash: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction Fuzzy Hash: BB41DC223107919BEB56AF37A9583AA2794F749F88F904825DE461B741DF38DC26C702

Function 0000024BB66EBF50 Relevance: 7.8, APIs: 6, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 0000024BB66F7380: malloc.LIBCMT ref: 0000024BB66F7397

malloc.LIBCMT ref: 0000024BB66EC04E

Part of subcall function 0000024BB6718868: _FF_MSGBANNER.LIBCMT ref: 0000024BB6718898
Part of subcall function 0000024BB6718868: _NMSG_WRITE.LIBCMT ref: 0000024BB67188A2
Part of subcall function 0000024BB6718868: _callnewh.LIBCMT ref: 0000024BB67188D6
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188E1
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188EC

Part of subcall function 0000024BB6717EEC: malloc.LIBCMT ref: 0000024BB6717F27

Part of subcall function 0000024BB6717EEC: realloc.LIBCMT ref: 0000024BB6717F4E

malloc.LIBCMT ref: 0000024BB66EC182
_snprintf.LIBCMT ref: 0000024BB66EC210
_snprintf.LIBCMT ref: 0000024BB66EC24A
_snprintf.LIBCMT ref: 0000024BB66EC274
free.LIBCMT ref: 0000024BB66EC47B

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$_callnewhfreerealloc
String ID:
API String ID: 74200508-0
Opcode ID: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction ID: 2778853a5664b73b36ed3795ba271c3582493a81e7444d363866dcbf5ea24d9a
Opcode Fuzzy Hash: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction Fuzzy Hash: 37D12D712146808AF752EB76E4593EEB7A1E7C4B48F104126AE9A876D6DF3CCC05CB43

Function 0000024BB66E48F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000024BB66E493A

Part of subcall function 0000024BB6718868: _FF_MSGBANNER.LIBCMT ref: 0000024BB6718898
Part of subcall function 0000024BB6718868: _NMSG_WRITE.LIBCMT ref: 0000024BB67188A2
Part of subcall function 0000024BB6718868: _callnewh.LIBCMT ref: 0000024BB67188D6
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188E1
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188EC

malloc.LIBCMT ref: 0000024BB66E4945

Part of subcall function 0000024BB6718868: _callnewh.LIBCMT ref: 0000024BB67188FC
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB6718901

free.LIBCMT ref: 0000024BB66E4A2C
free.LIBCMT ref: 0000024BB66E4A34
free.LIBCMT ref: 0000024BB66E4A40
free.LIBCMT ref: 0000024BB66E4A4D

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction ID: d19477e4331ea4c8c25e395f90c24eca088581253bed2b1ae586ed83c18a9261
Opcode Fuzzy Hash: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction Fuzzy Hash: 0241BC2222468547EB16AF3B64087AA6799F795F9CF494034DD068B749EF38CC0AC306

Function 0000024BB6723AC8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000024BB6723AD9

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

__doserrno.LIBCMT ref: 0000024BB6723AD1

Part of subcall function 0000024BB671AAA4: _getptd_noexit.LIBCMT ref: 0000024BB671AAA8

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction ID: 42fd43e0825d423e058e9978ed9067deff223a0b9350ecf90e868cdb5a76dab1
Opcode Fuzzy Hash: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction Fuzzy Hash: D50131A1715E8486FA175F3BC4893587792DF51F79F554315DE2A063D2C72CCC418613

Function 0000024BB66F27EC Relevance: 7.5, APIs: 5, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000024BB66F2804

Part of subcall function 0000024BB6718868: _FF_MSGBANNER.LIBCMT ref: 0000024BB6718898
Part of subcall function 0000024BB6718868: _NMSG_WRITE.LIBCMT ref: 0000024BB67188A2
Part of subcall function 0000024BB6718868: _callnewh.LIBCMT ref: 0000024BB67188D6
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188E1
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188EC

_snprintf.LIBCMT ref: 0000024BB66F282E

Part of subcall function 0000024BB6718B00: _errno.LIBCMT ref: 0000024BB6718B37
Part of subcall function 0000024BB6718B00: _invalid_parameter_noinfo.LIBCMT ref: 0000024BB6718B42

remove.LIBCMT ref: 0000024BB66F283F
remove.LIBCMT ref: 0000024BB66F284B
free.LIBCMT ref: 0000024BB66F2855

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction ID: 7f9a3c723011956e4d91b16c378e0ba8b966a3a6b7c624a47a4b0f068d5bb62b
Opcode Fuzzy Hash: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction Fuzzy Hash: 87F0EC72538A8086D641EF62F45575EA364FBC4B84F401116BE8E53B59CF78C815CB41

Function 0000024BB6715CD4 Relevance: 6.4, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000024BB6715D17
free.LIBCMT ref: 0000024BB6715D3C

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction ID: e179124e4645d7e598fa004959ef767af9f823e15c582279d759025aba7f3ca7
Opcode Fuzzy Hash: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction Fuzzy Hash: 568164726186808AE765DF36E44839EB7A1F384B48F500426EE8987A99DF7DCD45CF02

Function 0000024BB67186BC Relevance: 6.3, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000024BB67186D6

Part of subcall function 0000024BB6718868: _FF_MSGBANNER.LIBCMT ref: 0000024BB6718898
Part of subcall function 0000024BB6718868: _NMSG_WRITE.LIBCMT ref: 0000024BB67188A2
Part of subcall function 0000024BB6718868: _callnewh.LIBCMT ref: 0000024BB67188D6
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188E1
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188EC

malloc.LIBCMT ref: 0000024BB67186F5

Part of subcall function 0000024BB6718868: _callnewh.LIBCMT ref: 0000024BB67188FC
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB6718901

malloc.LIBCMT ref: 0000024BB671872C
_snprintf.LIBCMT ref: 0000024BB6718758

Part of subcall function 0000024BB6718B00: _errno.LIBCMT ref: 0000024BB6718B37
Part of subcall function 0000024BB6718B00: _invalid_parameter_noinfo.LIBCMT ref: 0000024BB6718B42

malloc.LIBCMT ref: 0000024BB671879B

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction ID: 9402ca7eda96e44352714a97f64c5a71600f257983ec71772409199ac1cc3c73
Opcode Fuzzy Hash: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction Fuzzy Hash: 1C21A276618B8486DB65DB16E49425AB7A0F3C8B98F104216EEDD47BA8CF38C952CF40

Function 0000024BB67195F4 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000024BB671962C

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000024BB6719637
_flush.LIBCMT ref: 0000024BB67196E9
_fileno.LIBCMT ref: 0000024BB671970A

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction ID: 74962387ad8ae9e60ce47dff64985116f1168b9b14285df19aac9233a6b31ee1
Opcode Fuzzy Hash: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction Fuzzy Hash: 4641162130038486FE6A9E73594C36AB691FB44FECF1842269F6647BC5EB78DD438642

Function 0000024BB6728B28 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000024BB6728B4C

Part of subcall function 0000024BB671B324: _getptd.LIBCMT ref: 0000024BB671B33A
Part of subcall function 0000024BB671B324: __updatetlocinfo.LIBCMT ref: 0000024BB671B36F
Part of subcall function 0000024BB671B324: __updatetmbcinfo.LIBCMT ref: 0000024BB671B396

_errno.LIBCMT ref: 0000024BB6728B58

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000024BB6728B63
strchr.LIBCMT ref: 0000024BB6728B79

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction ID: 1e063ebf01faf69a1150976bb972411b4e451cc3ca9dfc09688b4f591824896c
Opcode Fuzzy Hash: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction Fuzzy Hash: 68212792604AE4C1EB625637905833D66D1E342FDCF1C41A9EE8607BC5CB2DCC45C712

Function 0000024BB66E04D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

clock.LIBCMT ref: 0000024BB66E0517
clock.LIBCMT ref: 0000024BB66E0524
clock.LIBCMT ref: 0000024BB66E052D
clock.LIBCMT ref: 0000024BB66E053A

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: d03712ea6dff40dc61df695a72462f45a6042f5138b97e015bd1273f2220f335
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: F4112932904B4545F772DFB679843ABB6D0FB88B9CF191025EE4643245EB74CC95C602

Function 0000024BB66F70FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000024BB66F7380: malloc.LIBCMT ref: 0000024BB66F7397

strrchr.LIBCMT ref: 0000024BB66F71F2
_snprintf.LIBCMT ref: 0000024BB66F730C

Strings

:, xrefs: 0000024BB66F734F

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _snprintfmallocstrrchr
String ID: :
API String ID: 3587327836-336475711
Opcode ID: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction ID: 260200eb37a566cccabc5da04ea67aadb7ed8fa7dac637dac08793b86dd2773a
Opcode Fuzzy Hash: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction Fuzzy Hash: D261C632219A8486E751DF25F88439EBBA0F3C9B98F105115EECE47BA9DF79C845CB01

Function 0000024BB67212F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__crtCapturePreviousContext.LIBCMT ref: 0000024BB67217B5
__raise_securityfailure.LIBCMT ref: 0000024BB6721857

Strings

sv-FI, xrefs: 0000024BB6721850

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: CaptureContextPrevious__crt__raise_securityfailure
String ID: sv-FI
API String ID: 37250909-2947700294
Opcode ID: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction ID: 8ea26f0abc89613b1a96b5821853b6efa0751a775851e303e08b6b3d9813f085
Opcode Fuzzy Hash: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction Fuzzy Hash: 4B210D35225B0481FA029B2AE85D35573A4F385B8CFA00226EE8E867A2DF3CCC05C702

Function 0000024BB6718D24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000024BB6718D75

Part of subcall function 0000024BB671AB14: _getptd_noexit.LIBCMT ref: 0000024BB671AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000024BB6718D80

Strings

B, xrefs: 0000024BB6718DAC

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction ID: 810128b37642b679146c95f9b922a056a38c7385eaa611e2dc869409fd8e5226
Opcode Fuzzy Hash: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction Fuzzy Hash: 1F11C472610B4486EB11DF63E444399B661F798FE8F684322AF5807BD6CF38C645CB01

Function 0000024BB66E10C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMON

Download Yara Rule

APIs

calloc.LIBCMT ref: 0000024BB66E116A

Part of subcall function 0000024BB6728358: _calloc_impl.LIBCMT ref: 0000024BB6728368
Part of subcall function 0000024BB6728358: _errno.LIBCMT ref: 0000024BB672837B
Part of subcall function 0000024BB6728358: _errno.LIBCMT ref: 0000024BB6728385

free.LIBCMT ref: 0000024BB66E12F3
free.LIBCMT ref: 0000024BB66E12FD
free.LIBCMT ref: 0000024BB66E130F

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction ID: 0e651f792154893bda1e377a33ccc8d07863f73d8aca2d5c384e29d82833010c
Opcode Fuzzy Hash: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction Fuzzy Hash: 28C1FE32614B848AE765CF66E48439EB7E4F388B88F10412AEF8E47B58DF38C455CB01

Function 0000024BB66FAD40 Relevance: 5.2, APIs: 4, Instructions: 234COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000024BB66FADAA

Part of subcall function 0000024BB6718868: _FF_MSGBANNER.LIBCMT ref: 0000024BB6718898
Part of subcall function 0000024BB6718868: _NMSG_WRITE.LIBCMT ref: 0000024BB67188A2
Part of subcall function 0000024BB6718868: _callnewh.LIBCMT ref: 0000024BB67188D6
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188E1
Part of subcall function 0000024BB6718868: _errno.LIBCMT ref: 0000024BB67188EC

free.LIBCMT ref: 0000024BB66FB1E3

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction ID: 45b03f3912c896af96a79e41987ab887a8ded2ea1445999a0698978a5021a965
Opcode Fuzzy Hash: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction Fuzzy Hash: 0AC1DCB62196C0CAD771CA25E49439FB7A0F799B99F501129EFCA43B58DB39C840CF06

Function 0000024BB66EEFEC Relevance: 5.1, APIs: 4, Instructions: 144COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000024BB66EF0A9
_snprintf.LIBCMT ref: 0000024BB66EF0C9
_snprintf.LIBCMT ref: 0000024BB66EF19A

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction ID: 2554e1112e6db96e70e5d3eddaf4dd8429cc2cab08b20975c7f0d3090f8239fc
Opcode Fuzzy Hash: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction Fuzzy Hash: 6781EA36208AC486EB21DB61F45839AB761F395B98F504216DE9E43BA9DF3CC845CB41

Function 0000024BB66E3700 Relevance: 5.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000024BB66E3763

Memory Dump Source

Source File: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction ID: f3d7fab3e7d0d70a64d5647fde064c486f7073cb745862cd4d7694ab0c9e8552
Opcode Fuzzy Hash: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction Fuzzy Hash: 65417C3261068097EB5ADF36A4187AE77A1F744F88F444825EE5BA7B85EF34DC05C701

Function 0000024BB6716994 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000024BB6716A1F
_snprintf.LIBCMT ref: 0000024BB6716A44
_snprintf.LIBCMT ref: 0000024BB6716AA4
_snprintf.LIBCMT ref: 0000024BB6716AC9

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: 6383a7835a4b65a47cfb1c067873db5a66ec93dca46c4c5e3f535797e85619d2
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: D0311032214A8482E622DF62E8583D97770F385B68F544227EEAD43BE9DF7CC945CB01

Function 0000024BB6717104 Relevance: 5.0, APIs: 4, Instructions: 50stringCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000024BB671714E
strtok.LIBCMT ref: 0000024BB67171AC
strtok.LIBCMT ref: 0000024BB67171BE
free.LIBCMT ref: 0000024BB67171D7

Memory Dump Source

Source File: 00000000.00000003.2726426387.0000024BB66FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000024BB66E0000, based on PE: true

Associated: 00000000.00000003.2726394153.0000024BB66E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2726426387.0000024BB673C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_24bb66e0000_loaddll64.jbxd

Yara matches

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction ID: 7ecef2267cbeea8be8da09345ce9fe21223c3b7d6b11548f51480c33d94ccb6e
Opcode Fuzzy Hash: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction Fuzzy Hash: 4121DB32114B4485EA62DF26F86835A7761F3C5BA8F501316EE9E437E9CF38C9419701

Analysis Process: rundll32.exePID: 1588, Parent PID: 2268COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	25

Executed Functions

Function 0000012E545D7CFC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 187
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000012E545D7F80: malloc.LIBCMT ref: 0000012E545D7F97

GetUserNameA.ADVAPI32 ref: 0000012E545D7DAA

Part of subcall function 0000012E545D00A4: WSASocketA.WS2_32 ref: 0000012E545D00E0

strrchr.LIBCMT ref: 0000012E545D7DF2
_snprintf.LIBCMT ref: 0000012E545D7F0C

Strings

:, xrefs: 0000012E545D7F4F

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: NameSocketUser_snprintfmallocstrrchr
String ID: :
API String ID: 1789932928-336475711
Opcode ID: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction ID: 2ba64ad800ae3ff22f48e4a9768e5814dca668214bab711b90010fab9ae01c5c
Opcode Fuzzy Hash: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction Fuzzy Hash: 1471ED74228B488FE394EF28C485B9AB7E1FBC9344F50496DF589C32A1CB74D851CB02

Function 0000012E52D7D107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000012E52D7D166
VirtualProtect.KERNELBASE ref: 0000012E52D7D1AF

Strings

DCBA, xrefs: 0000012E52D7D141

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: DCBA
API String ID: 544645111-2222620526
Opcode ID: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction ID: 7e98d1ba1d6d461be3d743730bc28cf053615c94fac7f4bc525e7004a297dd73
Opcode Fuzzy Hash: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction Fuzzy Hash: 1741E376201B858EDB20CF69D9807DC37E1E749BACF159216FE1D87B98DB38C9948740

Function 0000012E545DD0FC Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 110
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 0000012E545DD1AB
(, xrefs: 0000012E545DD1A3

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID:
String ID: ($0
API String ID: 0-506339136
Opcode ID: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction ID: 81e9da950a7187221b7d08c36332dd6851953cfd3e1688357f7481d5e5bad5d5
Opcode Fuzzy Hash: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction Fuzzy Hash: 6C4132742287458FF7A4EF28D4947AAB7E1FF98349F50492DE089C32A1DB75C949CB02

Function 0000012E545D00A4 Relevance: 4.6, APIs: 3, Instructions: 93
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32 ref: 0000012E545D00E0
WSAIoctl.WS2_32 ref: 0000012E545D013B
closesocket.WS2_32 ref: 0000012E545D01CA

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: IoctlSocketclosesocket
String ID:
API String ID: 3445158922-0
Opcode ID: 2b1563ebb8b5cee2362f50e6a9862c7e044125dd490747691ac161b43e72dde1
Instruction ID: 7bc5b4569460b73eb03f73d9416982208fd2af54551871170bc2510928a55a73
Opcode Fuzzy Hash: 2b1563ebb8b5cee2362f50e6a9862c7e044125dd490747691ac161b43e72dde1
Instruction Fuzzy Hash: DF31FD746187858FE350EF68C84579AFBE4FB88348F50492DE49AC6290D7B8D5558B02

Function 0000012E545CF9C0 Relevance: 1.6, APIs: 1, Instructions: 150
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 0000012E545CFA7C

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 170dc46f2207cb387e16a0227af4bff50695bdbce6e0c670e9cf9a8f94b52204
Instruction ID: f35e93569bbcd679985d057f46f76907d09ab301cc993b842e59d75dd5ca712b
Opcode Fuzzy Hash: 170dc46f2207cb387e16a0227af4bff50695bdbce6e0c670e9cf9a8f94b52204
Instruction Fuzzy Hash: 4F5181756287448FF354EF18C859BABB7E1FB89309F40442DE286D36E5CB788855CB42

Non-executed Functions

Function 0000012E52D9F9E4 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0000012E52D9FA3A
_errno.LIBCMT ref: 0000012E52D9FA41
_invalid_parameter_noinfo.LIBCMT ref: 0000012E52D9FA4C

Strings

U, xrefs: 0000012E52D9FFAE

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction ID: ae7f653072e81e63b33835bd4376d5c3ff823f71432a4b10e0be498838f5059e
Opcode Fuzzy Hash: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction Fuzzy Hash: EA12E23B2246818AEB208F28D4847EEB7E1F78779CF504117FA89476A4DB3DC865CB10

Function 0000012E52D9B3CC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000012E52D9B42D

Part of subcall function 0000012E52D9B324: _getptd.LIBCMT ref: 0000012E52D9B33A
Part of subcall function 0000012E52D9B324: __updatetlocinfo.LIBCMT ref: 0000012E52D9B36F
Part of subcall function 0000012E52D9B324: __updatetmbcinfo.LIBCMT ref: 0000012E52D9B396

_fileno.LIBCMT ref: 0000012E52D9B45F

Part of subcall function 0000012E52D9EA24: _errno.LIBCMT ref: 0000012E52D9EA2D
Part of subcall function 0000012E52D9EA24: _invalid_parameter_noinfo.LIBCMT ref: 0000012E52D9EA38

write_multi_char.LIBCMT ref: 0000012E52D9BA8F
write_string.LIBCMT ref: 0000012E52D9BAAC
_errno.LIBCMT ref: 0000012E52D9B432

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

_errno.LIBCMT ref: 0000012E52D9BD97
_invalid_parameter_noinfo.LIBCMT ref: 0000012E52D9BDA2

Strings

@, xrefs: 0000012E52D9B44B
-, xrefs: 0000012E52D9BA40

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$@
API String ID: 3246410048-1222683799
Opcode ID: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction ID: 7ffa29cecbf057997b35bd4bcad20fa84c12b90cbc6ec027b27cbb2ea23a770c
Opcode Fuzzy Hash: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction Fuzzy Hash: D6B1E27B624A8485FB65CB6994403EE6BE1F787BDCF160107FE4907AD8DB38C9618B40

Function 0000012E54600EEC Relevance: 16.6, APIs: 11, Instructions: 108
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000012E54600F1E

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

__doserrno.LIBCMT ref: 0000012E54600F15

Part of subcall function 0000012E545FB6A4: _getptd_noexit.LIBCMT ref: 0000012E545FB6A8

__doserrno.LIBCMT ref: 0000012E54600F7B
_errno.LIBCMT ref: 0000012E54600F82
_invalid_parameter_noinfo.LIBCMT ref: 0000012E54600FE6

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction ID: def61a2412e3307febaf492ec754c7cabb0f87c7f8a9e5d4f24a88bdbb0d2aa6
Opcode Fuzzy Hash: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction Fuzzy Hash: 12315CB9338B44DFF716AF6998863FC32C0EB41324F11425DE816872D3E6B09C119752

Function 0000012E52D98F1C Relevance: 16.6, APIs: 11, Instructions: 82COMMON

Download Yara Rule

APIs

__crtCorExitProcess.LIBCMT ref: 0000012E52D98F24
free.LIBCMT ref: 0000012E52D98F62

Part of subcall function 0000012E52D98828: _errno.LIBCMT ref: 0000012E52D98848

free.LIBCMT ref: 0000012E52D98F77
free.LIBCMT ref: 0000012E52D98F98
free.LIBCMT ref: 0000012E52D98FAD
free.LIBCMT ref: 0000012E52D98FC1
free.LIBCMT ref: 0000012E52D98FCD
free.LIBCMT ref: 0000012E52D98FF8
free.LIBCMT ref: 0000012E52D99019
free.LIBCMT ref: 0000012E52D99032
free.LIBCMT ref: 0000012E52D99063

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: free$ExitProcess__crt_errno
String ID:
API String ID: 1362684943-0
Opcode ID: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction ID: 5293ac90b3fcc0392f6d6dfeaee4ab518cdea294957ce92b8c3aa53169d8f29e
Opcode Fuzzy Hash: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction Fuzzy Hash: B9410A3D631A0485FE54AF11F9A53F863E0AB5BBADF081627FA19566D2CF3C84758310

Function 0000012E52DA02EC Relevance: 16.6, APIs: 11, Instructions: 81COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E52DA031E

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

__doserrno.LIBCMT ref: 0000012E52DA0315

Part of subcall function 0000012E52D9AAA4: _getptd_noexit.LIBCMT ref: 0000012E52D9AAA8

__doserrno.LIBCMT ref: 0000012E52DA037B
_errno.LIBCMT ref: 0000012E52DA0382
_invalid_parameter_noinfo.LIBCMT ref: 0000012E52DA03E6

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction ID: ce340201bed6397dc7b377ad46245fa54403332bc0dabb51e625efed5d51b2d9
Opcode Fuzzy Hash: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction Fuzzy Hash: 3F31D23A33828087E716AF659981BED37D1AB827ACF454217FA51177D2CB7CC861C710

Function 0000012E54601CD8 Relevance: 15.1, APIs: 10, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000012E54601D03

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

__doserrno.LIBCMT ref: 0000012E54601CFB

Part of subcall function 0000012E545FB6A4: _getptd_noexit.LIBCMT ref: 0000012E545FB6A8

__lock_fhandle.LIBCMT ref: 0000012E54601D47
_lseeki64_nolock.LIBCMT ref: 0000012E54601D60
_unlock_fhandle.LIBCMT ref: 0000012E54601D83

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction ID: 3a0ecc39b876e909c502ece9971e8ef8ac5319c19bf964ef02f87fd573ee8cbd
Opcode Fuzzy Hash: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction Fuzzy Hash: A5213679738A009FF71AAF98DC863F972D0EB85328F15025EE01EC71D3C6F158218662

Function 0000012E54601B60 Relevance: 15.1, APIs: 10, Instructions: 88
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000012E54601B8B

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

__doserrno.LIBCMT ref: 0000012E54601B83

Part of subcall function 0000012E545FB6A4: _getptd_noexit.LIBCMT ref: 0000012E545FB6A8

__lock_fhandle.LIBCMT ref: 0000012E54601BCF
_lseek_nolock.LIBCMT ref: 0000012E54601BE8
_unlock_fhandle.LIBCMT ref: 0000012E54601C09

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction ID: b256633c37488837fcb5f3a475ed18a3e5a015fc3695014714cf7acd3b3fcf76
Opcode Fuzzy Hash: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction Fuzzy Hash: A32128B9728600CFF71A6F5CD8863FD72D4EB82328F15061CE15A872D3D7F898618262

Function 0000012E52DA0F60 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E52DA0F8B

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

__doserrno.LIBCMT ref: 0000012E52DA0F83

Part of subcall function 0000012E52D9AAA4: _getptd_noexit.LIBCMT ref: 0000012E52D9AAA8

__lock_fhandle.LIBCMT ref: 0000012E52DA0FCF
_lseek_nolock.LIBCMT ref: 0000012E52DA0FE8
_unlock_fhandle.LIBCMT ref: 0000012E52DA1009

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction ID: 78ed69b2dd215e0abac99c68acf4ccd85bdce9ffadecde4633c239e88a79fe11
Opcode Fuzzy Hash: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction Fuzzy Hash: E721323A33028046F7056F25D842BEC76D2AB837A9F690106FA151B3D2CB7CC861C325

Function 0000012E52DA10D8 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E52DA1103

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

__doserrno.LIBCMT ref: 0000012E52DA10FB

Part of subcall function 0000012E52D9AAA4: _getptd_noexit.LIBCMT ref: 0000012E52D9AAA8

__lock_fhandle.LIBCMT ref: 0000012E52DA1147
_lseeki64_nolock.LIBCMT ref: 0000012E52DA1160
_unlock_fhandle.LIBCMT ref: 0000012E52DA1183

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction ID: a928c70680548f8667c214721e88410942d32d6546574b7e3b2929623d39425e
Opcode Fuzzy Hash: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction Fuzzy Hash: D921F03B73424046FA056F159841BED6AD2AB82BF8F99471AFE350B3D2CB3CC4618724

Function 0000012E54609EA0 Relevance: 13.7, APIs: 9, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012E54609EC6
_errno.LIBCMT ref: 0000012E54609EBB

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: 181d52bcb5af38a644f949309eae4e32f5a35df007ff24cdcce28bd57c8089db
Instruction ID: 7267c1dab3fe0b125fbea687fd050130d43541b656246bbb7b5b521d103ef1a6
Opcode Fuzzy Hash: 181d52bcb5af38a644f949309eae4e32f5a35df007ff24cdcce28bd57c8089db
Instruction Fuzzy Hash: DA516778335B0ACBFB65AF1884453F672D2FB6436DF54022AE09AC31D6E6B4CC618342

Function 0000012E52DA92A0 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012E52DA92C6
_errno.LIBCMT ref: 0000012E52DA92BB

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction ID: f71edbd1215a42e0d9cd705217baaa40f1e3709d0ad2856c1815618c1009cd5d
Opcode Fuzzy Hash: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction Fuzzy Hash: 7C41047A63139186FF60EB2185C0BED76E1E757BACF908127FA94477C5D728C8618700

Function 0000012E54600504 Relevance: 13.6, APIs: 9, Instructions: 89
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000012E5460052F

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

__doserrno.LIBCMT ref: 0000012E54600527

Part of subcall function 0000012E545FB6A4: _getptd_noexit.LIBCMT ref: 0000012E545FB6A8

__lock_fhandle.LIBCMT ref: 0000012E54600573
_unlock_fhandle.LIBCMT ref: 0000012E546005AD

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction ID: f2015d47d1c0bc091e46251a26c092656c5b0965384fde1e6f17cff11942679c
Opcode Fuzzy Hash: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction Fuzzy Hash: CC213B797287009FF31B6F58E8463F872C0DB46324F15021DE01A871D3E6F49C2186A6

Function 0000012E545FF828 Relevance: 13.6, APIs: 9, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000012E545FF849

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

__doserrno.LIBCMT ref: 0000012E545FF841

Part of subcall function 0000012E545FB6A4: _getptd_noexit.LIBCMT ref: 0000012E545FB6A8

__lock_fhandle.LIBCMT ref: 0000012E545FF88D
_close_nolock.LIBCMT ref: 0000012E545FF8A0
_unlock_fhandle.LIBCMT ref: 0000012E545FF8B9

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction ID: 3d02baf57787b660d526663b0e99dbeaffb48b50044237b107bd734b18bd149d
Opcode Fuzzy Hash: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction Fuzzy Hash: BE213ABB725A80AFF715BF65C8853E876D0EF41328F65051EF016872D7C6B488108723

Function 0000012E52D9F904 Relevance: 13.6, APIs: 9, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E52D9F92F

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

__doserrno.LIBCMT ref: 0000012E52D9F927

Part of subcall function 0000012E52D9AAA4: _getptd_noexit.LIBCMT ref: 0000012E52D9AAA8

__lock_fhandle.LIBCMT ref: 0000012E52D9F973
_unlock_fhandle.LIBCMT ref: 0000012E52D9F9AD

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction ID: ea61b64b4d46cb6ee62ce4ba7bdaa61e96c074f50e1652d2cbd7a59a68f31d93
Opcode Fuzzy Hash: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction Fuzzy Hash: 4A21C33B7346406EF6056F2599413EDA6D2AB83BADF194117BA190B3D2CB7CC861C721

Function 0000012E52D9EC28 Relevance: 13.6, APIs: 9, Instructions: 57COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E52D9EC49

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

__doserrno.LIBCMT ref: 0000012E52D9EC41

Part of subcall function 0000012E52D9AAA4: _getptd_noexit.LIBCMT ref: 0000012E52D9AAA8

__lock_fhandle.LIBCMT ref: 0000012E52D9EC8D
_close_nolock.LIBCMT ref: 0000012E52D9ECA0
_unlock_fhandle.LIBCMT ref: 0000012E52D9ECB9

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction ID: 2533aee8b737c87cd6a3c4b5d2ea3f087227b37b7853418fc884301d3ece3b6c
Opcode Fuzzy Hash: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction Fuzzy Hash: 5211083B33468046F70AAF2598813DC66D1A7837A9F190627FA55073D3C77CC861C714

Function 0000012E545F9B34 Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0000012E545F9B62

Part of subcall function 0000012E545F9428: RtlFreeHeap.NTDLL ref: 0000012E545F943E
Part of subcall function 0000012E545F9428: _errno.LIBCMT ref: 0000012E545F9448

free.LIBCMT ref: 0000012E545F9B77
free.LIBCMT ref: 0000012E545F9B98
free.LIBCMT ref: 0000012E545F9BAD
free.LIBCMT ref: 0000012E545F9BC1
free.LIBCMT ref: 0000012E545F9BCD
free.LIBCMT ref: 0000012E545F9BF8
free.LIBCMT ref: 0000012E545F9C19
free.LIBCMT ref: 0000012E545F9C32
free.LIBCMT ref: 0000012E545F9C63

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: free$FreeHeap_errno
String ID:
API String ID: 2737118440-0
Opcode ID: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction ID: 8a1e24905712a1c7297add39a3f92bf7d600e4db0ac441937768aa5354c4ad74
Opcode Fuzzy Hash: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction Fuzzy Hash: DF410F76378E0EAFFBA8EF58DCD5BE972D1F758319F5440289005C2291EA2C9865CB12

Function 0000012E545C460C Relevance: 11.6, APIs: 9, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E545C46A9

Part of subcall function 0000012E545F9468: _FF_MSGBANNER.LIBCMT ref: 0000012E545F9498
Part of subcall function 0000012E545F9468: _NMSG_WRITE.LIBCMT ref: 0000012E545F94A2
Part of subcall function 0000012E545F9468: _callnewh.LIBCMT ref: 0000012E545F94D6
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94E1
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94EC

malloc.LIBCMT ref: 0000012E545C46B3

Part of subcall function 0000012E545F9468: _callnewh.LIBCMT ref: 0000012E545F94FC
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F9501

malloc.LIBCMT ref: 0000012E545C46BE
free.LIBCMT ref: 0000012E545C487E
free.LIBCMT ref: 0000012E545C4886
free.LIBCMT ref: 0000012E545C488E

Part of subcall function 0000012E545C54F0: malloc.LIBCMT ref: 0000012E545C553A
Part of subcall function 0000012E545C54F0: malloc.LIBCMT ref: 0000012E545C5545
Part of subcall function 0000012E545C54F0: free.LIBCMT ref: 0000012E545C562C
Part of subcall function 0000012E545C54F0: free.LIBCMT ref: 0000012E545C5634

free.LIBCMT ref: 0000012E545C489A
free.LIBCMT ref: 0000012E545C48A7
free.LIBCMT ref: 0000012E545C48B4

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction ID: 88c42e9adc2db6f148822f0fc7bdbfb47b4ba4f58a35c1ff2a0c170b6f9669eb
Opcode Fuzzy Hash: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction Fuzzy Hash: 1C91C974328B484BE759AF6C9851FF973D1FB96708F50021ED58AC32C3EE20DC128682

Function 0000012E52D63A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E52D63AA9

Part of subcall function 0000012E52D98868: _FF_MSGBANNER.LIBCMT ref: 0000012E52D98898
Part of subcall function 0000012E52D98868: _NMSG_WRITE.LIBCMT ref: 0000012E52D988A2
Part of subcall function 0000012E52D98868: _callnewh.LIBCMT ref: 0000012E52D988D6
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988E1
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988EC

malloc.LIBCMT ref: 0000012E52D63AB3

Part of subcall function 0000012E52D98868: _callnewh.LIBCMT ref: 0000012E52D988FC
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D98901

malloc.LIBCMT ref: 0000012E52D63ABE
free.LIBCMT ref: 0000012E52D63C7E
free.LIBCMT ref: 0000012E52D63C86
free.LIBCMT ref: 0000012E52D63C8E

Part of subcall function 0000012E52D648F0: malloc.LIBCMT ref: 0000012E52D6493A
Part of subcall function 0000012E52D648F0: malloc.LIBCMT ref: 0000012E52D64945
Part of subcall function 0000012E52D648F0: free.LIBCMT ref: 0000012E52D64A2C
Part of subcall function 0000012E52D648F0: free.LIBCMT ref: 0000012E52D64A34

free.LIBCMT ref: 0000012E52D63C9A
free.LIBCMT ref: 0000012E52D63CA7
free.LIBCMT ref: 0000012E52D63CB4

Memory Dump Source

Source File: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction ID: 0fc445f85f95b3515e56185072e4bfd21ce4c33d111add07f04074ba6577d6a7
Opcode Fuzzy Hash: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction Fuzzy Hash: 9C71E43A72478546EA689B2A94407EEB7D2F787FCCF414026FD4647B86DB38D466C700

Function 0000012E52D96C8C Relevance: 10.6, APIs: 7, Instructions: 145stringCOMMON

Download Yara Rule

APIs

_time64.LIBCMT ref: 0000012E52D96CA8
malloc.LIBCMT ref: 0000012E52D96CF3
strtok.LIBCMT ref: 0000012E52D96D5B
strtok.LIBCMT ref: 0000012E52D96D9B
_time64.LIBCMT ref: 0000012E52D96DB3
_time64.LIBCMT ref: 0000012E52D96E6B
_time64.LIBCMT ref: 0000012E52D96F2A

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _time64$strtok$malloc
String ID:
API String ID: 2141844861-0
Opcode ID: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction ID: 827bd67fa2d4e0ebd8f03b6e6927f3820694718f6efda80e976c1e2d054472d5
Opcode Fuzzy Hash: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction Fuzzy Hash: DC910579129A448AE764CF19E8953A9B7E4F34A75CF10821BF69A937E4CF7DC060CB40

Function 0000012E52D9B198 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0000012E52D9B1B5

Part of subcall function 0000012E52D9EA24: _errno.LIBCMT ref: 0000012E52D9EA2D
Part of subcall function 0000012E52D9EA24: _invalid_parameter_noinfo.LIBCMT ref: 0000012E52D9EA38

_errno.LIBCMT ref: 0000012E52D9B1C5

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

_errno.LIBCMT ref: 0000012E52D9B1E1
_isatty.LIBCMT ref: 0000012E52D9B242
_getbuf.LIBCMT ref: 0000012E52D9B24E

Strings

, xrefs: 0000012E52D9B1D0

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-3916222277
Opcode ID: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction ID: 111f5497c97a9cd1a28ad9d08bc836a9e56f2be03008c1637e58d254c0fa7a06
Opcode Fuzzy Hash: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction Fuzzy Hash: BC41E57B620B444AEB58DF29C4513AC37E0E786B9CF158217FA66473D5DB38C861C740

Function 0000012E54609D20 Relevance: 10.6, APIs: 7, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000012E54609D54

Part of subcall function 0000012E545FBF24: _getptd.LIBCMT ref: 0000012E545FBF3A
Part of subcall function 0000012E545FBF24: __updatetlocinfo.LIBCMT ref: 0000012E545FBF6F
Part of subcall function 0000012E545FBF24: __updatetmbcinfo.LIBCMT ref: 0000012E545FBF96

_errno.LIBCMT ref: 0000012E54609D6F
_invalid_parameter_noinfo.LIBCMT ref: 0000012E54609D7A

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 9aa24401b2afff689c0b0903031154c7b35a263849ab08805c315ffe4c7e00e0
Instruction ID: 57d6e4c5e331f6e0151763e1ddf022e88d711f531291be430a377fd83c7fcd94
Opcode Fuzzy Hash: 9aa24401b2afff689c0b0903031154c7b35a263849ab08805c315ffe4c7e00e0
Instruction Fuzzy Hash: 1E319C74368F088FD7A5DF1890857AA72D1FB58328F5502AEE44DC72D2DAB0CC54C786

Function 0000012E545F99D8 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E545F99FE

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

_invalid_parameter_noinfo.LIBCMT ref: 0000012E545F9A0A
__crtIsPackagedApp.LIBCMT ref: 0000012E545F9A1B
_dosmaperr.LIBCMT ref: 0000012E545F9A65

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction ID: 3f93f41b1c052f7ce0fd9f85c6cf5744b84e67e4edc2c605e12fa772c1f4f190
Opcode Fuzzy Hash: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction Fuzzy Hash: D531E575724F099FFB58AF6998057A972D1FF88319F14466DA04AC32E2EB38C8518703

Function 0000012E54604818 Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E54604831

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

__lock_fhandle.LIBCMT ref: 0000012E54604879
__doserrno.LIBCMT ref: 0000012E546048AE
_errno.LIBCMT ref: 0000012E546048B5
_unlock_fhandle.LIBCMT ref: 0000012E546048C5

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction ID: baf67da05eeba4c84b411ee2b594dab3955981f888a2a26a2b063cddf7a76f00
Opcode Fuzzy Hash: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction Fuzzy Hash: 2821D739724B80DFF736AFA998953FC76D0EB85318F150A5CE40A872D3D6F498209762

Function 0000012E52D98DD8 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E52D98DFE

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000012E52D98E0A
__crtIsPackagedApp.LIBCMT ref: 0000012E52D98E1B
_dosmaperr.LIBCMT ref: 0000012E52D98E65

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction ID: 866b6e7111ff927e56996ea140c8231b8d65a11885d6f7da36dd798501517117
Opcode Fuzzy Hash: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction Fuzzy Hash: 3831A13A720B4086FB10AF26D8143A966E5BB96F9CF044526FA49877E5DF7CC4218304

Function 0000012E52DA9120 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000012E52DA9154

Part of subcall function 0000012E52D9B324: _getptd.LIBCMT ref: 0000012E52D9B33A
Part of subcall function 0000012E52D9B324: __updatetlocinfo.LIBCMT ref: 0000012E52D9B36F
Part of subcall function 0000012E52D9B324: __updatetmbcinfo.LIBCMT ref: 0000012E52D9B396

_errno.LIBCMT ref: 0000012E52DA916F
_invalid_parameter_noinfo.LIBCMT ref: 0000012E52DA917A

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction ID: 573e4e583e433977857c372ee4411a5bec65174f724a25995dcb9299b3a212d3
Opcode Fuzzy Hash: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction Fuzzy Hash: A7315E7A62478485E7609F1194C8BDDB6E4F746BE8F548127FE5807B85CB79C861C700

Function 0000012E545FA6D0 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E545FA70C

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

_invalid_parameter_noinfo.LIBCMT ref: 0000012E545FA717
memcpy_s.LIBCMT ref: 0000012E545FA7DC
_fileno.LIBCMT ref: 0000012E545FA847
_filbuf.LIBCMT ref: 0000012E545FA875
_errno.LIBCMT ref: 0000012E545FA8C5

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction ID: 2a90603545f5b9e9d45a1efda8399a7195f79d59bc53f6c2008df1788bda2cde
Opcode Fuzzy Hash: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction Fuzzy Hash: 7F61D47A338F096BE76C5E2C58457BA72D1E794724F64032EE456C32D6EA60DC6382C3

Function 0000012E545D2854 Relevance: 9.2, APIs: 6, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000012E545D7F80: malloc.LIBCMT ref: 0000012E545D7F97

Part of subcall function 0000012E545FA1E8: _errno.LIBCMT ref: 0000012E545FA13F
Part of subcall function 0000012E545FA1E8: _invalid_parameter_noinfo.LIBCMT ref: 0000012E545FA14A

fseek.LIBCMT ref: 0000012E545D2929
_ftelli64.LIBCMT ref: 0000012E545D2933
fseek.LIBCMT ref: 0000012E545D2947
fclose.LIBCMT ref: 0000012E545D297E
fclose.LIBCMT ref: 0000012E545D29D3
malloc.LIBCMT ref: 0000012E545D29E2

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction ID: b195a0b258ca06039c39963a95b818314084e5d8f06ea45dcb6f90f73d9cfcfa
Opcode Fuzzy Hash: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction Fuzzy Hash: 7671FF742287488FE394EF18C495B9AB7E1FFD8358F50492DB08AC32E2CA74D955CB42

Function 0000012E52D99AD0 Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E52D99B0C

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000012E52D99B17
memcpy_s.LIBCMT ref: 0000012E52D99BDC
_fileno.LIBCMT ref: 0000012E52D99C47
_filbuf.LIBCMT ref: 0000012E52D99C75
_errno.LIBCMT ref: 0000012E52D99CC5

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction ID: 56d773177bfde57c1d79d783eca260e391b804e7ca686d56872b8792adb72812
Opcode Fuzzy Hash: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction Fuzzy Hash: 6C51143972424082FA249A6699C07E976D1B397BFCF144722BE3943BD4CB38C4B1C740

Function 0000012E52D71C54 Relevance: 9.1, APIs: 6, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 0000012E52D77380: malloc.LIBCMT ref: 0000012E52D77397

Part of subcall function 0000012E52D995E8: _errno.LIBCMT ref: 0000012E52D9953F
Part of subcall function 0000012E52D995E8: _invalid_parameter_noinfo.LIBCMT ref: 0000012E52D9954A

fseek.LIBCMT ref: 0000012E52D71D29
_ftelli64.LIBCMT ref: 0000012E52D71D33
fseek.LIBCMT ref: 0000012E52D71D47
fclose.LIBCMT ref: 0000012E52D71D7E
fclose.LIBCMT ref: 0000012E52D71DD3
malloc.LIBCMT ref: 0000012E52D71DE2

Memory Dump Source

Source File: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction ID: 66533d8690459abcf9254515eeb4930ad9c0e32f48fd07ddd87e68d6398014c6
Opcode Fuzzy Hash: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction Fuzzy Hash: 1D611E3A228A8482EB60DB15E49139EB7A1F7C6798F144117FA8E43BA9DF3CC555CF40

Function 0000012E545FA1E8 Relevance: 9.1, APIs: 6, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E545FA13F

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

_invalid_parameter_noinfo.LIBCMT ref: 0000012E545FA14A
_getstream.LIBCMT ref: 0000012E545FA16A
_errno.LIBCMT ref: 0000012E545FA17C
_errno.LIBCMT ref: 0000012E545FA18E
_openfile.LIBCMT ref: 0000012E545FA1BC

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction ID: e52a44cbf72a207e5531d5d4f5caf49a830181f97cd0d4468d443e167fffca20
Opcode Fuzzy Hash: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction Fuzzy Hash: 4D210ABA738B4A6FF790EF2C54057EA73D1EB89304F05095AA445C3296EF24CC518363

Function 0000012E545D1080 Relevance: 9.1, APIs: 6, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E545D1097

Part of subcall function 0000012E545F9468: _FF_MSGBANNER.LIBCMT ref: 0000012E545F9498
Part of subcall function 0000012E545F9468: _NMSG_WRITE.LIBCMT ref: 0000012E545F94A2
Part of subcall function 0000012E545F9468: _callnewh.LIBCMT ref: 0000012E545F94D6
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94E1
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94EC

free.LIBCMT ref: 0000012E545D10E0

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction ID: 25a4d2c8c4a2530e07786674eb1051753a25fc5879f36890adc0d317a04b96c9
Opcode Fuzzy Hash: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction Fuzzy Hash: A8310F75628A449FE384FF28C455BDEB7E1FF98308F50061DB08AD32E2DA349A55C742

Function 0000012E52D995E8 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E52D9953F

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000012E52D9954A
_getstream.LIBCMT ref: 0000012E52D9956A
_errno.LIBCMT ref: 0000012E52D9957C
_errno.LIBCMT ref: 0000012E52D9958E
_openfile.LIBCMT ref: 0000012E52D995BC

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction ID: 9b2bcd9402efdf09d419671d30eff2d62a8c9f3c06e0137f10ec249b4338995d
Opcode Fuzzy Hash: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction Fuzzy Hash: DB21877933578285FBA19F2298413DFA6D5A7477C8F444423BE8987786EF3CC5618710

Function 0000012E52D70480 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E52D70497

Part of subcall function 0000012E52D98868: _FF_MSGBANNER.LIBCMT ref: 0000012E52D98898
Part of subcall function 0000012E52D98868: _NMSG_WRITE.LIBCMT ref: 0000012E52D988A2
Part of subcall function 0000012E52D98868: _callnewh.LIBCMT ref: 0000012E52D988D6
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988E1
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988EC

free.LIBCMT ref: 0000012E52D704E0

Memory Dump Source

Source File: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction ID: 4529da91ed302e3a0f17be0bdf1b092684f27e397f7ad42ca19f976c1f695d51
Opcode Fuzzy Hash: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction Fuzzy Hash: 70212F7A528A4081EA60EB11E4503DEA7E0F7C679CF541227B6DE43AEADF3CC5618B40

Function 0000012E52D9CE24 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 0000012E52D9CE41

Part of subcall function 0000012E52D9ABEC: _set_error_mode.LIBCMT ref: 0000012E52D9ABF5
Part of subcall function 0000012E52D9ABEC: _set_error_mode.LIBCMT ref: 0000012E52D9AC04
Part of subcall function 0000012E52D9ABEC: _NMSG_WRITE.LIBCMT ref: 0000012E52D9AC1B
Part of subcall function 0000012E52D9ABEC: _NMSG_WRITE.LIBCMT ref: 0000012E52D9AC25

_NMSG_WRITE.LIBCMT ref: 0000012E52D9CE4B

Part of subcall function 0000012E52D9AC60: _set_error_mode.LIBCMT ref: 0000012E52D9ACA5
Part of subcall function 0000012E52D9AC60: _set_error_mode.LIBCMT ref: 0000012E52D9ACB6
Part of subcall function 0000012E52D9AC60: __crtMessageBoxW.LIBCMT ref: 0000012E52D9ADC9

Part of subcall function 0000012E52D98F1C: __crtCorExitProcess.LIBCMT ref: 0000012E52D98F24
Part of subcall function 0000012E52D98F1C: free.LIBCMT ref: 0000012E52D98F62
Part of subcall function 0000012E52D98F1C: free.LIBCMT ref: 0000012E52D98F77
Part of subcall function 0000012E52D98F1C: free.LIBCMT ref: 0000012E52D98F98
Part of subcall function 0000012E52D98F1C: free.LIBCMT ref: 0000012E52D98FAD
Part of subcall function 0000012E52D98F1C: free.LIBCMT ref: 0000012E52D98FC1
Part of subcall function 0000012E52D98F1C: free.LIBCMT ref: 0000012E52D98FCD
Part of subcall function 0000012E52D98F1C: free.LIBCMT ref: 0000012E52D98FF8
Part of subcall function 0000012E52D98F1C: free.LIBCMT ref: 0000012E52D99019
Part of subcall function 0000012E52D98F1C: free.LIBCMT ref: 0000012E52D99032
Part of subcall function 0000012E52D98F1C: free.LIBCMT ref: 0000012E52D99063

_malloc_crt.LIBCMT ref: 0000012E52D9CE77

Part of subcall function 0000012E52D9D778: malloc.LIBCMT ref: 0000012E52D9D7A3

_errno.LIBCMT ref: 0000012E52D9CE84
_lock.LIBCMT ref: 0000012E52D9CE98
free.LIBCMT ref: 0000012E52D9CEB9

Part of subcall function 0000012E52D98828: _errno.LIBCMT ref: 0000012E52D98848

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_set_error_mode$__crt_errno$ExitMessageProcess_lock_malloc_crtmalloc
String ID:
API String ID: 2751257304-0
Opcode ID: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction ID: 79b7108fcd73e4ce8d545bd8a9644b285051f82f7df08786f6a9e09cf1fd970e
Opcode Fuzzy Hash: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction Fuzzy Hash: D011A13E230A8881F760AB61E4447F922E5EB4BB88F441423F547476E6CF7C84B19751

Function 0000012E545C4170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E545C41BD

Part of subcall function 0000012E545F9468: _FF_MSGBANNER.LIBCMT ref: 0000012E545F9498
Part of subcall function 0000012E545F9468: _NMSG_WRITE.LIBCMT ref: 0000012E545F94A2
Part of subcall function 0000012E545F9468: _callnewh.LIBCMT ref: 0000012E545F94D6
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94E1
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94EC

malloc.LIBCMT ref: 0000012E545C41C8

Part of subcall function 0000012E545F9468: _callnewh.LIBCMT ref: 0000012E545F94FC
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F9501

free.LIBCMT ref: 0000012E545C42AF
free.LIBCMT ref: 0000012E545C42B7
free.LIBCMT ref: 0000012E545C42BF
free.LIBCMT ref: 0000012E545C42CB
free.LIBCMT ref: 0000012E545C42D8

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction ID: 5ee9baaa22be06cc453e74613a7ba55300a24d8fa59171aa490814a921578177
Opcode Fuzzy Hash: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction Fuzzy Hash: 9D51B534728E0A5BE75EAF289456AFD73D5FB5A308F50012DD94BC3287EE20DC628681

Function 0000012E52D63570 Relevance: 8.9, APIs: 7, Instructions: 115COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E52D635BD

Part of subcall function 0000012E52D98868: _FF_MSGBANNER.LIBCMT ref: 0000012E52D98898
Part of subcall function 0000012E52D98868: _NMSG_WRITE.LIBCMT ref: 0000012E52D988A2
Part of subcall function 0000012E52D98868: _callnewh.LIBCMT ref: 0000012E52D988D6
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988E1
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988EC

malloc.LIBCMT ref: 0000012E52D635C8

Part of subcall function 0000012E52D98868: _callnewh.LIBCMT ref: 0000012E52D988FC
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D98901

free.LIBCMT ref: 0000012E52D636AF
free.LIBCMT ref: 0000012E52D636B7
free.LIBCMT ref: 0000012E52D636BF
free.LIBCMT ref: 0000012E52D636CB
free.LIBCMT ref: 0000012E52D636D8

Memory Dump Source

Source File: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction ID: 4259e11426cc3ddd62a9db608abd0c63cb99f85f6f1d52153f8c16ff9f085a44
Opcode Fuzzy Hash: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction Fuzzy Hash: 2641BC3A3247C19BFB98AB66A5502A967D0FB0AFC8F800426EF0647751DF34E436C700

Function 0000012E545CCB50 Relevance: 7.8, APIs: 6, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000012E545D7F80: malloc.LIBCMT ref: 0000012E545D7F97

malloc.LIBCMT ref: 0000012E545CCC4E

Part of subcall function 0000012E545F9468: _FF_MSGBANNER.LIBCMT ref: 0000012E545F9498
Part of subcall function 0000012E545F9468: _NMSG_WRITE.LIBCMT ref: 0000012E545F94A2
Part of subcall function 0000012E545F9468: _callnewh.LIBCMT ref: 0000012E545F94D6
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94E1
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94EC

Part of subcall function 0000012E545F8AEC: malloc.LIBCMT ref: 0000012E545F8B27

Part of subcall function 0000012E545F8AEC: realloc.LIBCMT ref: 0000012E545F8B4E

malloc.LIBCMT ref: 0000012E545CCD82
_snprintf.LIBCMT ref: 0000012E545CCE10
_snprintf.LIBCMT ref: 0000012E545CCE4A
_snprintf.LIBCMT ref: 0000012E545CCE74
free.LIBCMT ref: 0000012E545CD07B

Part of subcall function 0000012E545F9428: RtlFreeHeap.NTDLL ref: 0000012E545F943E
Part of subcall function 0000012E545F9428: _errno.LIBCMT ref: 0000012E545F9448

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: malloc$_errno_snprintf$FreeHeap_callnewhfreerealloc
String ID:
API String ID: 1397185943-0
Opcode ID: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction ID: fa57b02b6e02bb4888247ceebe9fc56245dcfa030d9e67bfc8405639a348e262
Opcode Fuzzy Hash: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction Fuzzy Hash: BBE12A793246449FF394FF28C451BEBB7E2FB85308F40452DA68AC72D2DA349955CB42

Function 0000012E52D6BF50 Relevance: 7.8, APIs: 6, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 0000012E52D77380: malloc.LIBCMT ref: 0000012E52D77397

malloc.LIBCMT ref: 0000012E52D6C04E

Part of subcall function 0000012E52D98868: _FF_MSGBANNER.LIBCMT ref: 0000012E52D98898
Part of subcall function 0000012E52D98868: _NMSG_WRITE.LIBCMT ref: 0000012E52D988A2
Part of subcall function 0000012E52D98868: _callnewh.LIBCMT ref: 0000012E52D988D6
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988E1
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988EC

Part of subcall function 0000012E52D97EEC: malloc.LIBCMT ref: 0000012E52D97F27

Part of subcall function 0000012E52D97EEC: realloc.LIBCMT ref: 0000012E52D97F4E

malloc.LIBCMT ref: 0000012E52D6C182
_snprintf.LIBCMT ref: 0000012E52D6C210
_snprintf.LIBCMT ref: 0000012E52D6C24A
_snprintf.LIBCMT ref: 0000012E52D6C274
free.LIBCMT ref: 0000012E52D6C47B

Memory Dump Source

Source File: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$_callnewhfreerealloc
String ID:
API String ID: 74200508-0
Opcode ID: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction ID: fbf00d51ddc6b95bbb9d2a20116b1d87d295360eb8f12f1498ffad04d8160905
Opcode Fuzzy Hash: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction Fuzzy Hash: 76D16F7A2246848AF750EB60E4553DEB6E1E7C634CF40412BFA8987AD6CF3DD825CB50

Function 0000012E54604424 Relevance: 7.7, APIs: 5, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 0000012E54604451

Part of subcall function 0000012E545FDA24: _FF_MSGBANNER.LIBCMT ref: 0000012E545FDA41
Part of subcall function 0000012E545FDA24: _NMSG_WRITE.LIBCMT ref: 0000012E545FDA4B

_lock.LIBCMT ref: 0000012E54604464
_lock.LIBCMT ref: 0000012E546044BF
_calloc_crt.LIBCMT ref: 0000012E54604576

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction ID: 2211feec3a376fe164d81ac1fe63493f4c529dff5e5efaf7a30b630808228437
Opcode Fuzzy Hash: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction Fuzzy Hash: 9D512975638B098FE7699F58C8813B5B3D0FB98318F15025DD84EC72A2D6B4DC62CB82

Function 0000012E545C54F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E545C553A

Part of subcall function 0000012E545F9468: _FF_MSGBANNER.LIBCMT ref: 0000012E545F9498
Part of subcall function 0000012E545F9468: _NMSG_WRITE.LIBCMT ref: 0000012E545F94A2
Part of subcall function 0000012E545F9468: _callnewh.LIBCMT ref: 0000012E545F94D6
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94E1
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94EC

malloc.LIBCMT ref: 0000012E545C5545

Part of subcall function 0000012E545F9468: _callnewh.LIBCMT ref: 0000012E545F94FC
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F9501

free.LIBCMT ref: 0000012E545C562C
free.LIBCMT ref: 0000012E545C5634
free.LIBCMT ref: 0000012E545C5640
free.LIBCMT ref: 0000012E545C564D

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction ID: de103fa861c7b34c1287b9dcd10aa48fcd869dd9aeb580d540029282e8261461
Opcode Fuzzy Hash: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction Fuzzy Hash: 6B411535328F1D0BE769AE688809BFA73D5EBA5358F54013DD587C3283ED20D8578791

Function 0000012E545FBD98 Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0000012E545FBDB5

Part of subcall function 0000012E545FF624: _errno.LIBCMT ref: 0000012E545FF62D
Part of subcall function 0000012E545FF624: _invalid_parameter_noinfo.LIBCMT ref: 0000012E545FF638

_errno.LIBCMT ref: 0000012E545FBDC5

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

_errno.LIBCMT ref: 0000012E545FBDE1
_isatty.LIBCMT ref: 0000012E545FBE42
_getbuf.LIBCMT ref: 0000012E545FBE4E

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction ID: cf59769860a3156055c4e74c2406e43a3dd2e15a6262ac3f133b5bc302bb5919
Opcode Fuzzy Hash: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction Fuzzy Hash: 325106BA324A48DFEB98EF28C0C57E577D0FB58314F140199D95ACB2C6D674C861CB82

Function 0000012E545DCF00 Relevance: 7.6, APIs: 6, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E545DCF18

Part of subcall function 0000012E545F9468: _FF_MSGBANNER.LIBCMT ref: 0000012E545F9498
Part of subcall function 0000012E545F9468: _NMSG_WRITE.LIBCMT ref: 0000012E545F94A2
Part of subcall function 0000012E545F9468: _callnewh.LIBCMT ref: 0000012E545F94D6
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94E1
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94EC

_snprintf.LIBCMT ref: 0000012E545DCF38

Part of subcall function 0000012E545F9700: _errno.LIBCMT ref: 0000012E545F9737
Part of subcall function 0000012E545F9700: _invalid_parameter_noinfo.LIBCMT ref: 0000012E545F9742

free.LIBCMT ref: 0000012E545DCF57

Part of subcall function 0000012E545F9428: RtlFreeHeap.NTDLL ref: 0000012E545F943E
Part of subcall function 0000012E545F9428: _errno.LIBCMT ref: 0000012E545F9448

malloc.LIBCMT ref: 0000012E545DCFE0
_snprintf.LIBCMT ref: 0000012E545DD007
free.LIBCMT ref: 0000012E545DD045

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _errno$_snprintffreemalloc$FreeHeap_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 343393124-0
Opcode ID: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction ID: b895dcec999102b761b09725de2ca50c99f5b492ea843e290522ac633ee5c19c
Opcode Fuzzy Hash: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction Fuzzy Hash: C2417335338A458FE784FF28C894BEAB7F1FF99304F500529E48AC32A1DA25D945CB02

Function 0000012E52D648F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E52D6493A

Part of subcall function 0000012E52D98868: _FF_MSGBANNER.LIBCMT ref: 0000012E52D98898
Part of subcall function 0000012E52D98868: _NMSG_WRITE.LIBCMT ref: 0000012E52D988A2
Part of subcall function 0000012E52D98868: _callnewh.LIBCMT ref: 0000012E52D988D6
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988E1
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988EC

malloc.LIBCMT ref: 0000012E52D64945

Part of subcall function 0000012E52D98868: _callnewh.LIBCMT ref: 0000012E52D988FC
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D98901

free.LIBCMT ref: 0000012E52D64A2C
free.LIBCMT ref: 0000012E52D64A34
free.LIBCMT ref: 0000012E52D64A40
free.LIBCMT ref: 0000012E52D64A4D

Memory Dump Source

Source File: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction ID: d543d9a91e2721867a4a3191f6c33dc04d7f9694cf9f264bc5209db30b7886d2
Opcode Fuzzy Hash: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction Fuzzy Hash: 2841E23A32838596FA65EB2664002BE67D8F756F8CF494026FE068B741DF39D826C310

Function 0000012E546046C8 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E546046D9

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

__doserrno.LIBCMT ref: 0000012E546046D1

Part of subcall function 0000012E545FB6A4: _getptd_noexit.LIBCMT ref: 0000012E545FB6A8

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction ID: ba52ecf0e2ad90044be7d0ccbad79691b07e967f1c14111d671c9009350fc83d
Opcode Fuzzy Hash: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction Fuzzy Hash: 7D01F479735948CFFA6AAF28CC597D432D0EF1632EF644248E40AC70E2D6B81460C623

Function 0000012E545D33EC Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E545D3404

Part of subcall function 0000012E545F9468: _FF_MSGBANNER.LIBCMT ref: 0000012E545F9498
Part of subcall function 0000012E545F9468: _NMSG_WRITE.LIBCMT ref: 0000012E545F94A2
Part of subcall function 0000012E545F9468: _callnewh.LIBCMT ref: 0000012E545F94D6
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94E1
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94EC

_snprintf.LIBCMT ref: 0000012E545D342E

Part of subcall function 0000012E545F9700: _errno.LIBCMT ref: 0000012E545F9737
Part of subcall function 0000012E545F9700: _invalid_parameter_noinfo.LIBCMT ref: 0000012E545F9742

remove.LIBCMT ref: 0000012E545D343F
remove.LIBCMT ref: 0000012E545D344B
free.LIBCMT ref: 0000012E545D3455

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction ID: dbe6c4056fa92cf32c71e1b1bd7797b8380739595410e1ad59407ecd7ed26e38
Opcode Fuzzy Hash: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction Fuzzy Hash: 0C01FBB4638B48AFE384EF18C449B99B7E1FFD4704F80092DB589C22A1DB749954CB43

Function 0000012E52DA3AC8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E52DA3AD9

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

__doserrno.LIBCMT ref: 0000012E52DA3AD1

Part of subcall function 0000012E52D9AAA4: _getptd_noexit.LIBCMT ref: 0000012E52D9AAA8

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction ID: f87c4355679bd08acc761070d339049c23dfb98071a951e7aa6a860421b872e8
Opcode Fuzzy Hash: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction Fuzzy Hash: 24018CBA736A4486FA49AF14C8813E836D39B53BBDF554307FA2A077E2C72C44218721

Function 0000012E52D727EC Relevance: 7.5, APIs: 5, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E52D72804

Part of subcall function 0000012E52D98868: _FF_MSGBANNER.LIBCMT ref: 0000012E52D98898
Part of subcall function 0000012E52D98868: _NMSG_WRITE.LIBCMT ref: 0000012E52D988A2
Part of subcall function 0000012E52D98868: _callnewh.LIBCMT ref: 0000012E52D988D6
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988E1
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988EC

_snprintf.LIBCMT ref: 0000012E52D7282E

Part of subcall function 0000012E52D98B00: _errno.LIBCMT ref: 0000012E52D98B37
Part of subcall function 0000012E52D98B00: _invalid_parameter_noinfo.LIBCMT ref: 0000012E52D98B42

remove.LIBCMT ref: 0000012E52D7283F
remove.LIBCMT ref: 0000012E52D7284B
free.LIBCMT ref: 0000012E52D72855

Memory Dump Source

Source File: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction ID: 58cdb5c6f7ee357fbc6466be9d12285fa8dfb55fb2b7e0f6f56a6bfe4e779e14
Opcode Fuzzy Hash: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction Fuzzy Hash: 84F0F9BA538B8086DA40EB51F45139EA3A4FBC5B88F405117BA8E53BA9CF7CC421CB40

Function 0000012E545F68D4 Relevance: 6.5, APIs: 5, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E545F6917
free.LIBCMT ref: 0000012E545F693C

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction ID: 98f05c8613d12e6475fa847a0b4a778a613df8a378655a35ceec45b5f0baaf40
Opcode Fuzzy Hash: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction Fuzzy Hash: E3913A752287849FE7A4EF28C4557EEB7E1FB84304F50092DE08AC3291DB75996ACB43

Function 0000012E52D95CD4 Relevance: 6.4, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E52D95D17
free.LIBCMT ref: 0000012E52D95D3C

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction ID: b8c259335d3cacf9428626c1c05d17ce3b68648e980c42d1505584a8e48dfeac
Opcode Fuzzy Hash: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction Fuzzy Hash: 37810F3A2286808AE760DF24E4543DEB7E1F786788F500526F78987AD9DB7DD854CF40

Function 0000012E545F92BC Relevance: 6.3, APIs: 5, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E545F92D6

Part of subcall function 0000012E545F9468: _FF_MSGBANNER.LIBCMT ref: 0000012E545F9498
Part of subcall function 0000012E545F9468: _NMSG_WRITE.LIBCMT ref: 0000012E545F94A2
Part of subcall function 0000012E545F9468: _callnewh.LIBCMT ref: 0000012E545F94D6
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94E1
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94EC

malloc.LIBCMT ref: 0000012E545F92F5

Part of subcall function 0000012E545F9468: _callnewh.LIBCMT ref: 0000012E545F94FC
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F9501

malloc.LIBCMT ref: 0000012E545F932C
_snprintf.LIBCMT ref: 0000012E545F9358

Part of subcall function 0000012E545F9700: _errno.LIBCMT ref: 0000012E545F9737
Part of subcall function 0000012E545F9700: _invalid_parameter_noinfo.LIBCMT ref: 0000012E545F9742

malloc.LIBCMT ref: 0000012E545F939B

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction ID: d16c73821eeefc66a4c9e2ad0007ac8dee2207002784e0954f2213fdfc95aacd
Opcode Fuzzy Hash: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction Fuzzy Hash: E931BA7461CB489FDB84EF18C054A5AB7E1FBAC319F500A6DA48DD73A1DB34E941CB42

Function 0000012E52D986BC Relevance: 6.3, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E52D986D6

Part of subcall function 0000012E52D98868: _FF_MSGBANNER.LIBCMT ref: 0000012E52D98898
Part of subcall function 0000012E52D98868: _NMSG_WRITE.LIBCMT ref: 0000012E52D988A2
Part of subcall function 0000012E52D98868: _callnewh.LIBCMT ref: 0000012E52D988D6
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988E1
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988EC

malloc.LIBCMT ref: 0000012E52D986F5

Part of subcall function 0000012E52D98868: _callnewh.LIBCMT ref: 0000012E52D988FC
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D98901

malloc.LIBCMT ref: 0000012E52D9872C
_snprintf.LIBCMT ref: 0000012E52D98758

Part of subcall function 0000012E52D98B00: _errno.LIBCMT ref: 0000012E52D98B37
Part of subcall function 0000012E52D98B00: _invalid_parameter_noinfo.LIBCMT ref: 0000012E52D98B42

malloc.LIBCMT ref: 0000012E52D9879B

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction ID: 2e18cde7adc99d01c3680f39044a079f0f392ab9ba270747f5a63118551c551b
Opcode Fuzzy Hash: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction Fuzzy Hash: 0721A23A618B8486DA64DB16E49025EB7A0F3C9B98F504216FEDD43BA9CF38C552CF40

Function 0000012E545FA1F4 Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E545FA22C

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

_invalid_parameter_noinfo.LIBCMT ref: 0000012E545FA237
_flush.LIBCMT ref: 0000012E545FA2E9
_fileno.LIBCMT ref: 0000012E545FA30A

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction ID: 225bece9a23727843b4ba20e2fa885ed20e5c5073ca67416133237ac7ace9e74
Opcode Fuzzy Hash: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction Fuzzy Hash: 7951FBB6338F095FE7689EAD54453B972C1E759318F14022EE49AC31D7EA61DC6282C3

Function 0000012E52D995F4 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E52D9962C

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000012E52D99637
_flush.LIBCMT ref: 0000012E52D996E9
_fileno.LIBCMT ref: 0000012E52D9970A

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction ID: e2d63def0e922b5dd0514f039539b3c8ed1176ff015ffee9a70612454469c2c6
Opcode Fuzzy Hash: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction Fuzzy Hash: 8D4126393203C046FE688E23A5813EAB6D1B746FECF184626BE5547BC5DB79C4618700

Function 0000012E545C10D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 0000012E545C1117
clock.LIBCMT ref: 0000012E545C1124
clock.LIBCMT ref: 0000012E545C112D
clock.LIBCMT ref: 0000012E545C113A

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: f2a5db909bb8a047368f1db4729ff010bdd6c69098909e7e2ee8d29f4243a031
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: F3213D39A1C70D4FE778EDA894427BAB7C0D785354F25122DE9CAC3283F5649C6286C6

Function 0000012E54609728 Relevance: 6.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000012E5460974C

Part of subcall function 0000012E545FBF24: _getptd.LIBCMT ref: 0000012E545FBF3A
Part of subcall function 0000012E545FBF24: __updatetlocinfo.LIBCMT ref: 0000012E545FBF6F
Part of subcall function 0000012E545FBF24: __updatetmbcinfo.LIBCMT ref: 0000012E545FBF96

_errno.LIBCMT ref: 0000012E54609758

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

_invalid_parameter_noinfo.LIBCMT ref: 0000012E54609763
strchr.LIBCMT ref: 0000012E54609779

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction ID: 37cd572283746604becb4d17862f86b6905c9d7e9ae712a802924f797a8650e7
Opcode Fuzzy Hash: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction Fuzzy Hash: E32149BA738664DFE7AA9F2840943BA36D2E74435DF040A6DE09EC71C1C9F08854C341

Function 0000012E52D604D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

clock.LIBCMT ref: 0000012E52D60517
clock.LIBCMT ref: 0000012E52D60524
clock.LIBCMT ref: 0000012E52D6052D
clock.LIBCMT ref: 0000012E52D6053A

Memory Dump Source

Source File: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: 7d442303a5d3442178c42dfb0114d38584aeb689b7a1e6a7f9a13b8aa65f5ff9
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: 7911023A624B4445F770EEA6B4806ABF6D0BB86398F195027FE4483286EB74DCA1C701

Function 0000012E52DA8B28 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000012E52DA8B4C

Part of subcall function 0000012E52D9B324: _getptd.LIBCMT ref: 0000012E52D9B33A
Part of subcall function 0000012E52D9B324: __updatetlocinfo.LIBCMT ref: 0000012E52D9B36F
Part of subcall function 0000012E52D9B324: __updatetmbcinfo.LIBCMT ref: 0000012E52D9B396

_errno.LIBCMT ref: 0000012E52DA8B58

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000012E52DA8B63
strchr.LIBCMT ref: 0000012E52DA8B79

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction ID: 5cfdecdf64f4f268a2f3e63bf5afe32f739bbc35c5bad464f48793b50ad07a1a
Opcode Fuzzy Hash: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction Fuzzy Hash: FE21E7FB6262E441EB6096159050BFE7AD1E346BDCF1C5123FE968BAC5CB6CC461C710

Function 0000012E545C1CC4 Relevance: 5.4, APIs: 4, Instructions: 410COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 0000012E545C1D6A

Part of subcall function 0000012E54608F58: _calloc_impl.LIBCMT ref: 0000012E54608F68
Part of subcall function 0000012E54608F58: _errno.LIBCMT ref: 0000012E54608F7B
Part of subcall function 0000012E54608F58: _errno.LIBCMT ref: 0000012E54608F85

free.LIBCMT ref: 0000012E545C1EF3
free.LIBCMT ref: 0000012E545C1EFD

Part of subcall function 0000012E545F9428: RtlFreeHeap.NTDLL ref: 0000012E545F943E
Part of subcall function 0000012E545F9428: _errno.LIBCMT ref: 0000012E545F9448

free.LIBCMT ref: 0000012E545C1F0F

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _errnofree$FreeHeap_calloc_implcalloc
String ID:
API String ID: 2553729582-0
Opcode ID: 78c2e68d2c1b3242693463214cb6a7d91bdf562fc33a57e2f937b62e4c2d32d4
Instruction ID: bd29f4837b8abd897d89eaa91600ca0c27801e9f80e3a64524e3f90000b4cb9e
Opcode Fuzzy Hash: 78c2e68d2c1b3242693463214cb6a7d91bdf562fc33a57e2f937b62e4c2d32d4
Instruction Fuzzy Hash: 99E13B74A18B488FDB98DF5CD484BAABBE1FB98305F10452EE58DC3291DB70D845CB86

Function 0000012E52D770FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000012E52D77380: malloc.LIBCMT ref: 0000012E52D77397

strrchr.LIBCMT ref: 0000012E52D771F2
_snprintf.LIBCMT ref: 0000012E52D7730C

Strings

:, xrefs: 0000012E52D7734F

Memory Dump Source

Source File: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintfmallocstrrchr
String ID: :
API String ID: 3587327836-336475711
Opcode ID: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction ID: 83cee8ec6bad23b8f1372f17b89abbfc642db9e25c1a0e0968a3f006ad8f73f9
Opcode Fuzzy Hash: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction Fuzzy Hash: 4761EA36229A8486EB50DB55E88079AB7E0F3CA794F145516FBCE47BA9CF7CC451CB00

Function 0000012E545DB940 Relevance: 5.3, APIs: 4, Instructions: 321COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E545DB9AA

Part of subcall function 0000012E545F9468: _FF_MSGBANNER.LIBCMT ref: 0000012E545F9498
Part of subcall function 0000012E545F9468: _NMSG_WRITE.LIBCMT ref: 0000012E545F94A2
Part of subcall function 0000012E545F9468: _callnewh.LIBCMT ref: 0000012E545F94D6
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94E1
Part of subcall function 0000012E545F9468: _errno.LIBCMT ref: 0000012E545F94EC

free.LIBCMT ref: 0000012E545DBDE3

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction ID: e3503da4dd4ae3f9faef7d8e5bb3323e183a2869cb2950b41a5e0e5925a6d3bc
Opcode Fuzzy Hash: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction Fuzzy Hash: 25D1E9B42587859FE7A4EF18C0447ABB7E1FF9A319F90192DA5CAC3250DB319980CB47

Function 0000012E545F9924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E545F9975

Part of subcall function 0000012E545FB714: _getptd_noexit.LIBCMT ref: 0000012E545FB718

_invalid_parameter_noinfo.LIBCMT ref: 0000012E545F9980

Strings

B, xrefs: 0000012E545F99AC

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction ID: 542e5dd093ef36db5330f5c57f34ac6353e8e0792ca2ef2cbc566fc2fe8f9103
Opcode Fuzzy Hash: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction Fuzzy Hash: C211C171228F088FD744EF5CD4857A6B3E1FB98328F1047AEA019C32A1DB34C980CB82

Function 0000012E52DA12F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__crtCapturePreviousContext.LIBCMT ref: 0000012E52DA17B5
__raise_securityfailure.LIBCMT ref: 0000012E52DA1857

Strings

sv-FI, xrefs: 0000012E52DA1850

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: CaptureContextPrevious__crt__raise_securityfailure
String ID: sv-FI
API String ID: 37250909-2947700294
Opcode ID: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction ID: 32fbd6fff7ed27dc112cd62501e64866b7a9884940b51d3e8146f52507924bae
Opcode Fuzzy Hash: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction Fuzzy Hash: 1021D3BC225B0485FB509B19E8553D977E5F38A388F940127FA8EA67A1DF3CC5648700

Function 0000012E52D98D24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000012E52D98D75

Part of subcall function 0000012E52D9AB14: _getptd_noexit.LIBCMT ref: 0000012E52D9AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000012E52D98D80

Strings

B, xrefs: 0000012E52D98DAC

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction ID: b64b7b7310ef26a68dfcc897edab48d01298c3c33af3727bd17f4716fa2fcf2b
Opcode Fuzzy Hash: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction Fuzzy Hash: 2D11A177620A4086EB10DF56E4407D9B6A5FB9AFE8F584322BF5847B96CF38C150CB00

Function 0000012E52D610C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMON

Download Yara Rule

APIs

calloc.LIBCMT ref: 0000012E52D6116A

Part of subcall function 0000012E52DA8358: _calloc_impl.LIBCMT ref: 0000012E52DA8368
Part of subcall function 0000012E52DA8358: _errno.LIBCMT ref: 0000012E52DA837B
Part of subcall function 0000012E52DA8358: _errno.LIBCMT ref: 0000012E52DA8385

free.LIBCMT ref: 0000012E52D612F3
free.LIBCMT ref: 0000012E52D612FD
free.LIBCMT ref: 0000012E52D6130F

Memory Dump Source

Source File: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction ID: 6e3b4f07ed026f6f4cbb75a3e7c860120f6ffd9dd1bc820da13623ebdcf7b257
Opcode Fuzzy Hash: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction Fuzzy Hash: 59C10E36614B858AEB64CF65E48079E77F4F789B88F10412AEB8D87B58DF38D465CB00

Function 0000012E52D7AD40 Relevance: 5.2, APIs: 4, Instructions: 234COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E52D7ADAA

Part of subcall function 0000012E52D98868: _FF_MSGBANNER.LIBCMT ref: 0000012E52D98898
Part of subcall function 0000012E52D98868: _NMSG_WRITE.LIBCMT ref: 0000012E52D988A2
Part of subcall function 0000012E52D98868: _callnewh.LIBCMT ref: 0000012E52D988D6
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988E1
Part of subcall function 0000012E52D98868: _errno.LIBCMT ref: 0000012E52D988EC

free.LIBCMT ref: 0000012E52D7B1E3

Memory Dump Source

Source File: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction ID: 065cc01f789515e7fb4407e790138ebdefd7db5c77191939090f3fdff64a5c61
Opcode Fuzzy Hash: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction Fuzzy Hash: 0FC1CA7A2286C08ADB70CA15E09039FB7A0F78A799F54111AFBCA83B59DB3DC451CF15

Function 0000012E545CFBEC Relevance: 5.2, APIs: 4, Instructions: 221COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000012E545CFCA9
_snprintf.LIBCMT ref: 0000012E545CFCC9
_snprintf.LIBCMT ref: 0000012E545CFD9A

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction ID: fa3c9c1ad28bd5b43475c9a1d9144639f79c0c4d989a959fd36aaabd7a5a8415
Opcode Fuzzy Hash: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction Fuzzy Hash: A3912E75218B888FE7A4EF18C455BABB7E1FB99305F40092DE48AC32E1DB749945CB42

Function 0000012E545C4300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E545C4363

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction ID: 8a418ce05631262eeb4818a98064a5d2f83bdf7a13deeb833f5683661cfc4b26
Opcode Fuzzy Hash: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction Fuzzy Hash: 0551D47432CA054BEB5DDF289485ABA73D1FB95308F10456DE98BC32C6EE30EC628681

Function 0000012E52D6EFEC Relevance: 5.1, APIs: 4, Instructions: 144COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000012E52D6F0A9
_snprintf.LIBCMT ref: 0000012E52D6F0C9
_snprintf.LIBCMT ref: 0000012E52D6F19A

Memory Dump Source

Source File: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction ID: cc3cdb8168e26207c8178f3c30a90bb8766d78edb3b6108debfae6ea433b6de0
Opcode Fuzzy Hash: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction Fuzzy Hash: D281EB3A228AC489E7209B55F4503DAB7A1F3DA798F504217FA9E43BA9DF3DC455CB00

Function 0000012E52D63700 Relevance: 5.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E52D63763

Memory Dump Source

Source File: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction ID: c17b7e956b8ac4efbe951f5a2c1cce7ac121a20f2b00842f2517edb8b7c0a476
Opcode Fuzzy Hash: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction Fuzzy Hash: 78418E3A62478087EB98DB26A4106ED77E1F746F8CF548426FE1A47B85DF34E825C700

Function 0000012E545F7594 Relevance: 5.1, APIs: 4, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000012E545F761F
_snprintf.LIBCMT ref: 0000012E545F7644
_snprintf.LIBCMT ref: 0000012E545F76A4
_snprintf.LIBCMT ref: 0000012E545F76C9

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: 5bdec7dc50a5295d6bbde147bef5ff3256c53dab6c8a91d25923a1859fa94813
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: 01418575228A489FE751FF28D844BDA77E1F798314F50052EA48AC32E0DB38D955CB43

Function 0000012E545F7D04 Relevance: 5.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E545F7D4E
strtok.LIBCMT ref: 0000012E545F7DAC
strtok.LIBCMT ref: 0000012E545F7DBE
free.LIBCMT ref: 0000012E545F7DD7

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction ID: 960af02bd8424960d0496cf4b11bfdb13982d032f0f84ebba9b9f3df12f8e146
Opcode Fuzzy Hash: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction Fuzzy Hash: CE31E575628B4CAFE794FF28C444BA977E1FB99319F90061EA49AC32A1D734D851C702

Function 0000012E52D96994 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000012E52D96A1F
_snprintf.LIBCMT ref: 0000012E52D96A44
_snprintf.LIBCMT ref: 0000012E52D96AA4
_snprintf.LIBCMT ref: 0000012E52D96AC9

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: 3a82c80395e49d6d31a39384f797dff1d657f4377c097517151e761011017927
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: 72315339238A8481E7219B11E4513DAA7E0F38A76CF544217FA9D43BE9DF3DC5A5CB40

Function 0000012E52D97104 Relevance: 5.0, APIs: 4, Instructions: 50stringCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000012E52D9714E
strtok.LIBCMT ref: 0000012E52D971AC
strtok.LIBCMT ref: 0000012E52D971BE
free.LIBCMT ref: 0000012E52D971D7

Memory Dump Source

Source File: 00000003.00000003.2632014535.0000012E52D7D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000012E52D60000, based on PE: true

Associated: 00000003.00000003.2631994187.0000012E52D60000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.2632014535.0000012E52DBC000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_12e52d60000_rundll32.jbxd

Yara matches

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction ID: 83b69390035c1e6dbae63ee9ee66bc7a37eceb753b84d2f907898204a943820c
Opcode Fuzzy Hash: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction Fuzzy Hash: 8621F17A125B4885EA609B15F85139AA7F5F3867A8F501317FA9E537E9CF3CC061CB00

Function 0000012E545F93B8 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000012E545F93D8

Part of subcall function 0000012E545F9428: RtlFreeHeap.NTDLL ref: 0000012E545F943E
Part of subcall function 0000012E545F9428: _errno.LIBCMT ref: 0000012E545F9448

free.LIBCMT ref: 0000012E545F93E6
free.LIBCMT ref: 0000012E545F93F4
free.LIBCMT ref: 0000012E545F93FE

Memory Dump Source

Source File: 00000003.00000002.2635071752.0000012E545C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000012E545C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12e545c1000_rundll32.jbxd

Similarity

API ID: free$FreeHeap_errno
String ID:
API String ID: 2737118440-0
Opcode ID: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction ID: 916668495f570e3e509baf912a09411b6991fc911e466fccca74a8f77ffa1123
Opcode Fuzzy Hash: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction Fuzzy Hash: FEF04C7523CD48AFD6C8FF18C895E99B7E1FFA8304F801458B049C73A2EA24E850CB12

Analysis Process: rundll32.exePID: 3212, Parent PID: 6416COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	25

Executed Functions

Function 000001EFEFAF7CFC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 187
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001EFEFAF7F80: malloc.LIBCMT ref: 000001EFEFAF7F97

GetUserNameA.ADVAPI32 ref: 000001EFEFAF7DAA

Part of subcall function 000001EFEFAF00A4: WSASocketA.WS2_32 ref: 000001EFEFAF00E0

strrchr.LIBCMT ref: 000001EFEFAF7DF2
_snprintf.LIBCMT ref: 000001EFEFAF7F0C

Strings

:, xrefs: 000001EFEFAF7F4F

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: NameSocketUser_snprintfmallocstrrchr
String ID: :
API String ID: 1789932928-336475711
Opcode ID: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction ID: d7a95239ba58a363f5ccbfb2e63a34d367d364bda6f60ee3dcd7969f8b102a16
Opcode Fuzzy Hash: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction Fuzzy Hash: 8371DE31518B888FE790EB18C495B9EB7E1FBC9310F95496DB889C72A5C774E881CB02

Function 000001EFEF94D107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001EFEF94D166
VirtualProtect.KERNELBASE ref: 000001EFEF94D1AF

Strings

DCBA, xrefs: 000001EFEF94D141

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: DCBA
API String ID: 544645111-2222620526
Opcode ID: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction ID: 5c63de13ee241e6f82fe441d03dd6b064c2a2f02b22df3bbc11fe6bd08dc9dbc
Opcode Fuzzy Hash: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction Fuzzy Hash: 93412A77301B858EDB24CF65D8807DC37A2E748BACF118226EE0D47B68EA34D985C740

Function 000001EFEFAFD0FC Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 110
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 000001EFEFAFD1AB
(, xrefs: 000001EFEFAFD1A3

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID:
String ID: ($0
API String ID: 0-506339136
Opcode ID: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction ID: 2d466a25dde8e0e8793a24a940b7410a37ee81fbaeed1e71e6effe8cf8845580
Opcode Fuzzy Hash: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction Fuzzy Hash: 54418E311187858FE7A5DF28C0547AEB7E1FB98315F54093DE88ADB2A1CB74D982CB42

Function 000001EFEFAF00A4 Relevance: 4.6, APIs: 3, Instructions: 93
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32 ref: 000001EFEFAF00E0
WSAIoctl.WS2_32 ref: 000001EFEFAF013B
closesocket.WS2_32 ref: 000001EFEFAF01CA

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: IoctlSocketclosesocket
String ID:
API String ID: 3445158922-0
Opcode ID: 2b1563ebb8b5cee2362f50e6a9862c7e044125dd490747691ac161b43e72dde1
Instruction ID: 3027af37680d2144ebe8bdcd3fe383b5c2102c550113c79ab99d31ec00ddb143
Opcode Fuzzy Hash: 2b1563ebb8b5cee2362f50e6a9862c7e044125dd490747691ac161b43e72dde1
Instruction Fuzzy Hash: BB313D715187848FE350DF68C444B9EFBE4FBC8344F55893DE89ADA2A0D7B8D4858B06

Function 000001EFEFAEF9C0 Relevance: 1.6, APIs: 1, Instructions: 150
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000001EFEFAEFA7C

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 170dc46f2207cb387e16a0227af4bff50695bdbce6e0c670e9cf9a8f94b52204
Instruction ID: a39c336b63a6542a839d8a4149161fe30bdfc58fe9ee055d4c5b377a48707a17
Opcode Fuzzy Hash: 170dc46f2207cb387e16a0227af4bff50695bdbce6e0c670e9cf9a8f94b52204
Instruction Fuzzy Hash: F9515C316286848FF354EB18C8597AE77E5FB89305F41453EA986D72E1CB789882CB02

Non-executed Functions

Function 000001EFEF96F9E4 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001EFEF96FA3A
_errno.LIBCMT ref: 000001EFEF96FA41
_invalid_parameter_noinfo.LIBCMT ref: 000001EFEF96FA4C

Strings

U, xrefs: 000001EFEF96FFAE

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction ID: a6a8396cad94a315469e39dce2287d1a678a94b741813ba7957708855209fdaa
Opcode Fuzzy Hash: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction Fuzzy Hash: BD12A2332157C586EB208F24D8443DE67A2F785798F52412AEEC9476B9FB39E486CB10

Function 000001EFEF96B3CC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001EFEF96B42D

Part of subcall function 000001EFEF96B324: _getptd.LIBCMT ref: 000001EFEF96B33A
Part of subcall function 000001EFEF96B324: __updatetlocinfo.LIBCMT ref: 000001EFEF96B36F
Part of subcall function 000001EFEF96B324: __updatetmbcinfo.LIBCMT ref: 000001EFEF96B396

_fileno.LIBCMT ref: 000001EFEF96B45F

Part of subcall function 000001EFEF96EA24: _errno.LIBCMT ref: 000001EFEF96EA2D
Part of subcall function 000001EFEF96EA24: _invalid_parameter_noinfo.LIBCMT ref: 000001EFEF96EA38

write_multi_char.LIBCMT ref: 000001EFEF96BA8F
write_string.LIBCMT ref: 000001EFEF96BAAC
_errno.LIBCMT ref: 000001EFEF96B432

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

_errno.LIBCMT ref: 000001EFEF96BD97
_invalid_parameter_noinfo.LIBCMT ref: 000001EFEF96BDA2

Strings

@, xrefs: 000001EFEF96B44B
-, xrefs: 000001EFEF96BA40

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$@
API String ID: 3246410048-1222683799
Opcode ID: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction ID: ffa03f5aa9ba2fef47408691c0672b35e762829ce179be11cbd3ac0c5073c39f
Opcode Fuzzy Hash: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction Fuzzy Hash: 4CB1D373604AC085FB698F65D8503ED67A2B785794F17012EDE89076F9FB38E9828740

Function 000001EFEFB20EEC Relevance: 16.6, APIs: 11, Instructions: 108
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001EFEFB20F1E

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

__doserrno.LIBCMT ref: 000001EFEFB20F15

Part of subcall function 000001EFEFB1B6A4: _getptd_noexit.LIBCMT ref: 000001EFEFB1B6A8

__doserrno.LIBCMT ref: 000001EFEFB20F7B
_errno.LIBCMT ref: 000001EFEFB20F82
_invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB20FE6

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction ID: 478b0c6eaa251f325bc5caafdeb08064668f1024857f9d5a281133b3de8de4bb
Opcode Fuzzy Hash: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction Fuzzy Hash: A331A672A186864FF719AF68D8422ED3690EBD5360F12467DEC11872F3D670B9838751

Function 000001EFEF968F1C Relevance: 16.6, APIs: 11, Instructions: 82COMMON

Download Yara Rule

APIs

__crtCorExitProcess.LIBCMT ref: 000001EFEF968F24
free.LIBCMT ref: 000001EFEF968F62

Part of subcall function 000001EFEF968828: _errno.LIBCMT ref: 000001EFEF968848

free.LIBCMT ref: 000001EFEF968F77
free.LIBCMT ref: 000001EFEF968F98
free.LIBCMT ref: 000001EFEF968FAD
free.LIBCMT ref: 000001EFEF968FC1
free.LIBCMT ref: 000001EFEF968FCD
free.LIBCMT ref: 000001EFEF968FF8
free.LIBCMT ref: 000001EFEF969019
free.LIBCMT ref: 000001EFEF969032
free.LIBCMT ref: 000001EFEF969063

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: free$ExitProcess__crt_errno
String ID:
API String ID: 1362684943-0
Opcode ID: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction ID: 41c1b9af8a92b0d4384ea4cde04b97aa894f25ad2dd4f8daee278c7949b24775
Opcode Fuzzy Hash: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction Fuzzy Hash: 14412C336516C181FE199B12EC603EC2393AF44765F0B453D9D99062B5FF3CA5C28340

Function 000001EFEF9702EC Relevance: 16.6, APIs: 11, Instructions: 81COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEF97031E

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

__doserrno.LIBCMT ref: 000001EFEF970315

Part of subcall function 000001EFEF96AAA4: _getptd_noexit.LIBCMT ref: 000001EFEF96AAA8

__doserrno.LIBCMT ref: 000001EFEF97037B
_errno.LIBCMT ref: 000001EFEF970382
_invalid_parameter_noinfo.LIBCMT ref: 000001EFEF9703E6

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction ID: 419e14e84c28a052a44999a71fb067140bab90f0d51a89f4b12f118e53ea0191
Opcode Fuzzy Hash: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction Fuzzy Hash: 1F315E732113C086E6566F65DD813AD2653A784BE4F47423DAE910B7F2EB78A8838710

Function 000001EFEFB21CD8 Relevance: 15.1, APIs: 10, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001EFEFB21D03

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

__doserrno.LIBCMT ref: 000001EFEFB21CFB

Part of subcall function 000001EFEFB1B6A4: _getptd_noexit.LIBCMT ref: 000001EFEFB1B6A8

__lock_fhandle.LIBCMT ref: 000001EFEFB21D47
_lseeki64_nolock.LIBCMT ref: 000001EFEFB21D60
_unlock_fhandle.LIBCMT ref: 000001EFEFB21D83

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction ID: c12185b8691f7d5020859d9e5fd9a1f8de1cbeeda385c94162ee7719e426e318
Opcode Fuzzy Hash: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction Fuzzy Hash: 0621E732B186868EF7186B5CDC423ED72D0EB85321F17466DEC15C71F3CA6468838666

Function 000001EFEFB21B60 Relevance: 15.1, APIs: 10, Instructions: 88
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001EFEFB21B8B

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

__doserrno.LIBCMT ref: 000001EFEFB21B83

Part of subcall function 000001EFEFB1B6A4: _getptd_noexit.LIBCMT ref: 000001EFEFB1B6A8

__lock_fhandle.LIBCMT ref: 000001EFEFB21BCF
_lseek_nolock.LIBCMT ref: 000001EFEFB21BE8
_unlock_fhandle.LIBCMT ref: 000001EFEFB21C09

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction ID: ac190ef3d052d196a142bb9f9f7974bb05f581329af84152e2ac4ca23d2150c5
Opcode Fuzzy Hash: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction Fuzzy Hash: DF21F936A086824EF7196B6CD8463FD7290DB82320F27467DED56CB1F3D66468838661

Function 000001EFEF9710D8 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEF971103

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

__doserrno.LIBCMT ref: 000001EFEF9710FB

Part of subcall function 000001EFEF96AAA4: _getptd_noexit.LIBCMT ref: 000001EFEF96AAA8

__lock_fhandle.LIBCMT ref: 000001EFEF971147
_lseeki64_nolock.LIBCMT ref: 000001EFEF971160
_unlock_fhandle.LIBCMT ref: 000001EFEF971183

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction ID: 9c413f3d35fab74be26001057b5124028179cdf7d0f9f84d3b433b138735c870
Opcode Fuzzy Hash: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction Fuzzy Hash: 03215C336112C046FA256F25DC413ED6653A744BF0F1B423DAEA50B2F2EA38A8C38714

Function 000001EFEF970F60 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEF970F8B

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

__doserrno.LIBCMT ref: 000001EFEF970F83

Part of subcall function 000001EFEF96AAA4: _getptd_noexit.LIBCMT ref: 000001EFEF96AAA8

__lock_fhandle.LIBCMT ref: 000001EFEF970FCF
_lseek_nolock.LIBCMT ref: 000001EFEF970FE8
_unlock_fhandle.LIBCMT ref: 000001EFEF971009

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction ID: 00a436fa2c5f5108a90dbf9a9d0197318dd74b3e414b9b06118e61a9d2b2cfbb
Opcode Fuzzy Hash: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction Fuzzy Hash: 8A2168336116C046F6156B25DC413ED6693AB84BE1F1B413DAE950B2F2EB78A8C39B24

Function 000001EFEFB29EA0 Relevance: 13.7, APIs: 9, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB29EC6
_errno.LIBCMT ref: 000001EFEFB29EBB

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: 181d52bcb5af38a644f949309eae4e32f5a35df007ff24cdcce28bd57c8089db
Instruction ID: 6247418e6c33b6004488fe31dc2a0b7e86788226740b03cf320054fa5ae8fde2
Opcode Fuzzy Hash: 181d52bcb5af38a644f949309eae4e32f5a35df007ff24cdcce28bd57c8089db
Instruction Fuzzy Hash: FB512632514A8B8AFBA8AB18C4413FD32D0FB94321F56467EAC59C31F5E724F9C39251

Function 000001EFEF9792A0 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEF9792C6
_errno.LIBCMT ref: 000001EFEF9792BB

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction ID: 504066f43ed3a628adf639c7d682acdd3040919e96ecb6010b9142bf46313977
Opcode Fuzzy Hash: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction Fuzzy Hash: 7B41BF736023E186FB60AB22CD403ED3693E755BD4F924139AED4476E5F628A8C38600

Function 000001EFEFB20504 Relevance: 13.6, APIs: 9, Instructions: 89
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001EFEFB2052F

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

__doserrno.LIBCMT ref: 000001EFEFB20527

Part of subcall function 000001EFEFB1B6A4: _getptd_noexit.LIBCMT ref: 000001EFEFB1B6A8

__lock_fhandle.LIBCMT ref: 000001EFEFB20573
_unlock_fhandle.LIBCMT ref: 000001EFEFB205AD

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction ID: a10dd4ff10ded50a91f6d86a9ae91664fc2c2ed9ee05b3fd803f72e35d7f18a4
Opcode Fuzzy Hash: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction Fuzzy Hash: 2921E732A086824EF7186B68DC863ED72D0EBC5321F16426EEC15C71F3D664788387A6

Function 000001EFEFB1F828 Relevance: 13.6, APIs: 9, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEFB1F849

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

__doserrno.LIBCMT ref: 000001EFEFB1F841

Part of subcall function 000001EFEFB1B6A4: _getptd_noexit.LIBCMT ref: 000001EFEFB1B6A8

__lock_fhandle.LIBCMT ref: 000001EFEFB1F88D
_close_nolock.LIBCMT ref: 000001EFEFB1F8A0
_unlock_fhandle.LIBCMT ref: 000001EFEFB1F8B9

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction ID: 9b5299f978278d115b1ffc10ce4f1037fa94c7447bd6a0d2c110162b6e963ab4
Opcode Fuzzy Hash: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction Fuzzy Hash: 7E21C333905A82CEF715AB64C8953EC7690EB51328F17457EAC1A871F3C674A882C761

Function 000001EFEF96F904 Relevance: 13.6, APIs: 9, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEF96F92F

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

__doserrno.LIBCMT ref: 000001EFEF96F927

Part of subcall function 000001EFEF96AAA4: _getptd_noexit.LIBCMT ref: 000001EFEF96AAA8

__lock_fhandle.LIBCMT ref: 000001EFEF96F973
_unlock_fhandle.LIBCMT ref: 000001EFEF96F9AD

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction ID: d2559ee674eca2aafb8c2e390506310d3e76ee215e7dff6afa3db8a1550a0ef9
Opcode Fuzzy Hash: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction Fuzzy Hash: C621AC332002C056F6016F25DC413ED6653AB80BA8F1B413DAF950B3F6FA78A8C3C620

Function 000001EFEF96EC28 Relevance: 13.6, APIs: 9, Instructions: 57COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEF96EC49

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

__doserrno.LIBCMT ref: 000001EFEF96EC41

Part of subcall function 000001EFEF96AAA4: _getptd_noexit.LIBCMT ref: 000001EFEF96AAA8

__lock_fhandle.LIBCMT ref: 000001EFEF96EC8D
_close_nolock.LIBCMT ref: 000001EFEF96ECA0
_unlock_fhandle.LIBCMT ref: 000001EFEF96ECB9

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction ID: 0e114cfaef48c6ac35087cffdb966ecb4a951addc894bee66b8e6d721c9dd96b
Opcode Fuzzy Hash: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction Fuzzy Hash: C511AF336006C041F615AF35DC413EC6A53A7807A0F5B067DAE950B3F2E67CA8C38718

Function 000001EFEFB19B34 Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001EFEFB19B62

Part of subcall function 000001EFEFB19428: RtlFreeHeap.NTDLL ref: 000001EFEFB1943E
Part of subcall function 000001EFEFB19428: _errno.LIBCMT ref: 000001EFEFB19448

free.LIBCMT ref: 000001EFEFB19B77
free.LIBCMT ref: 000001EFEFB19B98
free.LIBCMT ref: 000001EFEFB19BAD
free.LIBCMT ref: 000001EFEFB19BC1
free.LIBCMT ref: 000001EFEFB19BCD
free.LIBCMT ref: 000001EFEFB19BF8
free.LIBCMT ref: 000001EFEFB19C19
free.LIBCMT ref: 000001EFEFB19C32
free.LIBCMT ref: 000001EFEFB19C63

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: free$FreeHeap_errno
String ID:
API String ID: 2737118440-0
Opcode ID: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction ID: 8e8001bcffb74ca50eaf6944bad550478dc18f4f235719300710755e3df97b9a
Opcode Fuzzy Hash: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction Fuzzy Hash: 5E41303151498F8BFBB4EB58E8D5BED32E1F758319F55403D9C05C22A1EA2CA896C711

Function 000001EFEFAE460C Relevance: 11.6, APIs: 9, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEFAE46A9

Part of subcall function 000001EFEFB19468: _FF_MSGBANNER.LIBCMT ref: 000001EFEFB19498
Part of subcall function 000001EFEFB19468: _NMSG_WRITE.LIBCMT ref: 000001EFEFB194A2
Part of subcall function 000001EFEFB19468: _callnewh.LIBCMT ref: 000001EFEFB194D6
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194E1
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194EC

malloc.LIBCMT ref: 000001EFEFAE46B3

Part of subcall function 000001EFEFB19468: _callnewh.LIBCMT ref: 000001EFEFB194FC
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB19501

malloc.LIBCMT ref: 000001EFEFAE46BE
free.LIBCMT ref: 000001EFEFAE487E
free.LIBCMT ref: 000001EFEFAE4886
free.LIBCMT ref: 000001EFEFAE488E

Part of subcall function 000001EFEFAE54F0: malloc.LIBCMT ref: 000001EFEFAE553A
Part of subcall function 000001EFEFAE54F0: malloc.LIBCMT ref: 000001EFEFAE5545
Part of subcall function 000001EFEFAE54F0: free.LIBCMT ref: 000001EFEFAE562C
Part of subcall function 000001EFEFAE54F0: free.LIBCMT ref: 000001EFEFAE5634

free.LIBCMT ref: 000001EFEFAE489A
free.LIBCMT ref: 000001EFEFAE48A7
free.LIBCMT ref: 000001EFEFAE48B4

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction ID: 5017dcedf7f8dc3a6c831e24e899f276a61d1f4c6ce893a37a335228b71b0fc3
Opcode Fuzzy Hash: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction Fuzzy Hash: 2E91F835718B894BE729AA5CD8417FD73D5EB85700F45422EDC8BD7297EE20B8838682

Function 000001EFEF933A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEF933AA9

Part of subcall function 000001EFEF968868: _FF_MSGBANNER.LIBCMT ref: 000001EFEF968898
Part of subcall function 000001EFEF968868: _NMSG_WRITE.LIBCMT ref: 000001EFEF9688A2
Part of subcall function 000001EFEF968868: _callnewh.LIBCMT ref: 000001EFEF9688D6
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688E1
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688EC

malloc.LIBCMT ref: 000001EFEF933AB3

Part of subcall function 000001EFEF968868: _callnewh.LIBCMT ref: 000001EFEF9688FC
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF968901

malloc.LIBCMT ref: 000001EFEF933ABE
free.LIBCMT ref: 000001EFEF933C7E
free.LIBCMT ref: 000001EFEF933C86
free.LIBCMT ref: 000001EFEF933C8E

Part of subcall function 000001EFEF9348F0: malloc.LIBCMT ref: 000001EFEF93493A
Part of subcall function 000001EFEF9348F0: malloc.LIBCMT ref: 000001EFEF934945
Part of subcall function 000001EFEF9348F0: free.LIBCMT ref: 000001EFEF934A2C
Part of subcall function 000001EFEF9348F0: free.LIBCMT ref: 000001EFEF934A34

free.LIBCMT ref: 000001EFEF933C9A
free.LIBCMT ref: 000001EFEF933CA7
free.LIBCMT ref: 000001EFEF933CB4

Memory Dump Source

Source File: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction ID: a88ab79ba21d1fc127fdff0fe3754001cbfd0550f38a0c8d746e06ca47979929
Opcode Fuzzy Hash: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction Fuzzy Hash: BE71D4333057C447EA249A26D850BEE6692FB85FC8F42403D9D8647BA6FB38E5878700

Function 000001EFEF966C8C Relevance: 10.6, APIs: 7, Instructions: 145stringCOMMON

Download Yara Rule

APIs

_time64.LIBCMT ref: 000001EFEF966CA8
malloc.LIBCMT ref: 000001EFEF966CF3
strtok.LIBCMT ref: 000001EFEF966D5B
strtok.LIBCMT ref: 000001EFEF966D9B
_time64.LIBCMT ref: 000001EFEF966DB3
_time64.LIBCMT ref: 000001EFEF966E6B
_time64.LIBCMT ref: 000001EFEF966F2A

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _time64$strtok$malloc
String ID:
API String ID: 2141844861-0
Opcode ID: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction ID: 0267f24446eedc4a1ed0825067d5f438dec7d2295a5056f747f75e1355239fb8
Opcode Fuzzy Hash: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction Fuzzy Hash: 3D910472505AC486E7628B19EC9439D77A2F345B54F13823DEED9867B4EB3DE0D28B00

Function 000001EFEF96B198 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001EFEF96B1B5

Part of subcall function 000001EFEF96EA24: _errno.LIBCMT ref: 000001EFEF96EA2D
Part of subcall function 000001EFEF96EA24: _invalid_parameter_noinfo.LIBCMT ref: 000001EFEF96EA38

_errno.LIBCMT ref: 000001EFEF96B1C5

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

_errno.LIBCMT ref: 000001EFEF96B1E1
_isatty.LIBCMT ref: 000001EFEF96B242
_getbuf.LIBCMT ref: 000001EFEF96B24E

Strings

, xrefs: 000001EFEF96B1D0

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-3916222277
Opcode ID: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction ID: a2c526685d3d0c014fd47bc40816add14c547213c664338ebdf3eb9452ba41e8
Opcode Fuzzy Hash: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction Fuzzy Hash: CA41C173610B8446EB689F25C8513AD37A2E764B98F17412DDE99473E5FA34E8C3C740

Function 000001EFEFB29D20 Relevance: 10.6, APIs: 7, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001EFEFB29D54

Part of subcall function 000001EFEFB1BF24: _getptd.LIBCMT ref: 000001EFEFB1BF3A
Part of subcall function 000001EFEFB1BF24: __updatetlocinfo.LIBCMT ref: 000001EFEFB1BF6F
Part of subcall function 000001EFEFB1BF24: __updatetmbcinfo.LIBCMT ref: 000001EFEFB1BF96

_errno.LIBCMT ref: 000001EFEFB29D6F
_invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB29D7A

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 9aa24401b2afff689c0b0903031154c7b35a263849ab08805c315ffe4c7e00e0
Instruction ID: 73cdde2a46c75c9efa85caabdd304eeb0d4129ad25ad32aa2e8b625148201b95
Opcode Fuzzy Hash: 9aa24401b2afff689c0b0903031154c7b35a263849ab08805c315ffe4c7e00e0
Instruction Fuzzy Hash: 2F315232608A894FE754DF18D0857AD76D0FB98350F5246ADEC4DC72A2EA70EC82D785

Function 000001EFEFB199D8 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEFB199FE

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB19A0A
__crtIsPackagedApp.LIBCMT ref: 000001EFEFB19A1B
_dosmaperr.LIBCMT ref: 000001EFEFB19A65

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction ID: 30981b1276701d1cc13d9c29ab4592722a24c9db39a7e1844e05bcbf34b62a9e
Opcode Fuzzy Hash: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction Fuzzy Hash: 4431B731A14A4A8FFB54AF69D4057AD72D1FB88318F15467EEC46C32F1EB34D8828742

Function 000001EFEFB24818 Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEFB24831

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

__lock_fhandle.LIBCMT ref: 000001EFEFB24879
__doserrno.LIBCMT ref: 000001EFEFB248AE
_errno.LIBCMT ref: 000001EFEFB248B5
_unlock_fhandle.LIBCMT ref: 000001EFEFB248C5

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction ID: 6ae6a41d512950023e8288af5d91feee1f01fbde61db1040f1c03d40d6bb501a
Opcode Fuzzy Hash: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction Fuzzy Hash: 7621C432614AC2CEF619AF68D8853ED6690EB85310F16467DAC06CF6F3C66468828661

Function 000001EFEF968DD8 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEF968DFE

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEF968E0A
__crtIsPackagedApp.LIBCMT ref: 000001EFEF968E1B
_dosmaperr.LIBCMT ref: 000001EFEF968E65

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction ID: fba8222409169372f2fe53c59ce4eeed4e12f81ba7517082f3a0ef91d61c57b7
Opcode Fuzzy Hash: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction Fuzzy Hash: AA318C73200B8086FB11AF22DC043AC66E6AB84B94F074539AE85477F5FF3CE5828300

Function 000001EFEF979120 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001EFEF979154

Part of subcall function 000001EFEF96B324: _getptd.LIBCMT ref: 000001EFEF96B33A
Part of subcall function 000001EFEF96B324: __updatetlocinfo.LIBCMT ref: 000001EFEF96B36F
Part of subcall function 000001EFEF96B324: __updatetmbcinfo.LIBCMT ref: 000001EFEF96B396

_errno.LIBCMT ref: 000001EFEF97916F
_invalid_parameter_noinfo.LIBCMT ref: 000001EFEF97917A

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction ID: 990c5873bca45b3c045c9b37fd52a0a36cc96e14c7712b28a5a62824a481ac7a
Opcode Fuzzy Hash: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction Fuzzy Hash: 3D319C732067C485E7209F11D8887DDA6A6F349BE4F564139AE9807BE5FB34E892C700

Function 000001EFEFB1A6D0 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEFB1A70C

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB1A717
memcpy_s.LIBCMT ref: 000001EFEFB1A7DC
_fileno.LIBCMT ref: 000001EFEFB1A847
_filbuf.LIBCMT ref: 000001EFEFB1A875
_errno.LIBCMT ref: 000001EFEFB1A8C5

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction ID: c1a5227a18b79807f37ea5c9a5d27b82145873f7046f923f44d3482020f90212
Opcode Fuzzy Hash: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction Fuzzy Hash: C961C232A18F4A4AE7285A2C88452BD76D5E794724F16033FDC56C32F5DB20BC9782C1

Function 000001EFEFAF2854 Relevance: 9.2, APIs: 6, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001EFEFAF7F80: malloc.LIBCMT ref: 000001EFEFAF7F97

Part of subcall function 000001EFEFB1A1E8: _errno.LIBCMT ref: 000001EFEFB1A13F
Part of subcall function 000001EFEFB1A1E8: _invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB1A14A

fseek.LIBCMT ref: 000001EFEFAF2929
_ftelli64.LIBCMT ref: 000001EFEFAF2933
fseek.LIBCMT ref: 000001EFEFAF2947
fclose.LIBCMT ref: 000001EFEFAF297E
fclose.LIBCMT ref: 000001EFEFAF29D3
malloc.LIBCMT ref: 000001EFEFAF29E2

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction ID: ba7472848cd0412131dac2f5a1048e1cf4da55a4703a13552d11df6d43cc8ab3
Opcode Fuzzy Hash: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction Fuzzy Hash: A97113325187848FD344EB18C455B9EB7E1FBD8314F55493DB88AD72B1CB34A986CB42

Function 000001EFEF969AD0 Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEF969B0C

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEF969B17
memcpy_s.LIBCMT ref: 000001EFEF969BDC
_fileno.LIBCMT ref: 000001EFEF969C47
_filbuf.LIBCMT ref: 000001EFEF969C75
_errno.LIBCMT ref: 000001EFEF969CC5

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction ID: ce2b66a2b6a7605375c8f166ec901750739cf4f74aba68e409305df385be6701
Opcode Fuzzy Hash: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction Fuzzy Hash: D151C7337042C442EB148A26DD007ED66D2A744BF4F174639AEA947BE4F738E4D38641

Function 000001EFEF941C54 Relevance: 9.1, APIs: 6, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 000001EFEF947380: malloc.LIBCMT ref: 000001EFEF947397

Part of subcall function 000001EFEF9695E8: _errno.LIBCMT ref: 000001EFEF96953F
Part of subcall function 000001EFEF9695E8: _invalid_parameter_noinfo.LIBCMT ref: 000001EFEF96954A

fseek.LIBCMT ref: 000001EFEF941D29
_ftelli64.LIBCMT ref: 000001EFEF941D33
fseek.LIBCMT ref: 000001EFEF941D47
fclose.LIBCMT ref: 000001EFEF941D7E
fclose.LIBCMT ref: 000001EFEF941DD3
malloc.LIBCMT ref: 000001EFEF941DE2

Memory Dump Source

Source File: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction ID: b2c639ea17b93ea929b2e9cc63dd12923fb89cd7ade04cb5b3d2c8502f766983
Opcode Fuzzy Hash: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction Fuzzy Hash: 77611C33218AC482E760DB15E88039EB762F7D5794F51412AEECD43BB9EE38D586CB40

Function 000001EFEFB1A1E8 Relevance: 9.1, APIs: 6, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEFB1A13F

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB1A14A
_getstream.LIBCMT ref: 000001EFEFB1A16A
_errno.LIBCMT ref: 000001EFEFB1A17C
_errno.LIBCMT ref: 000001EFEFB1A18E
_openfile.LIBCMT ref: 000001EFEFB1A1BC

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction ID: 2553df2284d0616160d2e3210208b082045902bed55d66d8e007d7984f81f55d
Opcode Fuzzy Hash: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction Fuzzy Hash: 7B219732A18B8B4FF754EB28C4053AD76D5EB55314F06457F9C45C32B5EB24EC828751

Function 000001EFEFAF1080 Relevance: 9.1, APIs: 6, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEFAF1097

Part of subcall function 000001EFEFB19468: _FF_MSGBANNER.LIBCMT ref: 000001EFEFB19498
Part of subcall function 000001EFEFB19468: _NMSG_WRITE.LIBCMT ref: 000001EFEFB194A2
Part of subcall function 000001EFEFB19468: _callnewh.LIBCMT ref: 000001EFEFB194D6
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194E1
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194EC

free.LIBCMT ref: 000001EFEFAF10E0

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction ID: 515f5323567d8548023b62a710eeddb793374292824c64eb07429a96fde590e8
Opcode Fuzzy Hash: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction Fuzzy Hash: 25319132918A848FE344EB28C4547DE77E0FF98314F41063DBC8AD72B1DA34A982CB46

Function 000001EFEF9695E8 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEF96953F

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEF96954A
_getstream.LIBCMT ref: 000001EFEF96956A
_errno.LIBCMT ref: 000001EFEF96957C
_errno.LIBCMT ref: 000001EFEF96958E
_openfile.LIBCMT ref: 000001EFEF9695BC

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction ID: e072d4533409fee136c3c4e747543291516876374b2bc0005cf92a86af3e2351
Opcode Fuzzy Hash: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction Fuzzy Hash: DC2193733146C285FB619B32DC0139EA693A744BC4F074439ADC987BA6FB3DD4829711

Function 000001EFEF940480 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEF940497

Part of subcall function 000001EFEF968868: _FF_MSGBANNER.LIBCMT ref: 000001EFEF968898
Part of subcall function 000001EFEF968868: _NMSG_WRITE.LIBCMT ref: 000001EFEF9688A2
Part of subcall function 000001EFEF968868: _callnewh.LIBCMT ref: 000001EFEF9688D6
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688E1
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688EC

free.LIBCMT ref: 000001EFEF9404E0

Memory Dump Source

Source File: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction ID: 62bc20fc73ceab2b19c7bbc3f0143c7a5a7cf3d1f1abe8c6797dcc48a81bd788
Opcode Fuzzy Hash: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction Fuzzy Hash: F421FF33518AC081DA20AB11E89039E6762F7D4794F510239BEDE43AFAEE3CD582CB41

Function 000001EFEF96CE24 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000001EFEF96CE41

Part of subcall function 000001EFEF96ABEC: _set_error_mode.LIBCMT ref: 000001EFEF96ABF5
Part of subcall function 000001EFEF96ABEC: _set_error_mode.LIBCMT ref: 000001EFEF96AC04
Part of subcall function 000001EFEF96ABEC: _NMSG_WRITE.LIBCMT ref: 000001EFEF96AC1B
Part of subcall function 000001EFEF96ABEC: _NMSG_WRITE.LIBCMT ref: 000001EFEF96AC25

_NMSG_WRITE.LIBCMT ref: 000001EFEF96CE4B

Part of subcall function 000001EFEF96AC60: _set_error_mode.LIBCMT ref: 000001EFEF96ACA5
Part of subcall function 000001EFEF96AC60: _set_error_mode.LIBCMT ref: 000001EFEF96ACB6
Part of subcall function 000001EFEF96AC60: __crtMessageBoxW.LIBCMT ref: 000001EFEF96ADC9

Part of subcall function 000001EFEF968F1C: __crtCorExitProcess.LIBCMT ref: 000001EFEF968F24
Part of subcall function 000001EFEF968F1C: free.LIBCMT ref: 000001EFEF968F62
Part of subcall function 000001EFEF968F1C: free.LIBCMT ref: 000001EFEF968F77
Part of subcall function 000001EFEF968F1C: free.LIBCMT ref: 000001EFEF968F98
Part of subcall function 000001EFEF968F1C: free.LIBCMT ref: 000001EFEF968FAD
Part of subcall function 000001EFEF968F1C: free.LIBCMT ref: 000001EFEF968FC1
Part of subcall function 000001EFEF968F1C: free.LIBCMT ref: 000001EFEF968FCD
Part of subcall function 000001EFEF968F1C: free.LIBCMT ref: 000001EFEF968FF8
Part of subcall function 000001EFEF968F1C: free.LIBCMT ref: 000001EFEF969019
Part of subcall function 000001EFEF968F1C: free.LIBCMT ref: 000001EFEF969032
Part of subcall function 000001EFEF968F1C: free.LIBCMT ref: 000001EFEF969063

_malloc_crt.LIBCMT ref: 000001EFEF96CE77

Part of subcall function 000001EFEF96D778: malloc.LIBCMT ref: 000001EFEF96D7A3

_errno.LIBCMT ref: 000001EFEF96CE84
_lock.LIBCMT ref: 000001EFEF96CE98
free.LIBCMT ref: 000001EFEF96CEB9

Part of subcall function 000001EFEF968828: _errno.LIBCMT ref: 000001EFEF968848

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_set_error_mode$__crt_errno$ExitMessageProcess_lock_malloc_crtmalloc
String ID:
API String ID: 2751257304-0
Opcode ID: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction ID: d717009d50db3fcaf7df27e522a9a8643c856ebffdfd7b2f347bdb6c7224be04
Opcode Fuzzy Hash: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction Fuzzy Hash: CB116A332206C481F666AB60ED553ED22A3EB44781F43143CBDCA562F2EE78A8C28350

Function 000001EFEFAE4170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEFAE41BD

Part of subcall function 000001EFEFB19468: _FF_MSGBANNER.LIBCMT ref: 000001EFEFB19498
Part of subcall function 000001EFEFB19468: _NMSG_WRITE.LIBCMT ref: 000001EFEFB194A2
Part of subcall function 000001EFEFB19468: _callnewh.LIBCMT ref: 000001EFEFB194D6
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194E1
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194EC

malloc.LIBCMT ref: 000001EFEFAE41C8

Part of subcall function 000001EFEFB19468: _callnewh.LIBCMT ref: 000001EFEFB194FC
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB19501

free.LIBCMT ref: 000001EFEFAE42AF
free.LIBCMT ref: 000001EFEFAE42B7
free.LIBCMT ref: 000001EFEFAE42BF
free.LIBCMT ref: 000001EFEFAE42CB
free.LIBCMT ref: 000001EFEFAE42D8

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction ID: cd096379ca6d516a14ef0fefd08e500e989d3b20cff278ec881bc8613a18b8f7
Opcode Fuzzy Hash: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction Fuzzy Hash: A1510435618F8A4BE759AB28D8512FD73D8FB49704F51413DEC4BC72A7EA20E8D38681

Function 000001EFEF933570 Relevance: 8.9, APIs: 7, Instructions: 115COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEF9335BD

Part of subcall function 000001EFEF968868: _FF_MSGBANNER.LIBCMT ref: 000001EFEF968898
Part of subcall function 000001EFEF968868: _NMSG_WRITE.LIBCMT ref: 000001EFEF9688A2
Part of subcall function 000001EFEF968868: _callnewh.LIBCMT ref: 000001EFEF9688D6
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688E1
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688EC

malloc.LIBCMT ref: 000001EFEF9335C8

Part of subcall function 000001EFEF968868: _callnewh.LIBCMT ref: 000001EFEF9688FC
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF968901

free.LIBCMT ref: 000001EFEF9336AF
free.LIBCMT ref: 000001EFEF9336B7
free.LIBCMT ref: 000001EFEF9336BF
free.LIBCMT ref: 000001EFEF9336CB
free.LIBCMT ref: 000001EFEF9336D8

Memory Dump Source

Source File: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction ID: 037ec4921645dfe87e9bacf85e6071b2d7ba075492043d6aaa19ed24585fddbe
Opcode Fuzzy Hash: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction Fuzzy Hash: 8441CD337516E19BFA189A22DD5169D27A2FB05F84F820438DE9607761EF38E4A3C300

Function 000001EFEFAECB50 Relevance: 7.8, APIs: 6, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001EFEFAF7F80: malloc.LIBCMT ref: 000001EFEFAF7F97

malloc.LIBCMT ref: 000001EFEFAECC4E

Part of subcall function 000001EFEFB19468: _FF_MSGBANNER.LIBCMT ref: 000001EFEFB19498
Part of subcall function 000001EFEFB19468: _NMSG_WRITE.LIBCMT ref: 000001EFEFB194A2
Part of subcall function 000001EFEFB19468: _callnewh.LIBCMT ref: 000001EFEFB194D6
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194E1
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194EC

Part of subcall function 000001EFEFB18AEC: malloc.LIBCMT ref: 000001EFEFB18B27

Part of subcall function 000001EFEFB18AEC: realloc.LIBCMT ref: 000001EFEFB18B4E

malloc.LIBCMT ref: 000001EFEFAECD82
_snprintf.LIBCMT ref: 000001EFEFAECE10
_snprintf.LIBCMT ref: 000001EFEFAECE4A
_snprintf.LIBCMT ref: 000001EFEFAECE74
free.LIBCMT ref: 000001EFEFAED07B

Part of subcall function 000001EFEFB19428: RtlFreeHeap.NTDLL ref: 000001EFEFB1943E
Part of subcall function 000001EFEFB19428: _errno.LIBCMT ref: 000001EFEFB19448

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: malloc$_errno_snprintf$FreeHeap_callnewhfreerealloc
String ID:
API String ID: 1397185943-0
Opcode ID: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction ID: 7fc33a5a21ff0e4ade9156213032903f9853892aee3a5f5b3d7309262ae5dc36
Opcode Fuzzy Hash: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction Fuzzy Hash: B6E14F726146858FF354FB24C8517EE77E2FB84704F55453EAC86DB2E2DA34A882CB42

Function 000001EFEF93BF50 Relevance: 7.8, APIs: 6, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 000001EFEF947380: malloc.LIBCMT ref: 000001EFEF947397

malloc.LIBCMT ref: 000001EFEF93C04E

Part of subcall function 000001EFEF968868: _FF_MSGBANNER.LIBCMT ref: 000001EFEF968898
Part of subcall function 000001EFEF968868: _NMSG_WRITE.LIBCMT ref: 000001EFEF9688A2
Part of subcall function 000001EFEF968868: _callnewh.LIBCMT ref: 000001EFEF9688D6
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688E1
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688EC

Part of subcall function 000001EFEF967EEC: malloc.LIBCMT ref: 000001EFEF967F27

Part of subcall function 000001EFEF967EEC: realloc.LIBCMT ref: 000001EFEF967F4E

malloc.LIBCMT ref: 000001EFEF93C182
_snprintf.LIBCMT ref: 000001EFEF93C210
_snprintf.LIBCMT ref: 000001EFEF93C24A
_snprintf.LIBCMT ref: 000001EFEF93C274
free.LIBCMT ref: 000001EFEF93C47B

Memory Dump Source

Source File: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$_callnewhfreerealloc
String ID:
API String ID: 74200508-0
Opcode ID: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction ID: 0f7560bc02c27b51a1304bbcd3bfa1075a982ead47f24f7a5491b423633aa736
Opcode Fuzzy Hash: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction Fuzzy Hash: BCD139732156C086F750AB65EC517EE66A3E7C4344F52003DAEC9876F6EF38E8868B41

Function 000001EFEFB24424 Relevance: 7.7, APIs: 5, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000001EFEFB24451

Part of subcall function 000001EFEFB1DA24: _FF_MSGBANNER.LIBCMT ref: 000001EFEFB1DA41
Part of subcall function 000001EFEFB1DA24: _NMSG_WRITE.LIBCMT ref: 000001EFEFB1DA4B

_lock.LIBCMT ref: 000001EFEFB24464
_lock.LIBCMT ref: 000001EFEFB244BF
_calloc_crt.LIBCMT ref: 000001EFEFB24576

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction ID: 9c033a1a07401dcff29bf109f6ba17b44c683a4ac55e61f7148b86564a3399bc
Opcode Fuzzy Hash: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction Fuzzy Hash: F051D871524A4ACBF7549F58C8853A9B3D0FB98310F16456DEC8ACB1B7D674EC838682

Function 000001EFEFAE54F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEFAE553A

Part of subcall function 000001EFEFB19468: _FF_MSGBANNER.LIBCMT ref: 000001EFEFB19498
Part of subcall function 000001EFEFB19468: _NMSG_WRITE.LIBCMT ref: 000001EFEFB194A2
Part of subcall function 000001EFEFB19468: _callnewh.LIBCMT ref: 000001EFEFB194D6
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194E1
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194EC

malloc.LIBCMT ref: 000001EFEFAE5545

Part of subcall function 000001EFEFB19468: _callnewh.LIBCMT ref: 000001EFEFB194FC
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB19501

free.LIBCMT ref: 000001EFEFAE562C
free.LIBCMT ref: 000001EFEFAE5634
free.LIBCMT ref: 000001EFEFAE5640
free.LIBCMT ref: 000001EFEFAE564D

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction ID: d731c08880f9dc1c80b4a09dc3b0fbef8a285d34fc482499b12c994f7a7c566e
Opcode Fuzzy Hash: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction Fuzzy Hash: 3241FB32618B8D0FE769BA2CD8012BE72D5E795714F19053DDC8BC7263ED20E8838791

Function 000001EFEFB1BD98 Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001EFEFB1BDB5

Part of subcall function 000001EFEFB1F624: _errno.LIBCMT ref: 000001EFEFB1F62D
Part of subcall function 000001EFEFB1F624: _invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB1F638

_errno.LIBCMT ref: 000001EFEFB1BDC5

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

_errno.LIBCMT ref: 000001EFEFB1BDE1
_isatty.LIBCMT ref: 000001EFEFB1BE42
_getbuf.LIBCMT ref: 000001EFEFB1BE4E

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction ID: 66c2c04462f8cb0ca616be16a3d54ae014b4bfb096217e02e0295eebdd40a1cc
Opcode Fuzzy Hash: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction Fuzzy Hash: D851D532A14A8A4FEB58EF28C4C17AE77D0EB49314F15456EDC55CB2E6D634E8C2C780

Function 000001EFEFAFCF00 Relevance: 7.6, APIs: 6, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEFAFCF18

Part of subcall function 000001EFEFB19468: _FF_MSGBANNER.LIBCMT ref: 000001EFEFB19498
Part of subcall function 000001EFEFB19468: _NMSG_WRITE.LIBCMT ref: 000001EFEFB194A2
Part of subcall function 000001EFEFB19468: _callnewh.LIBCMT ref: 000001EFEFB194D6
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194E1
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194EC

_snprintf.LIBCMT ref: 000001EFEFAFCF38

Part of subcall function 000001EFEFB19700: _errno.LIBCMT ref: 000001EFEFB19737
Part of subcall function 000001EFEFB19700: _invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB19742

free.LIBCMT ref: 000001EFEFAFCF57

Part of subcall function 000001EFEFB19428: RtlFreeHeap.NTDLL ref: 000001EFEFB1943E
Part of subcall function 000001EFEFB19428: _errno.LIBCMT ref: 000001EFEFB19448

malloc.LIBCMT ref: 000001EFEFAFCFE0
_snprintf.LIBCMT ref: 000001EFEFAFD007
free.LIBCMT ref: 000001EFEFAFD045

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _errno$_snprintffreemalloc$FreeHeap_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 343393124-0
Opcode ID: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction ID: 851aef037a718d535ee19652ea3a89be1dbb528adadcc36148bb08cb0c2e8c28
Opcode Fuzzy Hash: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction Fuzzy Hash: 1941AB32218A854FE750EF28C454BAEB7F1FB99354F55053DEC89D72B0DA25E982C702

Function 000001EFEF9348F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEF93493A

Part of subcall function 000001EFEF968868: _FF_MSGBANNER.LIBCMT ref: 000001EFEF968898
Part of subcall function 000001EFEF968868: _NMSG_WRITE.LIBCMT ref: 000001EFEF9688A2
Part of subcall function 000001EFEF968868: _callnewh.LIBCMT ref: 000001EFEF9688D6
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688E1
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688EC

malloc.LIBCMT ref: 000001EFEF934945

Part of subcall function 000001EFEF968868: _callnewh.LIBCMT ref: 000001EFEF9688FC
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF968901

free.LIBCMT ref: 000001EFEF934A2C
free.LIBCMT ref: 000001EFEF934A34
free.LIBCMT ref: 000001EFEF934A40
free.LIBCMT ref: 000001EFEF934A4D

Memory Dump Source

Source File: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction ID: e6e231762fcb41981e65eb4368d43c6d56830b7ae78e76c30f4b4dbcb2f33ffe
Opcode Fuzzy Hash: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction Fuzzy Hash: CF41EF333152C146EA599B2ADC0029E6B96F755B88F5B8038DD958B761FF38E987C300

Function 000001EFEFB29262 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 000001EFEFB2910C
_malloc_crt.LIBCMT ref: 000001EFEFB2912E
free.LIBCMT ref: 000001EFEFB291C4
_recalloc_crt.LIBCMT ref: 000001EFEFB29275

Part of subcall function 000001EFEFB1E478: _recalloc.LIBCMT ref: 000001EFEFB1E4A8

_calloc_crt.LIBCMT ref: 000001EFEFB292B1

Part of subcall function 000001EFEFB1E2F8: _calloc_impl.LIBCMT ref: 000001EFEFB1E326

_errno.LIBCMT ref: 000001EFEFB29301

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

free.LIBCMT ref: 000001EFEFB2930F
free.LIBCMT ref: 000001EFEFB2931C
free.LIBCMT ref: 000001EFEFB2932E

Part of subcall function 000001EFEFB24FBC: _errno.LIBCMT ref: 000001EFEFB24FD4
Part of subcall function 000001EFEFB24FBC: _invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB24FE0

_invoke_watson.LIBCMT ref: 000001EFEFB2934A

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: free$_errno_malloc_crt$_calloc_crt_calloc_impl_getptd_noexit_invalid_parameter_noinfo_invoke_watson_recalloc_recalloc_crt
String ID:
API String ID: 321378830-0
Opcode ID: 1af5591cc140629ef8a1eaab72b160ba28423dfa39d6b40620a42b0b9187e2b6
Instruction ID: 12ffdf3b83692dde31aef7f246ac4b24e9aebfc6b7fdd0b030326e877b086b6e
Opcode Fuzzy Hash: 1af5591cc140629ef8a1eaab72b160ba28423dfa39d6b40620a42b0b9187e2b6
Instruction Fuzzy Hash: 5F21B732714E8E4EF754AF69D4467ED72C0FB94320F52453E9C4DC21F2EA24A8878682

Function 000001EFEFB2963A Relevance: 7.6, APIs: 5, Instructions: 99COMMON

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 000001EFEFB294B9
_malloc_crt.LIBCMT ref: 000001EFEFB294DE
free.LIBCMT ref: 000001EFEFB2957B
_recalloc_crt.LIBCMT ref: 000001EFEFB2964D

Part of subcall function 000001EFEFB1E478: _recalloc.LIBCMT ref: 000001EFEFB1E4A8

_calloc_crt.LIBCMT ref: 000001EFEFB2968C

Part of subcall function 000001EFEFB1E2F8: _calloc_impl.LIBCMT ref: 000001EFEFB1E326

_errno.LIBCMT ref: 000001EFEFB296D6

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

free.LIBCMT ref: 000001EFEFB296E4
free.LIBCMT ref: 000001EFEFB296F1
free.LIBCMT ref: 000001EFEFB29703

Part of subcall function 000001EFEFB22DD0: _errno.LIBCMT ref: 000001EFEFB22DEC
Part of subcall function 000001EFEFB22DD0: _invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB22DF8

_invoke_watson.LIBCMT ref: 000001EFEFB2971F

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: free$_errno_malloc_crt$_calloc_crt_calloc_impl_getptd_noexit_invalid_parameter_noinfo_invoke_watson_recalloc_recalloc_crt
String ID:
API String ID: 321378830-0
Opcode ID: 8a2acd4545fb3e1ff377b7186d7311079e6a4c6a1743b8f02e9e066f6884292d
Instruction ID: 417e579dc360734a1c4d357716ab7e59db885e74fa9e87099cc230b3e848894b
Opcode Fuzzy Hash: 8a2acd4545fb3e1ff377b7186d7311079e6a4c6a1743b8f02e9e066f6884292d
Instruction Fuzzy Hash: A2218132718E8B4AF7656F18D8517ED72C0FBC4750F52053EDC5AC22F2EA64A8939682

Function 000001EFEFB295B9 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_recalloc_crt.LIBCMT ref: 000001EFEFB295D1

Part of subcall function 000001EFEFB1E478: _recalloc.LIBCMT ref: 000001EFEFB1E4A8

_calloc_crt.LIBCMT ref: 000001EFEFB2968C
_errno.LIBCMT ref: 000001EFEFB296D6
free.LIBCMT ref: 000001EFEFB296E4
free.LIBCMT ref: 000001EFEFB296F1
free.LIBCMT ref: 000001EFEFB29703

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: free$_calloc_crt_errno_recalloc_recalloc_crt
String ID:
API String ID: 3700215360-0
Opcode ID: 5671fb06d6f05841401363cc8443e27ee7f0052eb4ca124240904de72179e6d7
Instruction ID: 5cc1b0c8d83a863f83c0dee679eab65e4a435e26d8be59e41c73cc2a37c345f2
Opcode Fuzzy Hash: 5671fb06d6f05841401363cc8443e27ee7f0052eb4ca124240904de72179e6d7
Instruction Fuzzy Hash: 7F21B332718E5B4AF765AB18D8517ED72C0FBC4350F42053EDC4BC21E2FE24A8839682

Function 000001EFEFB291FD Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_recalloc_crt.LIBCMT ref: 000001EFEFB29215

Part of subcall function 000001EFEFB1E478: _recalloc.LIBCMT ref: 000001EFEFB1E4A8

_calloc_crt.LIBCMT ref: 000001EFEFB292B1
_errno.LIBCMT ref: 000001EFEFB29301
free.LIBCMT ref: 000001EFEFB2930F
free.LIBCMT ref: 000001EFEFB2931C
free.LIBCMT ref: 000001EFEFB2932E

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: free$_calloc_crt_errno_recalloc_recalloc_crt
String ID:
API String ID: 3700215360-0
Opcode ID: d21b9421d81b7aad527b41b40eb760196fdcb429390ac35a4901b8c372e18314
Instruction ID: bc2036fe1a440b6b74789a1c326b0d344b8b4353ab69935c277c93587f2b06d9
Opcode Fuzzy Hash: d21b9421d81b7aad527b41b40eb760196fdcb429390ac35a4901b8c372e18314
Instruction Fuzzy Hash: 37219232718A8E4EF754AB69D8463ED73C1EBD4350F52453E9C4EC21F2FE24A8878242

Function 000001EFEFB246C8 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEFB246D9

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

__doserrno.LIBCMT ref: 000001EFEFB246D1

Part of subcall function 000001EFEFB1B6A4: _getptd_noexit.LIBCMT ref: 000001EFEFB1B6A8

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction ID: 0af3ea517ad16154015e506f21a293049134497c63f1a2c2de13f18dbd85ca9a
Opcode Fuzzy Hash: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction Fuzzy Hash: 1F01D6326149CACEF659AF28CD417DC3590EF56329F56C26D9C19CB4F3C67824C28622

Function 000001EFEFAF33EC Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEFAF3404

Part of subcall function 000001EFEFB19468: _FF_MSGBANNER.LIBCMT ref: 000001EFEFB19498
Part of subcall function 000001EFEFB19468: _NMSG_WRITE.LIBCMT ref: 000001EFEFB194A2
Part of subcall function 000001EFEFB19468: _callnewh.LIBCMT ref: 000001EFEFB194D6
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194E1
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194EC

_snprintf.LIBCMT ref: 000001EFEFAF342E

Part of subcall function 000001EFEFB19700: _errno.LIBCMT ref: 000001EFEFB19737
Part of subcall function 000001EFEFB19700: _invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB19742

remove.LIBCMT ref: 000001EFEFAF343F
remove.LIBCMT ref: 000001EFEFAF344B
free.LIBCMT ref: 000001EFEFAF3455

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction ID: cb94ec7ff9e55770c08e43d93b7d2cc61838f73c2defc66d024379109e1c0a65
Opcode Fuzzy Hash: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction Fuzzy Hash: 05014B715287899FE384EB18C485B9EB7E1FBC8705F81083EBC89C22A1DB34A485C743

Function 000001EFEF973AC8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEF973AD9

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

__doserrno.LIBCMT ref: 000001EFEF973AD1

Part of subcall function 000001EFEF96AAA4: _getptd_noexit.LIBCMT ref: 000001EFEF96AAA8

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction ID: e6c337819db2d59254deff02dbfb8da1b49f01f989f9e5a9fa01e4c0f9f700de
Opcode Fuzzy Hash: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction Fuzzy Hash: 5D014B737127C441EA455B14CC813EC36939B54BB5F57433ADEAA0A3F2E72864938211

Function 000001EFEF9427EC Relevance: 7.5, APIs: 5, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEF942804

Part of subcall function 000001EFEF968868: _FF_MSGBANNER.LIBCMT ref: 000001EFEF968898
Part of subcall function 000001EFEF968868: _NMSG_WRITE.LIBCMT ref: 000001EFEF9688A2
Part of subcall function 000001EFEF968868: _callnewh.LIBCMT ref: 000001EFEF9688D6
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688E1
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688EC

_snprintf.LIBCMT ref: 000001EFEF94282E

Part of subcall function 000001EFEF968B00: _errno.LIBCMT ref: 000001EFEF968B37
Part of subcall function 000001EFEF968B00: _invalid_parameter_noinfo.LIBCMT ref: 000001EFEF968B42

remove.LIBCMT ref: 000001EFEF94283F
remove.LIBCMT ref: 000001EFEF94284B
free.LIBCMT ref: 000001EFEF942855

Memory Dump Source

Source File: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction ID: 433d9fea216a96f2777ff6befad4498d75c08cfbe141041c3a6bda54f1296155
Opcode Fuzzy Hash: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction Fuzzy Hash: A9F0C972528AC086D644AB51F85169EA361FBC4780F42112ABECD56B79EB38D592CB40

Function 000001EFEFB168D4 Relevance: 6.5, APIs: 5, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEFB16917
free.LIBCMT ref: 000001EFEFB1693C

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction ID: baf1bb0367ddf73bba9faef147640ddf517987ecada1a75c7599756ebb901295
Opcode Fuzzy Hash: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction Fuzzy Hash: A79143325187C58FE764EB28C4457DFB7E5FB84304F51093EA88AC72A2DB74A886C742

Function 000001EFEF965CD4 Relevance: 6.4, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEF965D17
free.LIBCMT ref: 000001EFEF965D3C

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction ID: 7695a38c0f400f8c3641e073599bc0c34e29ea2b82011790fde1dfd55439fb1f
Opcode Fuzzy Hash: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction Fuzzy Hash: F68102331086C08AE760DB25E8513DE7762F7C5740F520439EEC987AB9EB79E586CB41

Function 000001EFEFB192BC Relevance: 6.3, APIs: 5, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEFB192D6

Part of subcall function 000001EFEFB19468: _FF_MSGBANNER.LIBCMT ref: 000001EFEFB19498
Part of subcall function 000001EFEFB19468: _NMSG_WRITE.LIBCMT ref: 000001EFEFB194A2
Part of subcall function 000001EFEFB19468: _callnewh.LIBCMT ref: 000001EFEFB194D6
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194E1
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194EC

malloc.LIBCMT ref: 000001EFEFB192F5

Part of subcall function 000001EFEFB19468: _callnewh.LIBCMT ref: 000001EFEFB194FC
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB19501

malloc.LIBCMT ref: 000001EFEFB1932C
_snprintf.LIBCMT ref: 000001EFEFB19358

Part of subcall function 000001EFEFB19700: _errno.LIBCMT ref: 000001EFEFB19737
Part of subcall function 000001EFEFB19700: _invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB19742

malloc.LIBCMT ref: 000001EFEFB1939B

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction ID: 4206c62d69d4845769304387b83430c238a308bc1c8dddfee8d7b3adbf332685
Opcode Fuzzy Hash: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction Fuzzy Hash: 5B31DC7451CB889FDB84EF18C044A5AB7E1FB9C315F10066EA88DD73A1DB34E982CB42

Function 000001EFEF9686BC Relevance: 6.3, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEF9686D6

Part of subcall function 000001EFEF968868: _FF_MSGBANNER.LIBCMT ref: 000001EFEF968898
Part of subcall function 000001EFEF968868: _NMSG_WRITE.LIBCMT ref: 000001EFEF9688A2
Part of subcall function 000001EFEF968868: _callnewh.LIBCMT ref: 000001EFEF9688D6
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688E1
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688EC

malloc.LIBCMT ref: 000001EFEF9686F5

Part of subcall function 000001EFEF968868: _callnewh.LIBCMT ref: 000001EFEF9688FC
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF968901

malloc.LIBCMT ref: 000001EFEF96872C
_snprintf.LIBCMT ref: 000001EFEF968758

Part of subcall function 000001EFEF968B00: _errno.LIBCMT ref: 000001EFEF968B37
Part of subcall function 000001EFEF968B00: _invalid_parameter_noinfo.LIBCMT ref: 000001EFEF968B42

malloc.LIBCMT ref: 000001EFEF96879B

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction ID: 71d8e0cd21fde519baff49f86d1805e4c1068eecd0d4156c30398f344e3b7970
Opcode Fuzzy Hash: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction Fuzzy Hash: 4421E976608B8486CA24DB16E45025EB7A1F7CDB94F114225EEDD43BA8DF3CC682CF00

Function 000001EFEFB1A1F4 Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEFB1A22C

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB1A237
_flush.LIBCMT ref: 000001EFEFB1A2E9
_fileno.LIBCMT ref: 000001EFEFB1A30A

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction ID: 76e227a2f021f97d8b6c2a97937821c32687c19df1948f7c9e215b7e9c57b8da
Opcode Fuzzy Hash: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction Fuzzy Hash: B051B831A18F4A4AE6686A6DE4453BD72C5EB59314F16023FDC5AC31F6EB61FC8381C1

Function 000001EFEF9695F4 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEF96962C

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEF969637
_flush.LIBCMT ref: 000001EFEF9696E9
_fileno.LIBCMT ref: 000001EFEF96970A

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction ID: 78c3748c531b41c343cfdd49331420262d5b061655f6d77c86819d08c7d787d5
Opcode Fuzzy Hash: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction Fuzzy Hash: 8E41C2337003C046EF659E22DD443AEB692B744BE4F1B42389ED647AE5FA78E5C38601

Function 000001EFEFAE10D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000001EFEFAE1117
clock.LIBCMT ref: 000001EFEFAE1124
clock.LIBCMT ref: 000001EFEFAE112D
clock.LIBCMT ref: 000001EFEFAE113A

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: 8ffb2876aded5dd2d9f0b2fa3919b1d5f7be1cffbdce7306ba7c756cf2c51de1
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: B221F97240C7590AE764B9E8D8423AEB6C0DB85750F1A023EEC87D7162E550ACC382C6

Function 000001EFEFB29728 Relevance: 6.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001EFEFB2974C

Part of subcall function 000001EFEFB1BF24: _getptd.LIBCMT ref: 000001EFEFB1BF3A
Part of subcall function 000001EFEFB1BF24: __updatetlocinfo.LIBCMT ref: 000001EFEFB1BF6F
Part of subcall function 000001EFEFB1BF24: __updatetmbcinfo.LIBCMT ref: 000001EFEFB1BF96

_errno.LIBCMT ref: 000001EFEFB29758

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB29763
strchr.LIBCMT ref: 000001EFEFB29779

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction ID: dafd8fe4c5e51625a3683146e6e53894808d81042b5240af16ad6a66376cf01d
Opcode Fuzzy Hash: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction Fuzzy Hash: 1A212B725186E64AF7949E28C0943BE36D1E7C4395F060E7DAC9EC71F1EB2098C3E251

Function 000001EFEF978B28 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001EFEF978B4C

Part of subcall function 000001EFEF96B324: _getptd.LIBCMT ref: 000001EFEF96B33A
Part of subcall function 000001EFEF96B324: __updatetlocinfo.LIBCMT ref: 000001EFEF96B36F
Part of subcall function 000001EFEF96B324: __updatetmbcinfo.LIBCMT ref: 000001EFEF96B396

_errno.LIBCMT ref: 000001EFEF978B58

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEF978B63
strchr.LIBCMT ref: 000001EFEF978B79

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction ID: e07a7eabcd1a3edcd82c98b7d912f58d52e3c6b269668c0aad11d3fa05635633
Opcode Fuzzy Hash: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction Fuzzy Hash: B121F3B36063E441EB605615D8503BD6BD3E384BD4F6E4139AEC60BAE5F92CD6C38710

Function 000001EFEF9304D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

clock.LIBCMT ref: 000001EFEF930517
clock.LIBCMT ref: 000001EFEF930524
clock.LIBCMT ref: 000001EFEF93052D
clock.LIBCMT ref: 000001EFEF93053A

Memory Dump Source

Source File: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: 4f74204a94a95a44534630a26078d98ebab48d2b31f99bf34be1ac96c216eaa6
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: A811B2336057C446E6649EA6F8402AFB691B7843D8F1B1039EEC4436B1F975E8C28600

Function 000001EFEF9470FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000001EFEF947380: malloc.LIBCMT ref: 000001EFEF947397

strrchr.LIBCMT ref: 000001EFEF9471F2
_snprintf.LIBCMT ref: 000001EFEF94730C

Strings

:, xrefs: 000001EFEF94734F

Memory Dump Source

Source File: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintfmallocstrrchr
String ID: :
API String ID: 3587327836-336475711
Opcode ID: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction ID: 12ccdbb53da02943dad4ec4b46c4532145adbf0aa7b6d8ff1945b00ae11fd1a2
Opcode Fuzzy Hash: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction Fuzzy Hash: FF61C932229BC486E750DB15E88039EB7A1F3C5790F515129EEC947BB9DF78D486CB40

Function 000001EFEFAFB940 Relevance: 5.3, APIs: 4, Instructions: 321COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEFAFB9AA

Part of subcall function 000001EFEFB19468: _FF_MSGBANNER.LIBCMT ref: 000001EFEFB19498
Part of subcall function 000001EFEFB19468: _NMSG_WRITE.LIBCMT ref: 000001EFEFB194A2
Part of subcall function 000001EFEFB19468: _callnewh.LIBCMT ref: 000001EFEFB194D6
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194E1
Part of subcall function 000001EFEFB19468: _errno.LIBCMT ref: 000001EFEFB194EC

free.LIBCMT ref: 000001EFEFAFBDE3

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction ID: c1dfe804664f679f0a8e76c46b383d827713736ed1261fa2f8bdc066c752886e
Opcode Fuzzy Hash: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction Fuzzy Hash: F7D119712587858FD7A4DB18C0447AFB7E0FB8A764F95193DA9C9DB260DB30A881C707

Function 000001EFEFB19924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEFB19975

Part of subcall function 000001EFEFB1B714: _getptd_noexit.LIBCMT ref: 000001EFEFB1B718

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEFB19980

Strings

B, xrefs: 000001EFEFB199AC

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction ID: eb5dc3eca78e97f2576a27355f27e9b08970e09053b7e1a26a7203f6145ff8ba
Opcode Fuzzy Hash: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction Fuzzy Hash: 32110431618B8D8FD744EF1CD4857A9B3D1FB98328F1043AEA819C32A1DB34D981CB82

Function 000001EFEF9712F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__crtCapturePreviousContext.LIBCMT ref: 000001EFEF9717B5
__raise_securityfailure.LIBCMT ref: 000001EFEF971857

Strings

sv-FI, xrefs: 000001EFEF971850

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: CaptureContextPrevious__crt__raise_securityfailure
String ID: sv-FI
API String ID: 37250909-2947700294
Opcode ID: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction ID: 6ff646baf85d772e4ecb74f49ad0d18fb383bff472951b0654d63164f61e9727
Opcode Fuzzy Hash: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction Fuzzy Hash: AD21C476216B8482EA509B18EC5139E67A6F384384FA7013ADECD567B5FF38E4968300

Function 000001EFEF968D24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001EFEF968D75

Part of subcall function 000001EFEF96AB14: _getptd_noexit.LIBCMT ref: 000001EFEF96AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001EFEF968D80

Strings

B, xrefs: 000001EFEF968DAC

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction ID: 850f22a3b87cbbec30c7917a3815a9931976fe76d81eb6506c6abbab7d44babf
Opcode Fuzzy Hash: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction Fuzzy Hash: 5D11827361068086EB109F52D84079DB662FB98FD4F564324AF98077A5EF38D286CB00

Function 000001EFEF9310C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMON

Download Yara Rule

APIs

calloc.LIBCMT ref: 000001EFEF93116A

Part of subcall function 000001EFEF978358: _calloc_impl.LIBCMT ref: 000001EFEF978368
Part of subcall function 000001EFEF978358: _errno.LIBCMT ref: 000001EFEF97837B
Part of subcall function 000001EFEF978358: _errno.LIBCMT ref: 000001EFEF978385

free.LIBCMT ref: 000001EFEF9312F3
free.LIBCMT ref: 000001EFEF9312FD
free.LIBCMT ref: 000001EFEF93130F

Memory Dump Source

Source File: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction ID: abff4a8dd65d7522dc5673c75c45b4e7c999ff6b2333088bb52d203c6c22a83b
Opcode Fuzzy Hash: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction Fuzzy Hash: 34C1E933605B848BE764CF55E88079E77A5F788B84F11412AEE8D47B68EB38D495CB00

Function 000001EFEF94AD40 Relevance: 5.2, APIs: 4, Instructions: 234COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEF94ADAA

Part of subcall function 000001EFEF968868: _FF_MSGBANNER.LIBCMT ref: 000001EFEF968898
Part of subcall function 000001EFEF968868: _NMSG_WRITE.LIBCMT ref: 000001EFEF9688A2
Part of subcall function 000001EFEF968868: _callnewh.LIBCMT ref: 000001EFEF9688D6
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688E1
Part of subcall function 000001EFEF968868: _errno.LIBCMT ref: 000001EFEF9688EC

free.LIBCMT ref: 000001EFEF94B1E3

Memory Dump Source

Source File: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction ID: a5a585e57fa0eebceb729b91d56b8bb0b35db8c320a6d05dca08f6a8c8966829
Opcode Fuzzy Hash: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction Fuzzy Hash: FBC1D5762186C08AD7B0CE15E49039FB7A1F799799F41112AEFCA83B68DB39D481CF05

Function 000001EFEFAEFBEC Relevance: 5.2, APIs: 4, Instructions: 221COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001EFEFAEFCA9
_snprintf.LIBCMT ref: 000001EFEFAEFCC9
_snprintf.LIBCMT ref: 000001EFEFAEFD9A

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction ID: 6075c2b9620be62b660eb58fac2e3e42fcd3708b05f24780d92d91ebd21f9a73
Opcode Fuzzy Hash: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction Fuzzy Hash: FD914331118B888FE764EF18D854B9FB7E1FBD9341F40092DD88AD32A1DB74A985CB42

Function 000001EFEFAE4300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEFAE4363

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction ID: 9285530f560ca1217c474b70f2b7f1eebfc0a7978b8b8ff7780a9815ee8fb086
Opcode Fuzzy Hash: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction Fuzzy Hash: 1F51C63661CA854BEB58AF28D8812AE33D5FB94700F05457DEC4BD7296EA30FCC78681

Function 000001EFEF93EFEC Relevance: 5.1, APIs: 4, Instructions: 144COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001EFEF93F0A9
_snprintf.LIBCMT ref: 000001EFEF93F0C9
_snprintf.LIBCMT ref: 000001EFEF93F19A

Memory Dump Source

Source File: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction ID: 6484798f8a8f2b19313e32959fb7e14b3e38ea4d450ea6e152653e4e60b4c1cb
Opcode Fuzzy Hash: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction Fuzzy Hash: 7381CD36219AC486E7209B55F8503DEB762F785798F51022ADEDD43BA9EF3CD486CB00

Function 000001EFEF933700 Relevance: 5.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEF933763

Memory Dump Source

Source File: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction ID: ae123715673475491310650b84cf851e86fcd6aa3e041d5502222bf947e0a988
Opcode Fuzzy Hash: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction Fuzzy Hash: F141A2337016C087EB58DB26E810AAD67A2F744F84F468438DE9A47B65FF35E886C700

Function 000001EFEFB17594 Relevance: 5.1, APIs: 4, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001EFEFB1761F
_snprintf.LIBCMT ref: 000001EFEFB17644
_snprintf.LIBCMT ref: 000001EFEFB176A4
_snprintf.LIBCMT ref: 000001EFEFB176C9

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: 02726748547ca960b1b7dd73ad37504d1df82d1dcee52cfb7025f168ab0f7ff0
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: B0415331518A898FE751EB18D844BDA77E1FB98314FA1053EAC4AC32F1DB34E986C742

Function 000001EFEFB17D04 Relevance: 5.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEFB17D4E
strtok.LIBCMT ref: 000001EFEFB17DAC
strtok.LIBCMT ref: 000001EFEFB17DBE
free.LIBCMT ref: 000001EFEFB17DD7

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction ID: c6048d2187d013b595e50f2322d7d073ceb4907c152a1c0c098e7f3391679838
Opcode Fuzzy Hash: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction Fuzzy Hash: 8A310571918B8D9FE790FB18C444B6977E1F799319F91062EA88AC32B1D734E982C702

Function 000001EFEF966994 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001EFEF966A1F
_snprintf.LIBCMT ref: 000001EFEF966A44
_snprintf.LIBCMT ref: 000001EFEF966AA4
_snprintf.LIBCMT ref: 000001EFEF966AC9

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: 90088dbba0e872cd767d283bc57ab3659cf6a6511cc277b36a22be865f66edf4
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: 4C313D73124AC481EA619B55EC403DE6762F3887A4F52423AAEED47BF4EB3CD582C700

Function 000001EFEF967104 Relevance: 5.0, APIs: 4, Instructions: 50stringCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001EFEF96714E
strtok.LIBCMT ref: 000001EFEF9671AC
strtok.LIBCMT ref: 000001EFEF9671BE
free.LIBCMT ref: 000001EFEF9671D7

Memory Dump Source

Source File: 00000004.00000003.2636693796.000001EFEF94D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001EFEF930000, based on PE: true

Associated: 00000004.00000003.2636672004.000001EFEF930000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2636693796.000001EFEF98C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1efef930000_rundll32.jbxd

Yara matches

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction ID: 0f9d1c16acd85ff2ade5f6ddfc9528978b22f1ff656c0365e4b44387e2dbd4b1
Opcode Fuzzy Hash: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction Fuzzy Hash: A421B932114BC485DA619B15EC5039E6762F3857A4F53522AEEEE467F5EF3CE1828700

Function 000001EFEFB193B8 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000001EFEFB193D8

Part of subcall function 000001EFEFB19428: RtlFreeHeap.NTDLL ref: 000001EFEFB1943E
Part of subcall function 000001EFEFB19428: _errno.LIBCMT ref: 000001EFEFB19448

free.LIBCMT ref: 000001EFEFB193E6
free.LIBCMT ref: 000001EFEFB193F4
free.LIBCMT ref: 000001EFEFB193FE

Memory Dump Source

Source File: 00000004.00000002.2645317984.000001EFEFAE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001EFEFAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1efefae1000_rundll32.jbxd

Similarity

API ID: free$FreeHeap_errno
String ID:
API String ID: 2737118440-0
Opcode ID: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction ID: 5e3cd979328ba58d7afb261798368a2faef81f79bb114376b49c5508f89b7a64
Opcode Fuzzy Hash: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction Fuzzy Hash: 35F0AC3552C989AFD6C8FB18D491E9D77E1FF98304F81146DB849C33B2EA20E851CB02

Analysis Process: rundll32.exePID: 2872, Parent PID: 2268COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	16

Executed Functions

Function 000001BFCABD7CFC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 187
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001BFCABD7F80: malloc.LIBCMT ref: 000001BFCABD7F97

GetUserNameA.ADVAPI32 ref: 000001BFCABD7DAA

Part of subcall function 000001BFCABD00A4: WSASocketA.WS2_32 ref: 000001BFCABD00E0

strrchr.LIBCMT ref: 000001BFCABD7DF2
_snprintf.LIBCMT ref: 000001BFCABD7F0C

Strings

:, xrefs: 000001BFCABD7F4F

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: NameSocketUser_snprintfmallocstrrchr
String ID: :
API String ID: 1789932928-336475711
Opcode ID: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction ID: e36e629b820d9f907046e10724731c4382095022a6eed5a6b53155ed1a73a1a5
Opcode Fuzzy Hash: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction Fuzzy Hash: B671DD70618B488FE394EB18C894F9ABBE1FBC9345F50496DB499C32A5C774E885CB02

Function 000001BFC932D107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001BFC932D166
VirtualProtect.KERNELBASE ref: 000001BFC932D1AF

Strings

DCBA, xrefs: 000001BFC932D141

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: DCBA
API String ID: 544645111-2222620526
Opcode ID: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction ID: 117f1694ef31e4bcf5f49b13adc5e146e0016d42371b7ad50d7be881f8b10f5b
Opcode Fuzzy Hash: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction Fuzzy Hash: AF415932301B888EDB51CF69D8807DC3BA5F788BACF118225EA1C87B99DB34D995C340

Function 000001BFCABDD0FC Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 000001BFCABDD1A3
0, xrefs: 000001BFCABDD1AB

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID:
String ID: ($0
API String ID: 0-506339136
Opcode ID: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction ID: 00b4aa056d7b022e755cb012b382af4f1bbda1f7f15d20207c60102b2eb3d31a
Opcode Fuzzy Hash: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction Fuzzy Hash: 95416A305197498FE7ACDB28C454BAABBE1FB98305F50493DE0D9C31A5DB74D889CB02

Function 000001BFCABD00A4 Relevance: 4.6, APIs: 3, Instructions: 93
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32 ref: 000001BFCABD00E0
WSAIoctl.WS2_32 ref: 000001BFCABD013B
closesocket.WS2_32 ref: 000001BFCABD01CA

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: IoctlSocketclosesocket
String ID:
API String ID: 3445158922-0
Opcode ID: 2b1563ebb8b5cee2362f50e6a9862c7e044125dd490747691ac161b43e72dde1
Instruction ID: f960d7ac58c09de9911e414829b4a1f8d38c6e8b7536d5bb2ea48b3c5ac45230
Opcode Fuzzy Hash: 2b1563ebb8b5cee2362f50e6a9862c7e044125dd490747691ac161b43e72dde1
Instruction Fuzzy Hash: E1311D745187888FE358DF68C844B9AFBE4FB88344F50493DF49AC2294D7B8D4859B02

Non-executed Functions

Function 000001BFC934F9E4 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001BFC934FA3A
_errno.LIBCMT ref: 000001BFC934FA41
_invalid_parameter_noinfo.LIBCMT ref: 000001BFC934FA4C

Strings

U, xrefs: 000001BFC934FFAE

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction ID: 39f8438392468e8025deed0fbe3bc3d3fd897f484454e329d52360efc824d4b1
Opcode Fuzzy Hash: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction Fuzzy Hash: 0312083260468986EB228F24DC44BEE7FA9F7C9744F55813ADA4983794DB3DC4E6CB10

Function 000001BFC934B3CC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BFC934B42D

Part of subcall function 000001BFC934B324: _getptd.LIBCMT ref: 000001BFC934B33A
Part of subcall function 000001BFC934B324: __updatetlocinfo.LIBCMT ref: 000001BFC934B36F
Part of subcall function 000001BFC934B324: __updatetmbcinfo.LIBCMT ref: 000001BFC934B396

_fileno.LIBCMT ref: 000001BFC934B45F

Part of subcall function 000001BFC934EA24: _errno.LIBCMT ref: 000001BFC934EA2D
Part of subcall function 000001BFC934EA24: _invalid_parameter_noinfo.LIBCMT ref: 000001BFC934EA38

write_multi_char.LIBCMT ref: 000001BFC934BA8F
write_string.LIBCMT ref: 000001BFC934BAAC
_errno.LIBCMT ref: 000001BFC934B432

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

_errno.LIBCMT ref: 000001BFC934BD97
_invalid_parameter_noinfo.LIBCMT ref: 000001BFC934BDA2

Strings

@, xrefs: 000001BFC934B44B
-, xrefs: 000001BFC934BA40

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$@
API String ID: 3246410048-1222683799
Opcode ID: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction ID: 42cd8bf538b8edf87bf3606aad7638bcd01ff2a3b0961fca41200dc7ac37aa1a
Opcode Fuzzy Hash: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction Fuzzy Hash: 78B1F93260468885FB66CB559C40BEE7FB9F7C5790F15903DEE49876D8CB34C5A28B40

Function 000001BFCABF9B1C Relevance: 16.6, APIs: 11, Instructions: 127
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__crtCorExitProcess.LIBCMT ref: 000001BFCABF9B24
free.LIBCMT ref: 000001BFCABF9B62

Part of subcall function 000001BFCABF9428: RtlFreeHeap.NTDLL ref: 000001BFCABF943E
Part of subcall function 000001BFCABF9428: _errno.LIBCMT ref: 000001BFCABF9448

free.LIBCMT ref: 000001BFCABF9B77
free.LIBCMT ref: 000001BFCABF9B98
free.LIBCMT ref: 000001BFCABF9BAD
free.LIBCMT ref: 000001BFCABF9BC1
free.LIBCMT ref: 000001BFCABF9BCD
free.LIBCMT ref: 000001BFCABF9BF8
free.LIBCMT ref: 000001BFCABF9C19
free.LIBCMT ref: 000001BFCABF9C32
free.LIBCMT ref: 000001BFCABF9C63

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: free$ExitFreeHeapProcess__crt_errno
String ID:
API String ID: 150120455-0
Opcode ID: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction ID: 78e3e543ad713220664d2078124972144564ed5a8632a64cf365738b0c9bb32b
Opcode Fuzzy Hash: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction Fuzzy Hash: 70411E34218A0D8BFBA8EBA8DCD5FE936D1F758311F58443C9005C2696DB2CA88ACB50

Function 000001BFCAC00EEC Relevance: 16.6, APIs: 11, Instructions: 108
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001BFCAC00F1E

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

__doserrno.LIBCMT ref: 000001BFCAC00F15

Part of subcall function 000001BFCABFB6A4: _getptd_noexit.LIBCMT ref: 000001BFCABFB6A8

__doserrno.LIBCMT ref: 000001BFCAC00F7B
_errno.LIBCMT ref: 000001BFCAC00F82
_invalid_parameter_noinfo.LIBCMT ref: 000001BFCAC00FE6

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction ID: 01b4f52ffc162dd3225ff6e33965b198415e207cee27c3bbb65c4908d1049f6e
Opcode Fuzzy Hash: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction Fuzzy Hash: 3031E47421874C4EE715EF798C82BE97A90EB45320F16027DE412872EBD770F89B8751

Function 000001BFC9348F1C Relevance: 16.6, APIs: 11, Instructions: 82COMMON

Download Yara Rule

APIs

__crtCorExitProcess.LIBCMT ref: 000001BFC9348F24
free.LIBCMT ref: 000001BFC9348F62

Part of subcall function 000001BFC9348828: _errno.LIBCMT ref: 000001BFC9348848

free.LIBCMT ref: 000001BFC9348F77
free.LIBCMT ref: 000001BFC9348F98
free.LIBCMT ref: 000001BFC9348FAD
free.LIBCMT ref: 000001BFC9348FC1
free.LIBCMT ref: 000001BFC9348FCD
free.LIBCMT ref: 000001BFC9348FF8
free.LIBCMT ref: 000001BFC9349019
free.LIBCMT ref: 000001BFC9349032
free.LIBCMT ref: 000001BFC9349063

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: free$ExitProcess__crt_errno
String ID:
API String ID: 1362684943-0
Opcode ID: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction ID: 7ca06d0dd11edbd9c4acc7a85d15a04dafd40e0c7050570545602b5afa6c7744
Opcode Fuzzy Hash: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction Fuzzy Hash: 2141EB35611A0C81FF579B11ED54BE83EA9EBC8B61F0AC57D9D1986291CF3888F78211

Function 000001BFC93502EC Relevance: 16.6, APIs: 11, Instructions: 81COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFC935031E

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

__doserrno.LIBCMT ref: 000001BFC9350315

Part of subcall function 000001BFC934AAA4: _getptd_noexit.LIBCMT ref: 000001BFC934AAA8

__doserrno.LIBCMT ref: 000001BFC935037B
_errno.LIBCMT ref: 000001BFC9350382
_invalid_parameter_noinfo.LIBCMT ref: 000001BFC93503E6

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction ID: 0cd3fea20f28e0a03e70681b659407c09785f96ce2f44d24aff0b74a23888bf6
Opcode Fuzzy Hash: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction Fuzzy Hash: AC31B33161028887E7075F659D81B9D3E99ABC4790F46C13CA916AB7D2C77CC4E2C710

Function 000001BFCAC01CD8 Relevance: 15.1, APIs: 10, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001BFCAC01D03

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

__doserrno.LIBCMT ref: 000001BFCAC01CFB

Part of subcall function 000001BFCABFB6A4: _getptd_noexit.LIBCMT ref: 000001BFCABFB6A8

__lock_fhandle.LIBCMT ref: 000001BFCAC01D47
_lseeki64_nolock.LIBCMT ref: 000001BFCAC01D60
_unlock_fhandle.LIBCMT ref: 000001BFCAC01D83

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction ID: 2d9b326dfa71cb435d0c01abb3e130fc7eff1606dda093ba100b0c2915600412
Opcode Fuzzy Hash: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction Fuzzy Hash: FF2129346187084EF719FB6C9C42BF9BAD0EB45320F19026DE0168B1EBC764A8978762

Function 000001BFCAC01B60 Relevance: 15.1, APIs: 10, Instructions: 88
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001BFCAC01B8B

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

__doserrno.LIBCMT ref: 000001BFCAC01B83

Part of subcall function 000001BFCABFB6A4: _getptd_noexit.LIBCMT ref: 000001BFCABFB6A8

__lock_fhandle.LIBCMT ref: 000001BFCAC01BCF
_lseek_nolock.LIBCMT ref: 000001BFCAC01BE8
_unlock_fhandle.LIBCMT ref: 000001BFCAC01C09

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction ID: 0ee8150747c2acfaa3cb5e600dfb49b881f7b89fcb3bde2edfbb39db2ef1ceb6
Opcode Fuzzy Hash: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction Fuzzy Hash: 942127356082084EF319AB6CDC42BF9BA90DB42320F1A022CE157871EBD764F8D78362

Function 000001BFC9350F60 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFC9350F8B

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

__doserrno.LIBCMT ref: 000001BFC9350F83

Part of subcall function 000001BFC934AAA4: _getptd_noexit.LIBCMT ref: 000001BFC934AAA8

__lock_fhandle.LIBCMT ref: 000001BFC9350FCF
_lseek_nolock.LIBCMT ref: 000001BFC9350FE8
_unlock_fhandle.LIBCMT ref: 000001BFC9351009

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction ID: eab4706480842c32a18ae677e95b8bf0cb3826aa8d46de5a01709b91cb98ee0f
Opcode Fuzzy Hash: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction Fuzzy Hash: 6821D032A0418846F6076F559C41BED7E99A7C47A0F1A812CAA164B6D2CB7CC8E38321

Function 000001BFC93510D8 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFC9351103

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

__doserrno.LIBCMT ref: 000001BFC93510FB

Part of subcall function 000001BFC934AAA4: _getptd_noexit.LIBCMT ref: 000001BFC934AAA8

__lock_fhandle.LIBCMT ref: 000001BFC9351147
_lseeki64_nolock.LIBCMT ref: 000001BFC9351160
_unlock_fhandle.LIBCMT ref: 000001BFC9351183

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction ID: bee62677eb2442a88eb0e4fd2fd1395e663f4987f3f658d5a8dbe9a1b369c062
Opcode Fuzzy Hash: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction Fuzzy Hash: 6C219232A1024855FA075F559C01BED7E59A7C4BF0F19C22CAA358B7D2C77CC5E28611

Function 000001BFCAC09EA0 Relevance: 13.7, APIs: 9, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001BFCAC09EC6
_errno.LIBCMT ref: 000001BFCAC09EBB

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: 181d52bcb5af38a644f949309eae4e32f5a35df007ff24cdcce28bd57c8089db
Instruction ID: 49c0c7625566fe1e9f980fd56f5d32d78b6c22a968d912b2f49aa5d7c1db5cac
Opcode Fuzzy Hash: 181d52bcb5af38a644f949309eae4e32f5a35df007ff24cdcce28bd57c8089db
Instruction Fuzzy Hash: C1512530118A1E4EEB64EB688C41BF57AD0EB54321F58027EE066C71EFD724E8DB8742

Function 000001BFC93592A0 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001BFC93592C6
_errno.LIBCMT ref: 000001BFC93592BB

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction ID: d0978e1fd277af022bbdbbb75e468e95f6b15d0b62c8c09aefdc9ec7c87710a1
Opcode Fuzzy Hash: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction Fuzzy Hash: 4C41F3B1A00398C1FB629B118D40BED3FE9E7D8B90FD5C139EA94876C5D72888E38600

Function 000001BFCAC00504 Relevance: 13.6, APIs: 9, Instructions: 89
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001BFCAC0052F

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

__doserrno.LIBCMT ref: 000001BFCAC00527

Part of subcall function 000001BFCABFB6A4: _getptd_noexit.LIBCMT ref: 000001BFCABFB6A8

__lock_fhandle.LIBCMT ref: 000001BFCAC00573
_unlock_fhandle.LIBCMT ref: 000001BFCAC005AD

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction ID: 51349db3e554797e88ba2c513ba218c63c7187bce2a2bdfe6b433d06a930ecd8
Opcode Fuzzy Hash: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction Fuzzy Hash: 332129306086080EFB14EB689C46BF97A90DB45320F1A026DE015C71EBD764B89786A9

Function 000001BFCABFF828 Relevance: 13.6, APIs: 9, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001BFCABFF849

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

__doserrno.LIBCMT ref: 000001BFCABFF841

Part of subcall function 000001BFCABFB6A4: _getptd_noexit.LIBCMT ref: 000001BFCABFB6A8

__lock_fhandle.LIBCMT ref: 000001BFCABFF88D
_close_nolock.LIBCMT ref: 000001BFCABFF8A0
_unlock_fhandle.LIBCMT ref: 000001BFCABFF8B9

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction ID: 1f012646ff6b946309cd3386185046cf1e62e9b87396808d9440003e274b80c8
Opcode Fuzzy Hash: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction Fuzzy Hash: E121E73A505A488EF715AF758C85BE87E90EF41320F1D057DE016872EBD774A88A8761

Function 000001BFC934F904 Relevance: 13.6, APIs: 9, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFC934F92F

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

__doserrno.LIBCMT ref: 000001BFC934F927

Part of subcall function 000001BFC934AAA4: _getptd_noexit.LIBCMT ref: 000001BFC934AAA8

__lock_fhandle.LIBCMT ref: 000001BFC934F973
_unlock_fhandle.LIBCMT ref: 000001BFC934F9AD

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction ID: ba7e63d4f5b844c49091fbc8105cd881781b89cfaf891d1b4aabe5e277d3cbb4
Opcode Fuzzy Hash: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction Fuzzy Hash: 5821953260018856FA076F159D41BED7D9AA7C07A1F1BC13DAA158B7D2CB7884F3C721

Function 000001BFC934EC28 Relevance: 13.6, APIs: 9, Instructions: 57COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFC934EC49

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

__doserrno.LIBCMT ref: 000001BFC934EC41

Part of subcall function 000001BFC934AAA4: _getptd_noexit.LIBCMT ref: 000001BFC934AAA8

__lock_fhandle.LIBCMT ref: 000001BFC934EC8D
_close_nolock.LIBCMT ref: 000001BFC934ECA0
_unlock_fhandle.LIBCMT ref: 000001BFC934ECB9

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction ID: 1d7b1bd236b2541180a3fcd76d5e9f83addc8e44cbf8c8c99913110a8c0df2b7
Opcode Fuzzy Hash: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction Fuzzy Hash: B611AF3264068845F6276F259D41BDC7E99A7C07A1F1BC63CE916877D2C77888E28314

Function 000001BFCABC460C Relevance: 11.6, APIs: 9, Instructions: 305COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFCABC46A9

Part of subcall function 000001BFCABF9468: _FF_MSGBANNER.LIBCMT ref: 000001BFCABF9498
Part of subcall function 000001BFCABF9468: _NMSG_WRITE.LIBCMT ref: 000001BFCABF94A2
Part of subcall function 000001BFCABF9468: _callnewh.LIBCMT ref: 000001BFCABF94D6
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94E1
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94EC

malloc.LIBCMT ref: 000001BFCABC46B3

Part of subcall function 000001BFCABF9468: _callnewh.LIBCMT ref: 000001BFCABF94FC
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF9501

malloc.LIBCMT ref: 000001BFCABC46BE
free.LIBCMT ref: 000001BFCABC487E
free.LIBCMT ref: 000001BFCABC4886
free.LIBCMT ref: 000001BFCABC488E

Part of subcall function 000001BFCABC54F0: malloc.LIBCMT ref: 000001BFCABC553A
Part of subcall function 000001BFCABC54F0: malloc.LIBCMT ref: 000001BFCABC5545
Part of subcall function 000001BFCABC54F0: free.LIBCMT ref: 000001BFCABC562C
Part of subcall function 000001BFCABC54F0: free.LIBCMT ref: 000001BFCABC5634

free.LIBCMT ref: 000001BFCABC489A
free.LIBCMT ref: 000001BFCABC48A7
free.LIBCMT ref: 000001BFCABC48B4

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction ID: 5469b6a7c89c9fc59ab575378e539915d3f6ef82924ccb1d2d706371b92ad32a
Opcode Fuzzy Hash: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction Fuzzy Hash: 9A91C930318B4C4BD769AA6C9C55FF9BBD1E795704F54023ED48AC328BDF20E94B8682

Function 000001BFC9313A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFC9313AA9

Part of subcall function 000001BFC9348868: _FF_MSGBANNER.LIBCMT ref: 000001BFC9348898
Part of subcall function 000001BFC9348868: _NMSG_WRITE.LIBCMT ref: 000001BFC93488A2
Part of subcall function 000001BFC9348868: _callnewh.LIBCMT ref: 000001BFC93488D6
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488E1
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488EC

malloc.LIBCMT ref: 000001BFC9313AB3

Part of subcall function 000001BFC9348868: _callnewh.LIBCMT ref: 000001BFC93488FC
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC9348901

malloc.LIBCMT ref: 000001BFC9313ABE
free.LIBCMT ref: 000001BFC9313C7E
free.LIBCMT ref: 000001BFC9313C86
free.LIBCMT ref: 000001BFC9313C8E

Part of subcall function 000001BFC93148F0: malloc.LIBCMT ref: 000001BFC931493A
Part of subcall function 000001BFC93148F0: malloc.LIBCMT ref: 000001BFC9314945
Part of subcall function 000001BFC93148F0: free.LIBCMT ref: 000001BFC9314A2C
Part of subcall function 000001BFC93148F0: free.LIBCMT ref: 000001BFC9314A34

free.LIBCMT ref: 000001BFC9313C9A
free.LIBCMT ref: 000001BFC9313CA7
free.LIBCMT ref: 000001BFC9313CB4

Memory Dump Source

Source File: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction ID: efb82d9ad5be3c05b5c933612e35ac74ac209b99952d12d6235288ec0b8cbe95
Opcode Fuzzy Hash: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction Fuzzy Hash: C171C53630478D46EA169A269C40FEE7E99F7C5BC8F41C03D9D464BB95DB38C8A78700

Function 000001BFC9346C8C Relevance: 10.6, APIs: 7, Instructions: 145stringCOMMON

Download Yara Rule

APIs

_time64.LIBCMT ref: 000001BFC9346CA8
malloc.LIBCMT ref: 000001BFC9346CF3
strtok.LIBCMT ref: 000001BFC9346D5B
strtok.LIBCMT ref: 000001BFC9346D9B
_time64.LIBCMT ref: 000001BFC9346DB3
_time64.LIBCMT ref: 000001BFC9346E6B
_time64.LIBCMT ref: 000001BFC9346F2A

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _time64$strtok$malloc
String ID:
API String ID: 2141844861-0
Opcode ID: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction ID: 777b10252ad7db80c6b7d3f5f37d50cdb19da02c2ca522784be7823138edcad3
Opcode Fuzzy Hash: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction Fuzzy Hash: 5D910431205A4C8AE7628F05EE88B957FE9F3C5758F11823DD59A867A4DB3DD0E6CB00

Function 000001BFC934B198 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001BFC934B1B5

Part of subcall function 000001BFC934EA24: _errno.LIBCMT ref: 000001BFC934EA2D
Part of subcall function 000001BFC934EA24: _invalid_parameter_noinfo.LIBCMT ref: 000001BFC934EA38

_errno.LIBCMT ref: 000001BFC934B1C5

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

_errno.LIBCMT ref: 000001BFC934B1E1
_isatty.LIBCMT ref: 000001BFC934B242
_getbuf.LIBCMT ref: 000001BFC934B24E

Strings

, xrefs: 000001BFC934B1D0

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-3916222277
Opcode ID: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction ID: d3dfe63c2ca799d9b075d81fb9b494c252e927e1c4443deb2ae62a1aabe1909a
Opcode Fuzzy Hash: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction Fuzzy Hash: 2541C472600B4C46EB5A9F24DC51BAD3EB8E7C4B94F158129EA66873C5DB34C8E2C740

Function 000001BFCAC09D20 Relevance: 10.6, APIs: 7, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BFCAC09D54

Part of subcall function 000001BFCABFBF24: _getptd.LIBCMT ref: 000001BFCABFBF3A
Part of subcall function 000001BFCABFBF24: __updatetlocinfo.LIBCMT ref: 000001BFCABFBF6F
Part of subcall function 000001BFCABFBF24: __updatetmbcinfo.LIBCMT ref: 000001BFCABFBF96

_errno.LIBCMT ref: 000001BFCAC09D6F
_invalid_parameter_noinfo.LIBCMT ref: 000001BFCAC09D7A

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 9aa24401b2afff689c0b0903031154c7b35a263849ab08805c315ffe4c7e00e0
Instruction ID: 793144328abcf2cea6f4f0a0be8757d0c54f23c677b872f67ec1d059715e7d74
Opcode Fuzzy Hash: 9aa24401b2afff689c0b0903031154c7b35a263849ab08805c315ffe4c7e00e0
Instruction Fuzzy Hash: 4D315C30608B0C4FD764DF589885BA97AD0EB58310F5502ADA459CB2ABDB70EC9A8785

Function 000001BFCABF99D8 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFCABF99FE

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

_invalid_parameter_noinfo.LIBCMT ref: 000001BFCABF9A0A
__crtIsPackagedApp.LIBCMT ref: 000001BFCABF9A1B
_dosmaperr.LIBCMT ref: 000001BFCABF9A65

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction ID: fddc46ebf3f6d12ec88aef98718f93ac25b1ff042ffb61f3096bb6d057d0a451
Opcode Fuzzy Hash: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction Fuzzy Hash: 7E31D634614A0D8FFB54AFB99C05BA97AD1FF88315F18417EE40AC32D6DB38D8868742

Function 000001BFC9348DD8 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFC9348DFE

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001BFC9348E0A
__crtIsPackagedApp.LIBCMT ref: 000001BFC9348E1B
_dosmaperr.LIBCMT ref: 000001BFC9348E65

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction ID: ff591d18d08e0e763bc3555ae5979bf044b71cf1b93b41c391864f52ae01e660
Opcode Fuzzy Hash: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction Fuzzy Hash: CF317E71700B4886FB22AF25DC047A97EE9ABC8B94F0585389E45877E5DF38C4E28704

Function 000001BFC9359120 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BFC9359154

Part of subcall function 000001BFC934B324: _getptd.LIBCMT ref: 000001BFC934B33A
Part of subcall function 000001BFC934B324: __updatetlocinfo.LIBCMT ref: 000001BFC934B36F
Part of subcall function 000001BFC934B324: __updatetmbcinfo.LIBCMT ref: 000001BFC934B396

_errno.LIBCMT ref: 000001BFC935916F
_invalid_parameter_noinfo.LIBCMT ref: 000001BFC935917A

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction ID: 4f9ea076040effa9bdee9a377f357b16bbe591ef7cbf7f2fe99ee6b3e4306e0d
Opcode Fuzzy Hash: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction Fuzzy Hash: 7E316472A0479885E7129F11D884BDD7EA8F7C8BE0F99C139EE5487B85CB74C9A2C710

Function 000001BFCABFA6D0 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFCABFA70C

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

_invalid_parameter_noinfo.LIBCMT ref: 000001BFCABFA717
memcpy_s.LIBCMT ref: 000001BFCABFA7DC
_fileno.LIBCMT ref: 000001BFCABFA847
_filbuf.LIBCMT ref: 000001BFCABFA875
_errno.LIBCMT ref: 000001BFCABFA8C5

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction ID: 94dd82bf921cd4ce8179fd7b8913f87bdd15803f2b5582c18aef20b90a6db83c
Opcode Fuzzy Hash: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction Fuzzy Hash: 23619238218F0D4AE66C5A3C5C45AB57ED1E795760F18033ED456C32DADB60FC9B86C1

Function 000001BFCABD2854 Relevance: 9.2, APIs: 6, Instructions: 202COMMON

Download Yara Rule

APIs

Part of subcall function 000001BFCABD7F80: malloc.LIBCMT ref: 000001BFCABD7F97

Part of subcall function 000001BFCABFA1E8: _errno.LIBCMT ref: 000001BFCABFA13F
Part of subcall function 000001BFCABFA1E8: _invalid_parameter_noinfo.LIBCMT ref: 000001BFCABFA14A

fseek.LIBCMT ref: 000001BFCABD2929
_ftelli64.LIBCMT ref: 000001BFCABD2933
fseek.LIBCMT ref: 000001BFCABD2947
fclose.LIBCMT ref: 000001BFCABD297E
fclose.LIBCMT ref: 000001BFCABD29D3
malloc.LIBCMT ref: 000001BFCABD29E2

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction ID: 8b59d886deee5517513ba5aed8a5f296db2552c5924caaf590c1719786688499
Opcode Fuzzy Hash: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction Fuzzy Hash: 9471183451878C8FD348EB18C855F9ABBE1FB98355F50453DB099C32A5CB34E98ACB42

Function 000001BFC9349AD0 Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFC9349B0C

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001BFC9349B17
memcpy_s.LIBCMT ref: 000001BFC9349BDC
_fileno.LIBCMT ref: 000001BFC9349C47
_filbuf.LIBCMT ref: 000001BFC9349C75
_errno.LIBCMT ref: 000001BFC9349CC5

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction ID: 6e9281e4794ee73e505a383999f820cfa2606c5ecdb83cefcc1de9295f45e6fa
Opcode Fuzzy Hash: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction Fuzzy Hash: 8651D53174424842FA668A665D00BE97ED9A3C4FF4F16C738AE2987BD4CB34C8F38644

Function 000001BFC9321C54 Relevance: 9.1, APIs: 6, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 000001BFC9327380: malloc.LIBCMT ref: 000001BFC9327397

Part of subcall function 000001BFC93495E8: _errno.LIBCMT ref: 000001BFC934953F
Part of subcall function 000001BFC93495E8: _invalid_parameter_noinfo.LIBCMT ref: 000001BFC934954A

fseek.LIBCMT ref: 000001BFC9321D29
_ftelli64.LIBCMT ref: 000001BFC9321D33
fseek.LIBCMT ref: 000001BFC9321D47
fclose.LIBCMT ref: 000001BFC9321D7E
fclose.LIBCMT ref: 000001BFC9321DD3
malloc.LIBCMT ref: 000001BFC9321DE2

Memory Dump Source

Source File: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction ID: 17492a2eafde11a7f47a3d24ff8a94082c532c8b3fc699b4d5cb47a781ee409e
Opcode Fuzzy Hash: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction Fuzzy Hash: 13614632218A8882E761DB15E85079FBB65F7C5790F108139F68E47BAACF38C596CF40

Function 000001BFCABFA1E8 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFCABFA13F

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

_invalid_parameter_noinfo.LIBCMT ref: 000001BFCABFA14A
_getstream.LIBCMT ref: 000001BFCABFA16A
_errno.LIBCMT ref: 000001BFCABFA17C
_errno.LIBCMT ref: 000001BFCABFA18E
_openfile.LIBCMT ref: 000001BFCABFA1BC

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction ID: 71a4c595a96e2ff1c72fa3cd3af3478b90d2be59cef4ebf51e5bcb7e475dba81
Opcode Fuzzy Hash: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction Fuzzy Hash: FB21D838618B4E4FFB94EB3C4C05BA97AD1EB49300F09057D9445C329AEF24EDC69351

Function 000001BFCABD1080 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFCABD1097

Part of subcall function 000001BFCABF9468: _FF_MSGBANNER.LIBCMT ref: 000001BFCABF9498
Part of subcall function 000001BFCABF9468: _NMSG_WRITE.LIBCMT ref: 000001BFCABF94A2
Part of subcall function 000001BFCABF9468: _callnewh.LIBCMT ref: 000001BFCABF94D6
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94E1
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94EC

free.LIBCMT ref: 000001BFCABD10E0

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction ID: 90e3f228d78c475123a2f3fcdb4432a50bc276bb917b21c6ade95c51ff08f70a
Opcode Fuzzy Hash: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction Fuzzy Hash: 3031F434518A4C9FD64CEB28CC55F9A7BD1FB98305F50053DB099D32A9DB34A58AC742

Function 000001BFC93495E8 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFC934953F

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001BFC934954A
_getstream.LIBCMT ref: 000001BFC934956A
_errno.LIBCMT ref: 000001BFC934957C
_errno.LIBCMT ref: 000001BFC934958E
_openfile.LIBCMT ref: 000001BFC93495BC

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction ID: e0f4a576dca989680e66bdd867c49017fb84d17f5fb3e91aee71de76cccf9bce
Opcode Fuzzy Hash: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction Fuzzy Hash: 4321A87131478945FB639B215C01B9EBE99A7C4BC0F16C478AD89D7785DB3CC4B28714

Function 000001BFC9320480 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFC9320497

Part of subcall function 000001BFC9348868: _FF_MSGBANNER.LIBCMT ref: 000001BFC9348898
Part of subcall function 000001BFC9348868: _NMSG_WRITE.LIBCMT ref: 000001BFC93488A2
Part of subcall function 000001BFC9348868: _callnewh.LIBCMT ref: 000001BFC93488D6
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488E1
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488EC

free.LIBCMT ref: 000001BFC93204E0

Memory Dump Source

Source File: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction ID: c40eb04c6a66642ac89b96fc1c5d49b18c6aee04b308e2ac45dbf63f08da9018
Opcode Fuzzy Hash: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction Fuzzy Hash: B0212432518A4881DA21EB11E8517DE7F64F7C4794F108239BADE43AEADF3CC5E68B40

Function 000001BFC934CE24 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000001BFC934CE41

Part of subcall function 000001BFC934ABEC: _set_error_mode.LIBCMT ref: 000001BFC934ABF5
Part of subcall function 000001BFC934ABEC: _set_error_mode.LIBCMT ref: 000001BFC934AC04
Part of subcall function 000001BFC934ABEC: _NMSG_WRITE.LIBCMT ref: 000001BFC934AC1B
Part of subcall function 000001BFC934ABEC: _NMSG_WRITE.LIBCMT ref: 000001BFC934AC25

_NMSG_WRITE.LIBCMT ref: 000001BFC934CE4B

Part of subcall function 000001BFC934AC60: _set_error_mode.LIBCMT ref: 000001BFC934ACA5
Part of subcall function 000001BFC934AC60: _set_error_mode.LIBCMT ref: 000001BFC934ACB6
Part of subcall function 000001BFC934AC60: __crtMessageBoxW.LIBCMT ref: 000001BFC934ADC9

Part of subcall function 000001BFC9348F1C: __crtCorExitProcess.LIBCMT ref: 000001BFC9348F24
Part of subcall function 000001BFC9348F1C: free.LIBCMT ref: 000001BFC9348F62
Part of subcall function 000001BFC9348F1C: free.LIBCMT ref: 000001BFC9348F77
Part of subcall function 000001BFC9348F1C: free.LIBCMT ref: 000001BFC9348F98
Part of subcall function 000001BFC9348F1C: free.LIBCMT ref: 000001BFC9348FAD
Part of subcall function 000001BFC9348F1C: free.LIBCMT ref: 000001BFC9348FC1
Part of subcall function 000001BFC9348F1C: free.LIBCMT ref: 000001BFC9348FCD
Part of subcall function 000001BFC9348F1C: free.LIBCMT ref: 000001BFC9348FF8
Part of subcall function 000001BFC9348F1C: free.LIBCMT ref: 000001BFC9349019
Part of subcall function 000001BFC9348F1C: free.LIBCMT ref: 000001BFC9349032
Part of subcall function 000001BFC9348F1C: free.LIBCMT ref: 000001BFC9349063

_malloc_crt.LIBCMT ref: 000001BFC934CE77

Part of subcall function 000001BFC934D778: malloc.LIBCMT ref: 000001BFC934D7A3

_errno.LIBCMT ref: 000001BFC934CE84
_lock.LIBCMT ref: 000001BFC934CE98
free.LIBCMT ref: 000001BFC934CEB9

Part of subcall function 000001BFC9348828: _errno.LIBCMT ref: 000001BFC9348848

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_set_error_mode$__crt_errno$ExitMessageProcess_lock_malloc_crtmalloc
String ID:
API String ID: 2751257304-0
Opcode ID: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction ID: 50efcc83a36c67d241c89f3c7c22b50f38370130a89368e80bfdb5a6eaca8e00
Opcode Fuzzy Hash: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction Fuzzy Hash: AB114C3221168C81F6669B60EC44BE93EA9E7C4781F46943CE546C66E2DF7888F29311

Function 000001BFCABC4170 Relevance: 8.9, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFCABC41BD

Part of subcall function 000001BFCABF9468: _FF_MSGBANNER.LIBCMT ref: 000001BFCABF9498
Part of subcall function 000001BFCABF9468: _NMSG_WRITE.LIBCMT ref: 000001BFCABF94A2
Part of subcall function 000001BFCABF9468: _callnewh.LIBCMT ref: 000001BFCABF94D6
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94E1
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94EC

malloc.LIBCMT ref: 000001BFCABC41C8

Part of subcall function 000001BFCABF9468: _callnewh.LIBCMT ref: 000001BFCABF94FC
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF9501

free.LIBCMT ref: 000001BFCABC42AF
free.LIBCMT ref: 000001BFCABC42B7
free.LIBCMT ref: 000001BFCABC42BF
free.LIBCMT ref: 000001BFCABC42CB
free.LIBCMT ref: 000001BFCABC42D8

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction ID: 7ac7a25d58d83fb975e8b31d05800e39f330680ea4e5790ac3546a537e77c6b6
Opcode Fuzzy Hash: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction Fuzzy Hash: 8051C634728E0D4BE7599B689C56EF9BBD1FB59304F50013DD84AC728BEB10E98B86C1

Function 000001BFC9313570 Relevance: 8.9, APIs: 7, Instructions: 115COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFC93135BD

Part of subcall function 000001BFC9348868: _FF_MSGBANNER.LIBCMT ref: 000001BFC9348898
Part of subcall function 000001BFC9348868: _NMSG_WRITE.LIBCMT ref: 000001BFC93488A2
Part of subcall function 000001BFC9348868: _callnewh.LIBCMT ref: 000001BFC93488D6
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488E1
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488EC

malloc.LIBCMT ref: 000001BFC93135C8

Part of subcall function 000001BFC9348868: _callnewh.LIBCMT ref: 000001BFC93488FC
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC9348901

free.LIBCMT ref: 000001BFC93136AF
free.LIBCMT ref: 000001BFC93136B7
free.LIBCMT ref: 000001BFC93136BF
free.LIBCMT ref: 000001BFC93136CB
free.LIBCMT ref: 000001BFC93136D8

Memory Dump Source

Source File: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction ID: 86dcf7ec5dceaa937fc33c428452af8cf6b677b8a17ce799b485c70f1e690252
Opcode Fuzzy Hash: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction Fuzzy Hash: C941B0313007599BEA5A9B269D94AE93F98F789BC0F408438DE464BB61DF34D8B7C700

Function 000001BFCABCCB50 Relevance: 7.8, APIs: 6, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 000001BFCABD7F80: malloc.LIBCMT ref: 000001BFCABD7F97

malloc.LIBCMT ref: 000001BFCABCCC4E

Part of subcall function 000001BFCABF9468: _FF_MSGBANNER.LIBCMT ref: 000001BFCABF9498
Part of subcall function 000001BFCABF9468: _NMSG_WRITE.LIBCMT ref: 000001BFCABF94A2
Part of subcall function 000001BFCABF9468: _callnewh.LIBCMT ref: 000001BFCABF94D6
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94E1
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94EC

Part of subcall function 000001BFCABF8AEC: malloc.LIBCMT ref: 000001BFCABF8B27

Part of subcall function 000001BFCABF8AEC: realloc.LIBCMT ref: 000001BFCABF8B4E

malloc.LIBCMT ref: 000001BFCABCCD82
_snprintf.LIBCMT ref: 000001BFCABCCE10
_snprintf.LIBCMT ref: 000001BFCABCCE4A
_snprintf.LIBCMT ref: 000001BFCABCCE74
free.LIBCMT ref: 000001BFCABCD07B

Part of subcall function 000001BFCABF9428: RtlFreeHeap.NTDLL ref: 000001BFCABF943E
Part of subcall function 000001BFCABF9428: _errno.LIBCMT ref: 000001BFCABF9448

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: malloc$_errno_snprintf$FreeHeap_callnewhfreerealloc
String ID:
API String ID: 1397185943-0
Opcode ID: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction ID: 0a6144576a578a43f45cacd504e69ee92b9388dc8b9d152c4d9ddb884f70c526
Opcode Fuzzy Hash: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction Fuzzy Hash: 78E121746146488BF358EB68CC55FEA7BE1FB85304F40453DB589C32DADB34A88ACB42

Function 000001BFC931BF50 Relevance: 7.8, APIs: 6, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 000001BFC9327380: malloc.LIBCMT ref: 000001BFC9327397

malloc.LIBCMT ref: 000001BFC931C04E

Part of subcall function 000001BFC9348868: _FF_MSGBANNER.LIBCMT ref: 000001BFC9348898
Part of subcall function 000001BFC9348868: _NMSG_WRITE.LIBCMT ref: 000001BFC93488A2
Part of subcall function 000001BFC9348868: _callnewh.LIBCMT ref: 000001BFC93488D6
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488E1
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488EC

Part of subcall function 000001BFC9347EEC: malloc.LIBCMT ref: 000001BFC9347F27

Part of subcall function 000001BFC9347EEC: realloc.LIBCMT ref: 000001BFC9347F4E

malloc.LIBCMT ref: 000001BFC931C182
_snprintf.LIBCMT ref: 000001BFC931C210
_snprintf.LIBCMT ref: 000001BFC931C24A
_snprintf.LIBCMT ref: 000001BFC931C274
free.LIBCMT ref: 000001BFC931C47B

Memory Dump Source

Source File: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$_callnewhfreerealloc
String ID:
API String ID: 74200508-0
Opcode ID: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction ID: bb69a14d26e46ca2e3f7db1e63a62566e3ea6ee55e738c9baf5290d11b9b55ea
Opcode Fuzzy Hash: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction Fuzzy Hash: 98D143312186488AF752AB50EC51BDE7EA9F7C5344F10813DE689876E6CF39C4A6CF50

Function 000001BFCAC04424 Relevance: 7.7, APIs: 5, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000001BFCAC04451

Part of subcall function 000001BFCABFDA24: _FF_MSGBANNER.LIBCMT ref: 000001BFCABFDA41
Part of subcall function 000001BFCABFDA24: _NMSG_WRITE.LIBCMT ref: 000001BFCABFDA4B

_lock.LIBCMT ref: 000001BFCAC04464
_lock.LIBCMT ref: 000001BFCAC044BF
_calloc_crt.LIBCMT ref: 000001BFCAC04576

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction ID: 2822211e83c0bc8569fb9642e7a8341035a5270a4611a393d9014b0b378e15f8
Opcode Fuzzy Hash: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction Fuzzy Hash: A8510670518A0D8BEB54DF58CC85BA6BBD0FB58310F15026DD84AC72BBD778EC978682

Function 000001BFCABC54F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFCABC553A

Part of subcall function 000001BFCABF9468: _FF_MSGBANNER.LIBCMT ref: 000001BFCABF9498
Part of subcall function 000001BFCABF9468: _NMSG_WRITE.LIBCMT ref: 000001BFCABF94A2
Part of subcall function 000001BFCABF9468: _callnewh.LIBCMT ref: 000001BFCABF94D6
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94E1
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94EC

malloc.LIBCMT ref: 000001BFCABC5545

Part of subcall function 000001BFCABF9468: _callnewh.LIBCMT ref: 000001BFCABF94FC
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF9501

free.LIBCMT ref: 000001BFCABC562C
free.LIBCMT ref: 000001BFCABC5634
free.LIBCMT ref: 000001BFCABC5640
free.LIBCMT ref: 000001BFCABC564D

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction ID: 29e1bfbb5eab4b82960d2abf313b734641a0150c479caf80ee87d747c474e9d3
Opcode Fuzzy Hash: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction Fuzzy Hash: F541E430258B0D4BE769AA688C45EFA7ED5EBA5315F54023DD487C3287EF20E84B87D1

Function 000001BFCABFBD98 Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001BFCABFBDB5

Part of subcall function 000001BFCABFF624: _errno.LIBCMT ref: 000001BFCABFF62D
Part of subcall function 000001BFCABFF624: _invalid_parameter_noinfo.LIBCMT ref: 000001BFCABFF638

_errno.LIBCMT ref: 000001BFCABFBDC5

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

_errno.LIBCMT ref: 000001BFCABFBDE1
_isatty.LIBCMT ref: 000001BFCABFBE42
_getbuf.LIBCMT ref: 000001BFCABFBE4E

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction ID: 5e94cc2d1beba7e92a1d2159566b7614eae48f29c4824be29fcf421788328dcd
Opcode Fuzzy Hash: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction Fuzzy Hash: 50519F78114A0C4FEB98DF388C81BA57AD0EB58310F18056DD856CB2DFD774E89ACB81

Function 000001BFCABDCF00 Relevance: 7.6, APIs: 6, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFCABDCF18

Part of subcall function 000001BFCABF9468: _FF_MSGBANNER.LIBCMT ref: 000001BFCABF9498
Part of subcall function 000001BFCABF9468: _NMSG_WRITE.LIBCMT ref: 000001BFCABF94A2
Part of subcall function 000001BFCABF9468: _callnewh.LIBCMT ref: 000001BFCABF94D6
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94E1
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94EC

_snprintf.LIBCMT ref: 000001BFCABDCF38

Part of subcall function 000001BFCABF9700: _errno.LIBCMT ref: 000001BFCABF9737
Part of subcall function 000001BFCABF9700: _invalid_parameter_noinfo.LIBCMT ref: 000001BFCABF9742

free.LIBCMT ref: 000001BFCABDCF57

Part of subcall function 000001BFCABF9428: RtlFreeHeap.NTDLL ref: 000001BFCABF943E
Part of subcall function 000001BFCABF9428: _errno.LIBCMT ref: 000001BFCABF9448

malloc.LIBCMT ref: 000001BFCABDCFE0
_snprintf.LIBCMT ref: 000001BFCABDD007
free.LIBCMT ref: 000001BFCABDD045

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _errno$_snprintffreemalloc$FreeHeap_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 343393124-0
Opcode ID: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction ID: 076981fedf245a8099eb637d59088e7f9e7cf84e09137e9a70ae8c09c7ae75ff
Opcode Fuzzy Hash: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction Fuzzy Hash: 91416A30618A494FD758EB38CC54FAA7BF1FB99304F54053DE489C32A9DB25E986C741

Function 000001BFC93148F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFC931493A

Part of subcall function 000001BFC9348868: _FF_MSGBANNER.LIBCMT ref: 000001BFC9348898
Part of subcall function 000001BFC9348868: _NMSG_WRITE.LIBCMT ref: 000001BFC93488A2
Part of subcall function 000001BFC9348868: _callnewh.LIBCMT ref: 000001BFC93488D6
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488E1
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488EC

malloc.LIBCMT ref: 000001BFC9314945

Part of subcall function 000001BFC9348868: _callnewh.LIBCMT ref: 000001BFC93488FC
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC9348901

free.LIBCMT ref: 000001BFC9314A2C
free.LIBCMT ref: 000001BFC9314A34
free.LIBCMT ref: 000001BFC9314A40
free.LIBCMT ref: 000001BFC9314A4D

Memory Dump Source

Source File: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction ID: 236b793b0eed385b2afbf9118553263416e2e7deb1898e9ec83a188033ab6ca1
Opcode Fuzzy Hash: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction Fuzzy Hash: 9541C13221028D56EB169B269C48A997F9CF7D5FC4F4A8038DD168B761EF38C8A7C301

Function 000001BFCAC046C8 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFCAC046D9

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

__doserrno.LIBCMT ref: 000001BFCAC046D1

Part of subcall function 000001BFCABFB6A4: _getptd_noexit.LIBCMT ref: 000001BFCABFB6A8

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction ID: 0e782d9341c5080ca383d426d43b1bc6b02d16d1ee75d2a740f473a329f3a1ff
Opcode Fuzzy Hash: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction Fuzzy Hash: 5901AD3412494C8EFA58EB28CE41FD53E90AF16326F58426CA405860FBC77CA4DAC622

Function 000001BFCABD33EC Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFCABD3404

Part of subcall function 000001BFCABF9468: _FF_MSGBANNER.LIBCMT ref: 000001BFCABF9498
Part of subcall function 000001BFCABF9468: _NMSG_WRITE.LIBCMT ref: 000001BFCABF94A2
Part of subcall function 000001BFCABF9468: _callnewh.LIBCMT ref: 000001BFCABF94D6
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94E1
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94EC

_snprintf.LIBCMT ref: 000001BFCABD342E

Part of subcall function 000001BFCABF9700: _errno.LIBCMT ref: 000001BFCABF9737
Part of subcall function 000001BFCABF9700: _invalid_parameter_noinfo.LIBCMT ref: 000001BFCABF9742

remove.LIBCMT ref: 000001BFCABD343F
remove.LIBCMT ref: 000001BFCABD344B
free.LIBCMT ref: 000001BFCABD3455

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction ID: 4f48310ad446a17f9439f68297a010ac8caefba5c5b3c0d4c17d51fedb37ba40
Opcode Fuzzy Hash: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction Fuzzy Hash: 0301FF7452874C9FE388EB28CC55F99BBE1FFD4700F80052DB485C22A5DB74A589CB42

Function 000001BFC9353AC8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFC9353AD9

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

__doserrno.LIBCMT ref: 000001BFC9353AD1

Part of subcall function 000001BFC934AAA4: _getptd_noexit.LIBCMT ref: 000001BFC934AAA8

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction ID: 53bb3d671bc0a424364e958f7d3e10f345aeda0a260b0ab82d8f30104bfb92d7
Opcode Fuzzy Hash: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction Fuzzy Hash: 35018171B1168C81FA075B14CD81BEC3EE99BD4BB1F56C32CE52A4A7D2C76C44E38222

Function 000001BFC93227EC Relevance: 7.5, APIs: 5, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFC9322804

Part of subcall function 000001BFC9348868: _FF_MSGBANNER.LIBCMT ref: 000001BFC9348898
Part of subcall function 000001BFC9348868: _NMSG_WRITE.LIBCMT ref: 000001BFC93488A2
Part of subcall function 000001BFC9348868: _callnewh.LIBCMT ref: 000001BFC93488D6
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488E1
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488EC

_snprintf.LIBCMT ref: 000001BFC932282E

Part of subcall function 000001BFC9348B00: _errno.LIBCMT ref: 000001BFC9348B37
Part of subcall function 000001BFC9348B00: _invalid_parameter_noinfo.LIBCMT ref: 000001BFC9348B42

remove.LIBCMT ref: 000001BFC932283F
remove.LIBCMT ref: 000001BFC932284B
free.LIBCMT ref: 000001BFC9322855

Memory Dump Source

Source File: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction ID: fef5f9557009b7021e7630b74b70d1c59b280baa959553d4e7f4d23ff41a41dc
Opcode Fuzzy Hash: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction Fuzzy Hash: EDF0F472528B8886D641EB51FC51B9EBB68F7C4780F405129FA8D93B59CF38C4A2CB40

Function 000001BFCABF68D4 Relevance: 6.5, APIs: 5, Instructions: 219COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFCABF6917
free.LIBCMT ref: 000001BFCABF693C

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction ID: ef6fce37909579927d344ae09fdaa71981686ad037aed346a144dd2c6cb86a70
Opcode Fuzzy Hash: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction Fuzzy Hash: 099130341087898FE7A4EB78CC55BDEBBE1FB94300F54493DA489C3295DB75A88AC742

Function 000001BFC9345CD4 Relevance: 6.4, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFC9345D17
free.LIBCMT ref: 000001BFC9345D3C

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction ID: 1e014cfcc561d6988e116e4a5650e5b9ee518cb702eddbb7d0080deafccab65e
Opcode Fuzzy Hash: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction Fuzzy Hash: 18815532604688C6E761DB14E840BDEBFA9F7C5740F508439E689C7A99DB7DC4D6CB10

Function 000001BFCABF92BC Relevance: 6.3, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFCABF92D6

Part of subcall function 000001BFCABF9468: _FF_MSGBANNER.LIBCMT ref: 000001BFCABF9498
Part of subcall function 000001BFCABF9468: _NMSG_WRITE.LIBCMT ref: 000001BFCABF94A2
Part of subcall function 000001BFCABF9468: _callnewh.LIBCMT ref: 000001BFCABF94D6
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94E1
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94EC

malloc.LIBCMT ref: 000001BFCABF92F5

Part of subcall function 000001BFCABF9468: _callnewh.LIBCMT ref: 000001BFCABF94FC
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF9501

malloc.LIBCMT ref: 000001BFCABF932C
_snprintf.LIBCMT ref: 000001BFCABF9358

Part of subcall function 000001BFCABF9700: _errno.LIBCMT ref: 000001BFCABF9737
Part of subcall function 000001BFCABF9700: _invalid_parameter_noinfo.LIBCMT ref: 000001BFCABF9742

malloc.LIBCMT ref: 000001BFCABF939B

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction ID: b513c8deed0744354f6f18a8348700b5801de1bdab5ac0d233fcc2cca5c73653
Opcode Fuzzy Hash: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction Fuzzy Hash: 4F31FC7451CB489FDB84EF28C444A5AB7E1FBAC315F14066DA48DD33A5CB34E982CB42

Function 000001BFC93486BC Relevance: 6.3, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFC93486D6

Part of subcall function 000001BFC9348868: _FF_MSGBANNER.LIBCMT ref: 000001BFC9348898
Part of subcall function 000001BFC9348868: _NMSG_WRITE.LIBCMT ref: 000001BFC93488A2
Part of subcall function 000001BFC9348868: _callnewh.LIBCMT ref: 000001BFC93488D6
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488E1
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488EC

malloc.LIBCMT ref: 000001BFC93486F5

Part of subcall function 000001BFC9348868: _callnewh.LIBCMT ref: 000001BFC93488FC
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC9348901

malloc.LIBCMT ref: 000001BFC934872C
_snprintf.LIBCMT ref: 000001BFC9348758

Part of subcall function 000001BFC9348B00: _errno.LIBCMT ref: 000001BFC9348B37
Part of subcall function 000001BFC9348B00: _invalid_parameter_noinfo.LIBCMT ref: 000001BFC9348B42

malloc.LIBCMT ref: 000001BFC934879B

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction ID: 10b9cf490ddab1fb3c48172cdd7d78adb02b8bc2f2438f884b18d2da395ecd54
Opcode Fuzzy Hash: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction Fuzzy Hash: 2121A936608B8886DA65DB16E45065EBBA4F3CCB94F114225EEDD53BA8CF3CC552CF40

Function 000001BFCABFA1F4 Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFCABFA22C

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

_invalid_parameter_noinfo.LIBCMT ref: 000001BFCABFA237
_flush.LIBCMT ref: 000001BFCABFA2E9
_fileno.LIBCMT ref: 000001BFCABFA30A

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction ID: 9859895ce777937b6fc6518a1b7814568d6f2c9c6442cb056bebb98d2f3dcece
Opcode Fuzzy Hash: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction Fuzzy Hash: BE51D734318F0D4BE66CAA7D5C45BB57AD1E759310F18023ED85AC31DAEB61EC9B4282

Function 000001BFC93495F4 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFC934962C

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001BFC9349637
_flush.LIBCMT ref: 000001BFC93496E9
_fileno.LIBCMT ref: 000001BFC934970A

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction ID: 1229646aeb904b4b7df8ee0e402808c0f8c51fcec687b2dcab1bec9cdab54bf1
Opcode Fuzzy Hash: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction Fuzzy Hash: A141E53130024846EA769E225D44B9ABE99B7C4FE4F1AC2389E55CB7C5D73CD4F38608

Function 000001BFCABC10D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

clock.LIBCMT ref: 000001BFCABC1117
clock.LIBCMT ref: 000001BFCABC1124
clock.LIBCMT ref: 000001BFCABC112D
clock.LIBCMT ref: 000001BFCABC113A

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: 9ac3ed3e1c51d573237c2c9bc79794e313d0c0f099c6aed1ff4f7321f4514034
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: A6210B3540C70C4EE764ADA8A882FB6BBC0D745350F25423DE99AD3157EB54EC8783C5

Function 000001BFCAC09728 Relevance: 6.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BFCAC0974C

Part of subcall function 000001BFCABFBF24: _getptd.LIBCMT ref: 000001BFCABFBF3A
Part of subcall function 000001BFCABFBF24: __updatetlocinfo.LIBCMT ref: 000001BFCABFBF6F
Part of subcall function 000001BFCABFBF24: __updatetmbcinfo.LIBCMT ref: 000001BFCABFBF96

_errno.LIBCMT ref: 000001BFCAC09758

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

_invalid_parameter_noinfo.LIBCMT ref: 000001BFCAC09763
strchr.LIBCMT ref: 000001BFCAC09779

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction ID: e93048bf98a5bc7b2b320efd2b2cc746c5c00d858f0d4231e780268641503b8d
Opcode Fuzzy Hash: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction Fuzzy Hash: 1721257651866C8EE7A4DEAC4894BBA3ED1E745311F04067DA096C71EBCB20D8DAC641

Function 000001BFC9358B28 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BFC9358B4C

Part of subcall function 000001BFC934B324: _getptd.LIBCMT ref: 000001BFC934B33A
Part of subcall function 000001BFC934B324: __updatetlocinfo.LIBCMT ref: 000001BFC934B36F
Part of subcall function 000001BFC934B324: __updatetmbcinfo.LIBCMT ref: 000001BFC934B396

_errno.LIBCMT ref: 000001BFC9358B58

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001BFC9358B63
strchr.LIBCMT ref: 000001BFC9358B79

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction ID: 812192157d431240b680e1db648f12e81d9732db41e9476ec5b0ab513c2ac562
Opcode Fuzzy Hash: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction Fuzzy Hash: E821F6B2A042AC41EB6256159850BBD7EDCE3C8BD4F1CD1B9AE8646AC5CB6CC4E38710

Function 000001BFC93104D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

clock.LIBCMT ref: 000001BFC9310517
clock.LIBCMT ref: 000001BFC9310524
clock.LIBCMT ref: 000001BFC931052D
clock.LIBCMT ref: 000001BFC931053A

Memory Dump Source

Source File: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: 675bc3ec00eb8b9c67879f7c9066e87facc7e8bafd92aea9c03590cd0e2c3f54
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: B5110A3250874CC5F7729EB6BC40AABBE98B7C8394F199039EE4543255EB78C8D3C600

Function 000001BFCABC1CC4 Relevance: 5.4, APIs: 4, Instructions: 410COMMON

Download Yara Rule

APIs

calloc.LIBCMT ref: 000001BFCABC1D6A

Part of subcall function 000001BFCAC08F58: _calloc_impl.LIBCMT ref: 000001BFCAC08F68
Part of subcall function 000001BFCAC08F58: _errno.LIBCMT ref: 000001BFCAC08F7B
Part of subcall function 000001BFCAC08F58: _errno.LIBCMT ref: 000001BFCAC08F85

free.LIBCMT ref: 000001BFCABC1EF3
free.LIBCMT ref: 000001BFCABC1EFD

Part of subcall function 000001BFCABF9428: RtlFreeHeap.NTDLL ref: 000001BFCABF943E
Part of subcall function 000001BFCABF9428: _errno.LIBCMT ref: 000001BFCABF9448

free.LIBCMT ref: 000001BFCABC1F0F

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _errnofree$FreeHeap_calloc_implcalloc
String ID:
API String ID: 2553729582-0
Opcode ID: 78c2e68d2c1b3242693463214cb6a7d91bdf562fc33a57e2f937b62e4c2d32d4
Instruction ID: c7e1ba07d846a400eb62091e609f3061bb99218e99c40a67fdb73769b655a2a4
Opcode Fuzzy Hash: 78c2e68d2c1b3242693463214cb6a7d91bdf562fc33a57e2f937b62e4c2d32d4
Instruction Fuzzy Hash: 81E14C70618B488FD798DF5CD884BAABBE1FB98305F10452EE48DC3255DB70E985CB85

Function 000001BFC93270FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000001BFC9327380: malloc.LIBCMT ref: 000001BFC9327397

strrchr.LIBCMT ref: 000001BFC93271F2
_snprintf.LIBCMT ref: 000001BFC932730C

Strings

:, xrefs: 000001BFC932734F

Memory Dump Source

Source File: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintfmallocstrrchr
String ID: :
API String ID: 3587327836-336475711
Opcode ID: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction ID: 1fe4ed74409d6625b6e29129e918b3ef65f71c27b64da4050af38ec099530da0
Opcode Fuzzy Hash: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction Fuzzy Hash: 1F61E032219B8885D751DB15E89479ABBA4F3C5B90F109129FACE47BA9CF7DC492CB00

Function 000001BFCABDB940 Relevance: 5.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFCABDB9AA

Part of subcall function 000001BFCABF9468: _FF_MSGBANNER.LIBCMT ref: 000001BFCABF9498
Part of subcall function 000001BFCABF9468: _NMSG_WRITE.LIBCMT ref: 000001BFCABF94A2
Part of subcall function 000001BFCABF9468: _callnewh.LIBCMT ref: 000001BFCABF94D6
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94E1
Part of subcall function 000001BFCABF9468: _errno.LIBCMT ref: 000001BFCABF94EC

free.LIBCMT ref: 000001BFCABDBDE3

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction ID: 5c60d82e4b2ef78000324501c0ac56b7501a4f9fb84cc578fd517198858eab4d
Opcode Fuzzy Hash: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction Fuzzy Hash: 8AD12C746487898FD7B8DB18C444BAFBBE0FB9A314F90092DA5C9C7258CB30A885C747

Function 000001BFCABF9924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFCABF9975

Part of subcall function 000001BFCABFB714: _getptd_noexit.LIBCMT ref: 000001BFCABFB718

_invalid_parameter_noinfo.LIBCMT ref: 000001BFCABF9980

Strings

B, xrefs: 000001BFCABF99AC

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction ID: c514535b067c184f1e0663898cb6c5f087c3528db022bcd686bd61dfd79e95a3
Opcode Fuzzy Hash: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction Fuzzy Hash: 6E11C430218B0C4FD744EF6CD885BA5B7D1FB98324F1447AEA019C32A5CB34D985CB82

Function 000001BFC93512F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__crtCapturePreviousContext.LIBCMT ref: 000001BFC93517B5
__raise_securityfailure.LIBCMT ref: 000001BFC9351857

Strings

sv-FI, xrefs: 000001BFC9351850

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: CaptureContextPrevious__crt__raise_securityfailure
String ID: sv-FI
API String ID: 37250909-2947700294
Opcode ID: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction ID: 30c9680d3fc42d164e20494646a7080e59181120bd34c3c9b006cddfad6349d2
Opcode Fuzzy Hash: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction Fuzzy Hash: 5F211478615B0881FA0A9B18FD51BE57BA8F7C8344F90813ED98E867A1DF3CC5A6C310

Function 000001BFC9348D24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BFC9348D75

Part of subcall function 000001BFC934AB14: _getptd_noexit.LIBCMT ref: 000001BFC934AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001BFC9348D80

Strings

B, xrefs: 000001BFC9348DAC

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction ID: e24f09007ea0afcad60be329c7b062fea2ec9641a44cc3a374eb698e55ed1ac3
Opcode Fuzzy Hash: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction Fuzzy Hash: D811C27261064486EB118F52E840799BA65F7D8FD4F558324AF5847795CF38C191CB00

Function 000001BFC93110C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMON

Download Yara Rule

APIs

calloc.LIBCMT ref: 000001BFC931116A

Part of subcall function 000001BFC9358358: _calloc_impl.LIBCMT ref: 000001BFC9358368
Part of subcall function 000001BFC9358358: _errno.LIBCMT ref: 000001BFC935837B
Part of subcall function 000001BFC9358358: _errno.LIBCMT ref: 000001BFC9358385

free.LIBCMT ref: 000001BFC93112F3
free.LIBCMT ref: 000001BFC93112FD
free.LIBCMT ref: 000001BFC931130F

Memory Dump Source

Source File: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction ID: 348033b2acd30b2b18c694c1097ae69c16b2376faf2b41a1fbd3f7900a86859f
Opcode Fuzzy Hash: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction Fuzzy Hash: F2C1EF36604B8586E765CF55E88479E7BF8F788784F108129EB8D87B68DF38C5A5CB00

Function 000001BFC932AD40 Relevance: 5.2, APIs: 4, Instructions: 234COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFC932ADAA

Part of subcall function 000001BFC9348868: _FF_MSGBANNER.LIBCMT ref: 000001BFC9348898
Part of subcall function 000001BFC9348868: _NMSG_WRITE.LIBCMT ref: 000001BFC93488A2
Part of subcall function 000001BFC9348868: _callnewh.LIBCMT ref: 000001BFC93488D6
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488E1
Part of subcall function 000001BFC9348868: _errno.LIBCMT ref: 000001BFC93488EC

free.LIBCMT ref: 000001BFC932B1E3

Memory Dump Source

Source File: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction ID: e0085086d5121c5d9c7827195aa5434145bf29076a219f8069ec166ba68dba79
Opcode Fuzzy Hash: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction Fuzzy Hash: B8C1F876218AC5CAD771CA14E48079FBBA0F7CA794F50502AEBCA83B59CB39D491CF05

Function 000001BFCABCFBEC Relevance: 5.2, APIs: 4, Instructions: 221COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001BFCABCFCA9
_snprintf.LIBCMT ref: 000001BFCABCFCC9
_snprintf.LIBCMT ref: 000001BFCABCFD9A

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction ID: d84357b1d509afa2265f5ce35e536aab7e46c85bc8e57ef8058b93f6744e62d5
Opcode Fuzzy Hash: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction Fuzzy Hash: A1912374118B8C8FE764EF28C855F9BBBE1FB99301F40092DD48AC32A5DB74A585CB42

Function 000001BFCABC4300 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFCABC4363

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction ID: 4483145bca5bdade1695951f1ee0a79c774665c5505f9a7c3dd9abdcde91354d
Opcode Fuzzy Hash: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction Fuzzy Hash: 0451B83061CA094BDB58DF289C85EA977D1FB94304F14457DD85BC328AEF20FD878681

Function 000001BFC931EFEC Relevance: 5.1, APIs: 4, Instructions: 144COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001BFC931F0A9
_snprintf.LIBCMT ref: 000001BFC931F0C9
_snprintf.LIBCMT ref: 000001BFC931F19A

Memory Dump Source

Source File: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction ID: bd972e0ade444eac3dc1788b986b4d8af948173cba341529f68a8df69cd6c4cf
Opcode Fuzzy Hash: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction Fuzzy Hash: DB812E36208A8885E721DB55FC507DABB65F3C5794F40822ADA9D43BA9CF7DC0A6CB00

Function 000001BFC9313700 Relevance: 5.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFC9313763

Memory Dump Source

Source File: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction ID: cc0a22e73876d3d4ec068d4d4ecf96b0101818d490aba56e556f091175ca428f
Opcode Fuzzy Hash: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction Fuzzy Hash: 3341953260064887DB56DF269804AED7B98F7C4B84F44C439DE1A4BB55EF34DC9AC700

Function 000001BFCABF7594 Relevance: 5.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001BFCABF761F
_snprintf.LIBCMT ref: 000001BFCABF7644
_snprintf.LIBCMT ref: 000001BFCABF76A4
_snprintf.LIBCMT ref: 000001BFCABF76C9

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: 00564aca36f16f361905bde5f4b8bc15abb45bed7784437236aa5b11bc9bc3c4
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: 77417F34518A489FE751EB28DC44BDA7BE0F798300F54057DA449C32E9DB34E9CACB42

Function 000001BFCABF7D04 Relevance: 5.1, APIs: 4, Instructions: 84stringCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFCABF7D4E
strtok.LIBCMT ref: 000001BFCABF7DAC
strtok.LIBCMT ref: 000001BFCABF7DBE
free.LIBCMT ref: 000001BFCABF7DD7

Memory Dump Source

Source File: 00000006.00000002.2701316815.000001BFCABC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001BFCABC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1bfcabc1000_rundll32.jbxd

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction ID: 69b3ac6c3c8f1a681b14463d04001fd7b40734f1e01f74b74af5ea6355a1790b
Opcode Fuzzy Hash: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction Fuzzy Hash: 5E316174518B4C9FE794EB28CC44FA97BE1FB99315F94062DA08AC32A5D734A8C6C701

Function 000001BFC9346994 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001BFC9346A1F
_snprintf.LIBCMT ref: 000001BFC9346A44
_snprintf.LIBCMT ref: 000001BFC9346AA4
_snprintf.LIBCMT ref: 000001BFC9346AC9

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: 1e081825da501c0a616a6d1d3088f1de4234e841f6dba57f83f6dbe0e5fa52c2
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: 0A311071214E8882E7229B05EC44BD97F69F3C4758F51823AEAAD437E5DB38C5A6C701

Function 000001BFC9347104 Relevance: 5.0, APIs: 4, Instructions: 50stringCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BFC934714E
strtok.LIBCMT ref: 000001BFC93471AC
strtok.LIBCMT ref: 000001BFC93471BE
free.LIBCMT ref: 000001BFC93471D7

Memory Dump Source

Source File: 00000006.00000003.2696147687.000001BFC932D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BFC9310000, based on PE: true

Associated: 00000006.00000003.2696128658.000001BFC9310000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000003.2696147687.000001BFC936C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_1bfc9310000_rundll32.jbxd

Yara matches

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction ID: 2bb42b024baa9cbfa4f8dd15f94cfa06aed0aa06ead6b66433caa0c4eeb65879
Opcode Fuzzy Hash: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction Fuzzy Hash: 4621DF31114B4885EA629B15FC8479A7F69F3C5BA4F415329ED9E837E5CF38C4A28B00

Analysis Process: rundll32.exePID: 7044, Parent PID: 2268COMMON

Executed Functions

Function 000001D3260FD107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001D3260FD166
VirtualProtect.KERNELBASE ref: 000001D3260FD1AF

Strings

DCBA, xrefs: 000001D3260FD141

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: DCBA
API String ID: 544645111-2222620526
Opcode ID: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction ID: 1e4b1e08172eb35e3b59f6cfd70a0000e17b7ad9026aeb9c4b9285cc99cba4b8
Opcode Fuzzy Hash: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction Fuzzy Hash: 31412672705B859EDB20CF69D8807DC37A5FB49BACF118212EA1D87B98DA34CA44E740

Function 000001D327A5D0FC Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 110
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 000001D327A5D1AB
(, xrefs: 000001D327A5D1A3

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID:
String ID: ($0
API String ID: 0-506339136
Opcode ID: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction ID: 1dcdecb0afbe1713089f6b4a460d5e1dc65d1ba124603cd3d11b8432eec7d934
Opcode Fuzzy Hash: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction Fuzzy Hash: 13417F709187458FEBA5DB29C0947AEB7F0FB98355F50492EE09AC32A1DB74CA44CB03

Non-executed Functions

Function 000001D32611F9E4 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001D32611FA3A
_errno.LIBCMT ref: 000001D32611FA41
_invalid_parameter_noinfo.LIBCMT ref: 000001D32611FA4C

Strings

U, xrefs: 000001D32611FFAE

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction ID: 43048541e243f958fc3e5dfb505f1fe08ebdcc3d57f9c81b334e757acaed3955
Opcode Fuzzy Hash: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction Fuzzy Hash: B7123A72A046818AFB208F24D0453EE77E1FB85B94F400117DB6A877A9DB3DF645DB12

Function 000001D32611B3CC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001D32611B42D

Part of subcall function 000001D32611B324: _getptd.LIBCMT ref: 000001D32611B33A
Part of subcall function 000001D32611B324: __updatetlocinfo.LIBCMT ref: 000001D32611B36F
Part of subcall function 000001D32611B324: __updatetmbcinfo.LIBCMT ref: 000001D32611B396

_fileno.LIBCMT ref: 000001D32611B45F

Part of subcall function 000001D32611EA24: _errno.LIBCMT ref: 000001D32611EA2D
Part of subcall function 000001D32611EA24: _invalid_parameter_noinfo.LIBCMT ref: 000001D32611EA38

write_multi_char.LIBCMT ref: 000001D32611BA8F
write_string.LIBCMT ref: 000001D32611BAAC
_errno.LIBCMT ref: 000001D32611B432

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

_errno.LIBCMT ref: 000001D32611BD97
_invalid_parameter_noinfo.LIBCMT ref: 000001D32611BDA2

Strings

@, xrefs: 000001D32611B44B
-, xrefs: 000001D32611BA40

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$@
API String ID: 3246410048-1222683799
Opcode ID: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction ID: 5348b7596a660b5c4fe17493c361beb8ab054e94bb234363978fcf4813a7d614
Opcode Fuzzy Hash: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction Fuzzy Hash: 33B12932A04A8485FB64CB6D94823ED6BA1FF41F94F144147DE6907AD9DB38F700E742

Function 000001D327A80EEC Relevance: 16.6, APIs: 11, Instructions: 108
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001D327A80F1E

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

__doserrno.LIBCMT ref: 000001D327A80F15

Part of subcall function 000001D327A7B6A4: _getptd_noexit.LIBCMT ref: 000001D327A7B6A8

__doserrno.LIBCMT ref: 000001D327A80F7B
_errno.LIBCMT ref: 000001D327A80F82
_invalid_parameter_noinfo.LIBCMT ref: 000001D327A80FE6

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction ID: 842ed3ef90596dbcd10452395429e1cbe88ebe7543dbe7adffaf6771a7ec2529
Opcode Fuzzy Hash: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction Fuzzy Hash: 583185F19197444EEF96AF68A8832EE3690FB85330F15435AE436873E3E7709E018653

Function 000001D326118F1C Relevance: 16.6, APIs: 11, Instructions: 82COMMON

Download Yara Rule

APIs

__crtCorExitProcess.LIBCMT ref: 000001D326118F24
free.LIBCMT ref: 000001D326118F62

Part of subcall function 000001D326118828: _errno.LIBCMT ref: 000001D326118848

free.LIBCMT ref: 000001D326118F77
free.LIBCMT ref: 000001D326118F98
free.LIBCMT ref: 000001D326118FAD
free.LIBCMT ref: 000001D326118FC1
free.LIBCMT ref: 000001D326118FCD
free.LIBCMT ref: 000001D326118FF8
free.LIBCMT ref: 000001D326119019
free.LIBCMT ref: 000001D326119032
free.LIBCMT ref: 000001D326119063

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: free$ExitProcess__crt_errno
String ID:
API String ID: 1362684943-0
Opcode ID: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction ID: 3327c555d48b094da7745feafed5cecf3d3c371fd005de6daa04232727189783
Opcode Fuzzy Hash: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction Fuzzy Hash: 2F413B71E12A0186FE94AB15E9533E82361EF44FA4F484657A93A072D6CF38B654F343

Function 000001D3261202EC Relevance: 16.6, APIs: 11, Instructions: 81COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D32612031E

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

__doserrno.LIBCMT ref: 000001D326120315

Part of subcall function 000001D32611AAA4: _getptd_noexit.LIBCMT ref: 000001D32611AAA8

__doserrno.LIBCMT ref: 000001D32612037B
_errno.LIBCMT ref: 000001D326120382
_invalid_parameter_noinfo.LIBCMT ref: 000001D3261203E6

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction ID: 8ba397a49e64ac028e0e28835a737489eb4b79534022a9288c95f40ce2681e52
Opcode Fuzzy Hash: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction Fuzzy Hash: A3310931B102D48BE706AF65A9837DD3A51BF80BA0F454217A932077D7C67CFA41E722

Function 000001D327A81CD8 Relevance: 15.1, APIs: 10, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001D327A81D03

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

__doserrno.LIBCMT ref: 000001D327A81CFB

Part of subcall function 000001D327A7B6A4: _getptd_noexit.LIBCMT ref: 000001D327A7B6A8

__lock_fhandle.LIBCMT ref: 000001D327A81D47
_lseeki64_nolock.LIBCMT ref: 000001D327A81D60
_unlock_fhandle.LIBCMT ref: 000001D327A81D83

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction ID: 5c9078d5b7aa11e41465fa6f0470f2d4087fd360526d69b731b107257724bd00
Opcode Fuzzy Hash: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction Fuzzy Hash: 2721F3B0A1AA040EFF9AAB58E8423ED72D0FB81330F15065EE036873D3D77059018663

Function 000001D327A81B60 Relevance: 15.1, APIs: 10, Instructions: 88
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001D327A81B8B

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

__doserrno.LIBCMT ref: 000001D327A81B83

Part of subcall function 000001D327A7B6A4: _getptd_noexit.LIBCMT ref: 000001D327A7B6A8

__lock_fhandle.LIBCMT ref: 000001D327A81BCF
_lseek_nolock.LIBCMT ref: 000001D327A81BE8
_unlock_fhandle.LIBCMT ref: 000001D327A81C09

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction ID: dc64d1834e062bae95c8677d0cc6733e46127d7f9278572767654781cc88daa2
Opcode Fuzzy Hash: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction Fuzzy Hash: 1C21E2F1E096004EFB9A6B58E8863FD7290FB82330F15061EE166873D3E774594186A3

Function 000001D326120F60 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D326120F8B

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

__doserrno.LIBCMT ref: 000001D326120F83

Part of subcall function 000001D32611AAA4: _getptd_noexit.LIBCMT ref: 000001D32611AAA8

__lock_fhandle.LIBCMT ref: 000001D326120FCF
_lseek_nolock.LIBCMT ref: 000001D326120FE8
_unlock_fhandle.LIBCMT ref: 000001D326121009

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction ID: ddc4151527209854f2a040ddfcc2d1c9c85688e835809abf867259812d621986
Opcode Fuzzy Hash: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction Fuzzy Hash: E521D432E001D046F711AF15A8433ED6A51AF80BA1F194116AA36073D3CB7CBA41E72A

Function 000001D3261210D8 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D326121103

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

__doserrno.LIBCMT ref: 000001D3261210FB

Part of subcall function 000001D32611AAA4: _getptd_noexit.LIBCMT ref: 000001D32611AAA8

__lock_fhandle.LIBCMT ref: 000001D326121147
_lseeki64_nolock.LIBCMT ref: 000001D326121160
_unlock_fhandle.LIBCMT ref: 000001D326121183

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction ID: c974bef18cd9bbb5718b9551499a1acb2bf9b262e86592645269f0dcff4a3878
Opcode Fuzzy Hash: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction Fuzzy Hash: 3A21B332E0029445FB01AF25A8033ED6A61AF50BB0F198316AA36073D3C63CB681E726

Function 000001D3261292A0 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001D3261292C6
_errno.LIBCMT ref: 000001D3261292BB

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction ID: a3cee79ecedf2f196b4073740fd76fdbaec25936218e59f6d488f6261a309333
Opcode Fuzzy Hash: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction Fuzzy Hash: 47411A71E003A082FB60DB2B95423E936E1FF54BA4F904523DA7A436C9D728F641F712

Function 000001D327A80504 Relevance: 13.6, APIs: 9, Instructions: 89
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001D327A8052F

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

__doserrno.LIBCMT ref: 000001D327A80527

Part of subcall function 000001D327A7B6A4: _getptd_noexit.LIBCMT ref: 000001D327A7B6A8

__lock_fhandle.LIBCMT ref: 000001D327A80573
_unlock_fhandle.LIBCMT ref: 000001D327A805AD

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction ID: a2afaf2cc9a8117299b08153ff4f45beec2737443f238e2ff709649208027862
Opcode Fuzzy Hash: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction Fuzzy Hash: 462107F0A096000EFB9A6B58E8473EE7280FB85330F15431AE175873E3D774590186B7

Function 000001D327A7F828 Relevance: 13.6, APIs: 9, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001D327A7F849

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

__doserrno.LIBCMT ref: 000001D327A7F841

Part of subcall function 000001D327A7B6A4: _getptd_noexit.LIBCMT ref: 000001D327A7B6A8

__lock_fhandle.LIBCMT ref: 000001D327A7F88D
_close_nolock.LIBCMT ref: 000001D327A7F8A0
_unlock_fhandle.LIBCMT ref: 000001D327A7F8B9

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction ID: 7cecc2d825da0688d11125ff22f2089fb9ec968226c9520d33473761e9c72bbe
Opcode Fuzzy Hash: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction Fuzzy Hash: 1221D8B2D06A044EFF96AB6898853ED7690FB46331F15055FE036873D3D7748A018763

Function 000001D32611F904 Relevance: 13.6, APIs: 9, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D32611F92F

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

__doserrno.LIBCMT ref: 000001D32611F927

Part of subcall function 000001D32611AAA4: _getptd_noexit.LIBCMT ref: 000001D32611AAA8

__lock_fhandle.LIBCMT ref: 000001D32611F973
_unlock_fhandle.LIBCMT ref: 000001D32611F9AD

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction ID: f469c36681a40fd97c9d7be119a97513c5243bf3781aa6a0df4b111c9fceb132
Opcode Fuzzy Hash: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction Fuzzy Hash: 5E21D472F001845AF6017F25A8533ED6A91AF80FA0F594197BA350B3D3CB7CBA41E326

Function 000001D32611EC28 Relevance: 13.6, APIs: 9, Instructions: 57COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D32611EC49

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

__doserrno.LIBCMT ref: 000001D32611EC41

Part of subcall function 000001D32611AAA4: _getptd_noexit.LIBCMT ref: 000001D32611AAA8

__lock_fhandle.LIBCMT ref: 000001D32611EC8D
_close_nolock.LIBCMT ref: 000001D32611ECA0
_unlock_fhandle.LIBCMT ref: 000001D32611ECB9

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction ID: 7484d2844d051e0dd5706b939934a406ec1a5fb73322c1c1e54d0d42b4b5eb03
Opcode Fuzzy Hash: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction Fuzzy Hash: D211E632F0068042F7056F65AC433DC6E51AF80FA1F1946A6A93A073D3C6B9F640E366

Function 000001D327A79B34 Relevance: 12.6, APIs: 10, Instructions: 116
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.LIBCMT ref: 000001D327A79B62

Part of subcall function 000001D327A79428: _errno.LIBCMT ref: 000001D327A79448

free.LIBCMT ref: 000001D327A79B77
free.LIBCMT ref: 000001D327A79B98
free.LIBCMT ref: 000001D327A79BAD
free.LIBCMT ref: 000001D327A79BC1
free.LIBCMT ref: 000001D327A79BCD
free.LIBCMT ref: 000001D327A79BF8
free.LIBCMT ref: 000001D327A79C19
free.LIBCMT ref: 000001D327A79C32
free.LIBCMT ref: 000001D327A79C63

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction ID: e7035fef2d1c7d7ff98ea6fb4287b875052132d76a69e399448586d66c761ae7
Opcode Fuzzy Hash: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction Fuzzy Hash: BA410E74658A0A8FFFE5EB58D8D6BED32D1F75C321F54402A9025C2391DB3C9945CB12

Function 000001D327A4460C Relevance: 11.6, APIs: 9, Instructions: 305
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 000001D327A446A9

Part of subcall function 000001D327A79468: _FF_MSGBANNER.LIBCMT ref: 000001D327A79498
Part of subcall function 000001D327A79468: _NMSG_WRITE.LIBCMT ref: 000001D327A794A2
Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794D6
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794E1
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794EC

malloc.LIBCMT ref: 000001D327A446B3

Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794FC
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A79501

malloc.LIBCMT ref: 000001D327A446BE
free.LIBCMT ref: 000001D327A4487E
free.LIBCMT ref: 000001D327A44886
free.LIBCMT ref: 000001D327A4488E

Part of subcall function 000001D327A454F0: malloc.LIBCMT ref: 000001D327A4553A
Part of subcall function 000001D327A454F0: malloc.LIBCMT ref: 000001D327A45545
Part of subcall function 000001D327A454F0: free.LIBCMT ref: 000001D327A4562C
Part of subcall function 000001D327A454F0: free.LIBCMT ref: 000001D327A45634

free.LIBCMT ref: 000001D327A4489A
free.LIBCMT ref: 000001D327A448A7
free.LIBCMT ref: 000001D327A448B4

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction ID: f5ad6904484f3a820949f2ff198eb8fef0fd362c4973ca5eeeede061bfae0df6
Opcode Fuzzy Hash: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction Fuzzy Hash: 2491C8B0B18B484BEB9AAA6C94617FD73D1FB95711F50021FD49AC3383EF219D068687

Function 000001D3260E3A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D3260E3AA9

Part of subcall function 000001D326118868: _FF_MSGBANNER.LIBCMT ref: 000001D326118898
Part of subcall function 000001D326118868: _NMSG_WRITE.LIBCMT ref: 000001D3261188A2
Part of subcall function 000001D326118868: _callnewh.LIBCMT ref: 000001D3261188D6
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188E1
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188EC

malloc.LIBCMT ref: 000001D3260E3AB3

Part of subcall function 000001D326118868: _callnewh.LIBCMT ref: 000001D3261188FC
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D326118901

malloc.LIBCMT ref: 000001D3260E3ABE
free.LIBCMT ref: 000001D3260E3C7E
free.LIBCMT ref: 000001D3260E3C86
free.LIBCMT ref: 000001D3260E3C8E

Part of subcall function 000001D3260E48F0: malloc.LIBCMT ref: 000001D3260E493A
Part of subcall function 000001D3260E48F0: malloc.LIBCMT ref: 000001D3260E4945
Part of subcall function 000001D3260E48F0: free.LIBCMT ref: 000001D3260E4A2C
Part of subcall function 000001D3260E48F0: free.LIBCMT ref: 000001D3260E4A34

free.LIBCMT ref: 000001D3260E3C9A
free.LIBCMT ref: 000001D3260E3CA7
free.LIBCMT ref: 000001D3260E3CB4

Memory Dump Source

Source File: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction ID: 348e3d7e7be61105c7deae23dcef9f68f9848f9cfb8689c0b31bea84f946e7c7
Opcode Fuzzy Hash: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction Fuzzy Hash: A3712932B087A446EB189B2694407EE7B91FF86FC8F40C416DE5A07B86DB38D605FB41

Function 000001D326116C8C Relevance: 10.6, APIs: 7, Instructions: 145stringCOMMON

Download Yara Rule

APIs

_time64.LIBCMT ref: 000001D326116CA8
malloc.LIBCMT ref: 000001D326116CF3
strtok.LIBCMT ref: 000001D326116D5B
strtok.LIBCMT ref: 000001D326116D9B
_time64.LIBCMT ref: 000001D326116DB3
_time64.LIBCMT ref: 000001D326116E6B
_time64.LIBCMT ref: 000001D326116F2A

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _time64$strtok$malloc
String ID:
API String ID: 2141844861-0
Opcode ID: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction ID: 2074f528d67c1a0ff212cc3ad1ef8294e30223f0602bad677558d11e12d2de68
Opcode Fuzzy Hash: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction Fuzzy Hash: F091F771906B848AE760CF19F88739977A0FB88754F10421BD5B9837A4CB3EF250EB42

Function 000001D32611B198 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001D32611B1B5

Part of subcall function 000001D32611EA24: _errno.LIBCMT ref: 000001D32611EA2D
Part of subcall function 000001D32611EA24: _invalid_parameter_noinfo.LIBCMT ref: 000001D32611EA38

_errno.LIBCMT ref: 000001D32611B1C5

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

_errno.LIBCMT ref: 000001D32611B1E1
_isatty.LIBCMT ref: 000001D32611B242
_getbuf.LIBCMT ref: 000001D32611B24E

Strings

, xrefs: 000001D32611B1D0

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-3916222277
Opcode ID: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction ID: 421b463260ebf374ee4a1a56616b3eb3adbcb35e6bdd41a78dc6962848e8f345
Opcode Fuzzy Hash: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction Fuzzy Hash: 9841F272A00B448AEB589F38D4533AC37A0EF44F94F144256DA7A473C6DA38FA51E782

Function 000001D327A799D8 Relevance: 10.6, APIs: 7, Instructions: 107
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001D327A799FE

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

_invalid_parameter_noinfo.LIBCMT ref: 000001D327A79A0A
__crtIsPackagedApp.LIBCMT ref: 000001D327A79A1B
_dosmaperr.LIBCMT ref: 000001D327A79A65

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction ID: 62673a77f7879f63cbcc5b90c14194b3811791a6f779ffcfdbccec7b2240c140
Opcode Fuzzy Hash: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction Fuzzy Hash: B731B3B0A15A094FFF95AB6998457ED72D1FB8C320F14416FA06AC33E2DB38C9418743

Function 000001D327A84818 Relevance: 10.6, APIs: 7, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001D327A84831

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

__lock_fhandle.LIBCMT ref: 000001D327A84879
__doserrno.LIBCMT ref: 000001D327A848AE
_errno.LIBCMT ref: 000001D327A848B5
_unlock_fhandle.LIBCMT ref: 000001D327A848C5

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction ID: d1b8d3cfaf40c4ddb863d835d188d4828d04dcdef19ef92f34daac7a50c0343e
Opcode Fuzzy Hash: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction Fuzzy Hash: A621F8B1E09B844FFF96AF68A8853EC7690FB85331F15025AE426873D3D7785A008663

Function 000001D326118DD8 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D326118DFE

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001D326118E0A
__crtIsPackagedApp.LIBCMT ref: 000001D326118E1B
_dosmaperr.LIBCMT ref: 000001D326118E65

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction ID: 12a38293fd8df85fcfec931bcd7ba6e32ac157b43a464bc0ac2d71a6d6a228ba
Opcode Fuzzy Hash: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction Fuzzy Hash: 4F319131B01B4486FB50AB36E8063A966E1BF84F98F148566DA66477E5DF3CF700E306

Function 000001D326129120 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001D326129154

Part of subcall function 000001D32611B324: _getptd.LIBCMT ref: 000001D32611B33A
Part of subcall function 000001D32611B324: __updatetlocinfo.LIBCMT ref: 000001D32611B36F
Part of subcall function 000001D32611B324: __updatetmbcinfo.LIBCMT ref: 000001D32611B396

_errno.LIBCMT ref: 000001D32612916F
_invalid_parameter_noinfo.LIBCMT ref: 000001D32612917A

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction ID: 2b97da988e532bd5e35d660dca64c0994a7a17a836ce8554a185f2fa35bcafa4
Opcode Fuzzy Hash: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction Fuzzy Hash: C331D472A0479486E7109B1B94867DD76B8FB54FF0F144522EE6503BC9CB34FA81E701

Function 000001D327A7A6D0 Relevance: 9.3, APIs: 6, Instructions: 257
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001D327A7A70C

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

_invalid_parameter_noinfo.LIBCMT ref: 000001D327A7A717
memcpy_s.LIBCMT ref: 000001D327A7A7DC
_fileno.LIBCMT ref: 000001D327A7A847
_filbuf.LIBCMT ref: 000001D327A7A875
_errno.LIBCMT ref: 000001D327A7A8C5

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction ID: 3fcf4b640de4e8cc69e02607227682184aeccd5d0e3b9bec52199dd85901a424
Opcode Fuzzy Hash: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction Fuzzy Hash: BD61AF70A18B095AEAAD5A2C58462FE72D1F794731F14032FE467C33D2EB709D5286CB

Function 000001D327A52854 Relevance: 9.2, APIs: 6, Instructions: 202
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001D327A57F80: malloc.LIBCMT ref: 000001D327A57F97

Part of subcall function 000001D327A7A1E8: _errno.LIBCMT ref: 000001D327A7A13F
Part of subcall function 000001D327A7A1E8: _invalid_parameter_noinfo.LIBCMT ref: 000001D327A7A14A

fseek.LIBCMT ref: 000001D327A52929
_ftelli64.LIBCMT ref: 000001D327A52933
fseek.LIBCMT ref: 000001D327A52947
fclose.LIBCMT ref: 000001D327A5297E
fclose.LIBCMT ref: 000001D327A529D3
malloc.LIBCMT ref: 000001D327A529E2

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction ID: 8077968d0721d5e66d18b94a22c4f445a837c8e2533ac7c39cbbb8fd080dbc0d
Opcode Fuzzy Hash: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction Fuzzy Hash: 8E710EB09187488FE785EB18C455B9AB7F1FB98365F50492EB09AC33A1CB349A45CB43

Function 000001D326119AD0 Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D326119B0C

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001D326119B17
memcpy_s.LIBCMT ref: 000001D326119BDC
_fileno.LIBCMT ref: 000001D326119C47
_filbuf.LIBCMT ref: 000001D326119C75
_errno.LIBCMT ref: 000001D326119CC5

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction ID: e46a5f4bcec0be777c1f35216ab720129f4747e076b636d901ff68864a16c2a0
Opcode Fuzzy Hash: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction Fuzzy Hash: 1D513871F0525042FA248A2654027E976D1BF44FF0F148B62AE7943BDCCB34F691E242

Function 000001D3260F1C54 Relevance: 9.1, APIs: 6, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 000001D3260F7380: malloc.LIBCMT ref: 000001D3260F7397

Part of subcall function 000001D3261195E8: _errno.LIBCMT ref: 000001D32611953F
Part of subcall function 000001D3261195E8: _invalid_parameter_noinfo.LIBCMT ref: 000001D32611954A

fseek.LIBCMT ref: 000001D3260F1D29
_ftelli64.LIBCMT ref: 000001D3260F1D33
fseek.LIBCMT ref: 000001D3260F1D47
fclose.LIBCMT ref: 000001D3260F1D7E
fclose.LIBCMT ref: 000001D3260F1DD3
malloc.LIBCMT ref: 000001D3260F1DE2

Memory Dump Source

Source File: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction ID: 646611304342f190e370a7bc1d54a223aac0fb504ca40f96426ea8ac6d37e96f
Opcode Fuzzy Hash: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction Fuzzy Hash: 40614332A18A8482E760DB15F44139EB765FBC5790F108117FAAE43BA9DF38D644EF42

Function 000001D327A7A1E8 Relevance: 9.1, APIs: 6, Instructions: 94
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001D327A7A13F

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

_invalid_parameter_noinfo.LIBCMT ref: 000001D327A7A14A
_getstream.LIBCMT ref: 000001D327A7A16A
_errno.LIBCMT ref: 000001D327A7A17C
_errno.LIBCMT ref: 000001D327A7A18E
_openfile.LIBCMT ref: 000001D327A7A1BC

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction ID: 39f8326536becee1091dae2eefb6d154cec93cfb9dfa3a9f97b6ca90d38d89a7
Opcode Fuzzy Hash: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction Fuzzy Hash: FC2183B1A19A495FFFD2AB2C48053EE62D1FB99320F04095BA456C7392EB34CA414757

Function 000001D327A51080 Relevance: 9.1, APIs: 6, Instructions: 85
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 000001D327A51097

Part of subcall function 000001D327A79468: _FF_MSGBANNER.LIBCMT ref: 000001D327A79498
Part of subcall function 000001D327A79468: _NMSG_WRITE.LIBCMT ref: 000001D327A794A2
Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794D6
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794E1
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794EC

free.LIBCMT ref: 000001D327A510E0

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction ID: 9d2f8d764a8d81dd66805e9f4da96a2ed32cc7c982ae5e5cbeb4b4f963c13c86
Opcode Fuzzy Hash: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction Fuzzy Hash: FA314FB0D18A449FEAC5EB28C4557EE77E1FB98364F500A1EB09AC33A1DB349A41C747

Function 000001D3261195E8 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D32611953F

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001D32611954A
_getstream.LIBCMT ref: 000001D32611956A
_errno.LIBCMT ref: 000001D32611957C
_errno.LIBCMT ref: 000001D32611958E
_openfile.LIBCMT ref: 000001D3261195BC

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction ID: e0b984aadc083201bcd512919d35f3dfbf6469de283d8ee2cf959700bbd1625d
Opcode Fuzzy Hash: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction Fuzzy Hash: 2821D871B1438245FBA19B21680239EA6956F44FC0F0448A3ADB99778AEB3CF701E716

Function 000001D3260F0480 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D3260F0497

Part of subcall function 000001D326118868: _FF_MSGBANNER.LIBCMT ref: 000001D326118898
Part of subcall function 000001D326118868: _NMSG_WRITE.LIBCMT ref: 000001D3261188A2
Part of subcall function 000001D326118868: _callnewh.LIBCMT ref: 000001D3261188D6
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188E1
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188EC

free.LIBCMT ref: 000001D3260F04E0

Memory Dump Source

Source File: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction ID: 743b21c29dbdf323a076314237f3032d085a4df0ba90b9852064bc8de17ba3bd
Opcode Fuzzy Hash: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction Fuzzy Hash: B6216572918A8081DA60EB11E4513DE6764FFD5B94F004213B6AE43AEACE3CD741EB42

Function 000001D32611CE24 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000001D32611CE41

Part of subcall function 000001D32611ABEC: _set_error_mode.LIBCMT ref: 000001D32611ABF5
Part of subcall function 000001D32611ABEC: _set_error_mode.LIBCMT ref: 000001D32611AC04
Part of subcall function 000001D32611ABEC: _NMSG_WRITE.LIBCMT ref: 000001D32611AC1B
Part of subcall function 000001D32611ABEC: _NMSG_WRITE.LIBCMT ref: 000001D32611AC25

_NMSG_WRITE.LIBCMT ref: 000001D32611CE4B

Part of subcall function 000001D32611AC60: _set_error_mode.LIBCMT ref: 000001D32611ACA5
Part of subcall function 000001D32611AC60: _set_error_mode.LIBCMT ref: 000001D32611ACB6
Part of subcall function 000001D32611AC60: __crtMessageBoxW.LIBCMT ref: 000001D32611ADC9

Part of subcall function 000001D326118F1C: __crtCorExitProcess.LIBCMT ref: 000001D326118F24
Part of subcall function 000001D326118F1C: free.LIBCMT ref: 000001D326118F62
Part of subcall function 000001D326118F1C: free.LIBCMT ref: 000001D326118F77
Part of subcall function 000001D326118F1C: free.LIBCMT ref: 000001D326118F98
Part of subcall function 000001D326118F1C: free.LIBCMT ref: 000001D326118FAD
Part of subcall function 000001D326118F1C: free.LIBCMT ref: 000001D326118FC1
Part of subcall function 000001D326118F1C: free.LIBCMT ref: 000001D326118FCD
Part of subcall function 000001D326118F1C: free.LIBCMT ref: 000001D326118FF8
Part of subcall function 000001D326118F1C: free.LIBCMT ref: 000001D326119019
Part of subcall function 000001D326118F1C: free.LIBCMT ref: 000001D326119032
Part of subcall function 000001D326118F1C: free.LIBCMT ref: 000001D326119063

_malloc_crt.LIBCMT ref: 000001D32611CE77

Part of subcall function 000001D32611D778: malloc.LIBCMT ref: 000001D32611D7A3

_errno.LIBCMT ref: 000001D32611CE84
_lock.LIBCMT ref: 000001D32611CE98
free.LIBCMT ref: 000001D32611CEB9

Part of subcall function 000001D326118828: _errno.LIBCMT ref: 000001D326118848

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_set_error_mode$__crt_errno$ExitMessageProcess_lock_malloc_crtmalloc
String ID:
API String ID: 2751257304-0
Opcode ID: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction ID: 5fe81f82deae40866ba75a411c61f7a29d9bc82c1fcfc2b4e09aa50823df4464
Opcode Fuzzy Hash: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction Fuzzy Hash: 3E117031E11684C1F7609B61E4473E92A61EF80F80F045463E56A466D2DF7CB750F353

Function 000001D327A44170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D327A441BD

Part of subcall function 000001D327A79468: _FF_MSGBANNER.LIBCMT ref: 000001D327A79498
Part of subcall function 000001D327A79468: _NMSG_WRITE.LIBCMT ref: 000001D327A794A2
Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794D6
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794E1
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794EC

malloc.LIBCMT ref: 000001D327A441C8

Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794FC
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A79501

free.LIBCMT ref: 000001D327A442AF
free.LIBCMT ref: 000001D327A442B7
free.LIBCMT ref: 000001D327A442BF
free.LIBCMT ref: 000001D327A442CB
free.LIBCMT ref: 000001D327A442D8

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction ID: 4db742f67cdb11aed1a2daa6d19a796d416a381e90250909888e5eb025abd55e
Opcode Fuzzy Hash: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction Fuzzy Hash: D251B670A18F0A4BEB9AAB2894616F973D5FB49314F50012ED85AC3387EF60DD428686

Function 000001D3260E3570 Relevance: 8.9, APIs: 7, Instructions: 115COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D3260E35BD

Part of subcall function 000001D326118868: _FF_MSGBANNER.LIBCMT ref: 000001D326118898
Part of subcall function 000001D326118868: _NMSG_WRITE.LIBCMT ref: 000001D3261188A2
Part of subcall function 000001D326118868: _callnewh.LIBCMT ref: 000001D3261188D6
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188E1
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188EC

malloc.LIBCMT ref: 000001D3260E35C8

Part of subcall function 000001D326118868: _callnewh.LIBCMT ref: 000001D3261188FC
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D326118901

free.LIBCMT ref: 000001D3260E36AF
free.LIBCMT ref: 000001D3260E36B7
free.LIBCMT ref: 000001D3260E36BF
free.LIBCMT ref: 000001D3260E36CB
free.LIBCMT ref: 000001D3260E36D8

Memory Dump Source

Source File: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction ID: 8e9ad60d8cfcf03d41132590891c59b8fd4d502339ff1e7479156f42977077e6
Opcode Fuzzy Hash: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction Fuzzy Hash: 4241E232B0476197EA58AB3695513ED3BA0FF06B80F80C426DE6607745DF34E626F741

Function 000001D327A4CB50 Relevance: 7.8, APIs: 6, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001D327A57F80: malloc.LIBCMT ref: 000001D327A57F97

malloc.LIBCMT ref: 000001D327A4CC4E

Part of subcall function 000001D327A79468: _FF_MSGBANNER.LIBCMT ref: 000001D327A79498
Part of subcall function 000001D327A79468: _NMSG_WRITE.LIBCMT ref: 000001D327A794A2
Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794D6
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794E1
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794EC

Part of subcall function 000001D327A78AEC: malloc.LIBCMT ref: 000001D327A78B27

Part of subcall function 000001D327A78AEC: realloc.LIBCMT ref: 000001D327A78B4E

malloc.LIBCMT ref: 000001D327A4CD82
_snprintf.LIBCMT ref: 000001D327A4CE10
_snprintf.LIBCMT ref: 000001D327A4CE4A
_snprintf.LIBCMT ref: 000001D327A4CE74
free.LIBCMT ref: 000001D327A4D07B

Part of subcall function 000001D327A79428: _errno.LIBCMT ref: 000001D327A79448

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: malloc$_errno_snprintf$_callnewhfreerealloc
String ID:
API String ID: 3710081536-0
Opcode ID: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction ID: 07d97ef18e427c871823c56fe34f8be53e28598586c7f6d16c40478f6a7d8d81
Opcode Fuzzy Hash: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction Fuzzy Hash: 4AE13EB0A146408FFBD5EB28C4527EEB6E1FB84310F50452EA1AAC73D2DB359A45CB53

Function 000001D3260EBF50 Relevance: 7.8, APIs: 6, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 000001D3260F7380: malloc.LIBCMT ref: 000001D3260F7397

malloc.LIBCMT ref: 000001D3260EC04E

Part of subcall function 000001D326118868: _FF_MSGBANNER.LIBCMT ref: 000001D326118898
Part of subcall function 000001D326118868: _NMSG_WRITE.LIBCMT ref: 000001D3261188A2
Part of subcall function 000001D326118868: _callnewh.LIBCMT ref: 000001D3261188D6
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188E1
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188EC

Part of subcall function 000001D326117EEC: malloc.LIBCMT ref: 000001D326117F27

Part of subcall function 000001D326117EEC: realloc.LIBCMT ref: 000001D326117F4E

malloc.LIBCMT ref: 000001D3260EC182
_snprintf.LIBCMT ref: 000001D3260EC210
_snprintf.LIBCMT ref: 000001D3260EC24A
_snprintf.LIBCMT ref: 000001D3260EC274
free.LIBCMT ref: 000001D3260EC47B

Memory Dump Source

Source File: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$_callnewhfreerealloc
String ID:
API String ID: 74200508-0
Opcode ID: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction ID: 743657f865515600994a0d6e4746d0786b620099ad6db535c102a685f18d1f13
Opcode Fuzzy Hash: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction Fuzzy Hash: 0BD17171A1865086F750EB60E4523DE72A5EFC5740F108027B6AA877D6DF3DEA01FB82

Function 000001D327A84424 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000001D327A84451

Part of subcall function 000001D327A7DA24: _FF_MSGBANNER.LIBCMT ref: 000001D327A7DA41
Part of subcall function 000001D327A7DA24: _NMSG_WRITE.LIBCMT ref: 000001D327A7DA4B

_lock.LIBCMT ref: 000001D327A84464
_lock.LIBCMT ref: 000001D327A844BF
_calloc_crt.LIBCMT ref: 000001D327A84576

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction ID: b5f9b820ccbb57104ff1a34a622aea79d6d719d4f81fb8f5a0d7c77ec884c6e3
Opcode Fuzzy Hash: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction Fuzzy Hash: 0351F5B0918B098BEB999F58D8813A9B7D0FB58320F15025EEC5AC73A2D734DD428783

Function 000001D327A454F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D327A4553A

Part of subcall function 000001D327A79468: _FF_MSGBANNER.LIBCMT ref: 000001D327A79498
Part of subcall function 000001D327A79468: _NMSG_WRITE.LIBCMT ref: 000001D327A794A2
Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794D6
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794E1
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794EC

malloc.LIBCMT ref: 000001D327A45545

Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794FC
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A79501

free.LIBCMT ref: 000001D327A4562C
free.LIBCMT ref: 000001D327A45634
free.LIBCMT ref: 000001D327A45640
free.LIBCMT ref: 000001D327A4564D

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction ID: 4b28b1e19ab16f6e8dbaa4b23085c4073c8e4601bbc279c18120c82f03cb3c5e
Opcode Fuzzy Hash: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction Fuzzy Hash: 8F410970618B1D4BEB9AAA2854112FAB2D5FB95320F14012FD497C3343EE21D9038793

Function 000001D327A7BD98 Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001D327A7BDB5

Part of subcall function 000001D327A7F624: _errno.LIBCMT ref: 000001D327A7F62D
Part of subcall function 000001D327A7F624: _invalid_parameter_noinfo.LIBCMT ref: 000001D327A7F638

_errno.LIBCMT ref: 000001D327A7BDC5

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

_errno.LIBCMT ref: 000001D327A7BDE1
_isatty.LIBCMT ref: 000001D327A7BE42
_getbuf.LIBCMT ref: 000001D327A7BE4E

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction ID: 365ca4eecbbb9548d02268bb2252b73d0a9b86b921991acbdfb309c94065f2ae
Opcode Fuzzy Hash: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction Fuzzy Hash: 1251A1F0915A488FEFDADF28C4827E976D0FB55320F14069AE865CB3D6D734CA418B92

Function 000001D327A89BBC Relevance: 7.6, APIs: 5, Instructions: 149COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D327A89BDF

Part of subcall function 000001D327A79468: _FF_MSGBANNER.LIBCMT ref: 000001D327A79498
Part of subcall function 000001D327A79468: _NMSG_WRITE.LIBCMT ref: 000001D327A794A2
Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794D6
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794E1
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794EC

_invoke_watson.LIBCMT ref: 000001D327A89C26
_calloc_crt.LIBCMT ref: 000001D327A89C91
free.LIBCMT ref: 000001D327A89CE3

Part of subcall function 000001D327A84FBC: _errno.LIBCMT ref: 000001D327A84FD4
Part of subcall function 000001D327A84FBC: _invalid_parameter_noinfo.LIBCMT ref: 000001D327A84FE0

free.LIBCMT ref: 000001D327A89D15

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _errno$free$_callnewh_calloc_crt_invalid_parameter_noinfo_invoke_watsonmalloc
String ID:
API String ID: 1496976027-0
Opcode ID: a61f022d04707639bf355da8362fa33aa289f3e9c869973616d516e863df6b36
Instruction ID: e6b7ae2afd6ca2901c27212c6b33b9c669701076a55805265d4dc9198b595427
Opcode Fuzzy Hash: a61f022d04707639bf355da8362fa33aa289f3e9c869973616d516e863df6b36
Instruction Fuzzy Hash: 1841E6B0A28B494FEFC5EF69D4497EAB3D1FB98365F40452EA455C2291DB78C940CB03

Function 000001D327A5CF00 Relevance: 7.6, APIs: 6, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D327A5CF18

Part of subcall function 000001D327A79468: _FF_MSGBANNER.LIBCMT ref: 000001D327A79498
Part of subcall function 000001D327A79468: _NMSG_WRITE.LIBCMT ref: 000001D327A794A2
Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794D6
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794E1
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794EC

_snprintf.LIBCMT ref: 000001D327A5CF38

Part of subcall function 000001D327A79700: _errno.LIBCMT ref: 000001D327A79737
Part of subcall function 000001D327A79700: _invalid_parameter_noinfo.LIBCMT ref: 000001D327A79742

free.LIBCMT ref: 000001D327A5CF57

Part of subcall function 000001D327A79428: _errno.LIBCMT ref: 000001D327A79448

malloc.LIBCMT ref: 000001D327A5CFE0
_snprintf.LIBCMT ref: 000001D327A5D007
free.LIBCMT ref: 000001D327A5D045

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 761449704-0
Opcode ID: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction ID: 1a19ae421c25348598f1ba982524f8d31717b9f7a15096c9be31e9c106633465
Opcode Fuzzy Hash: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction Fuzzy Hash: B8419871618A058FEBC1EB28C495BAA77F1FB9D350F50052EE09AC33A1DB35DA45CB42

Function 000001D3260E48F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D3260E493A

Part of subcall function 000001D326118868: _FF_MSGBANNER.LIBCMT ref: 000001D326118898
Part of subcall function 000001D326118868: _NMSG_WRITE.LIBCMT ref: 000001D3261188A2
Part of subcall function 000001D326118868: _callnewh.LIBCMT ref: 000001D3261188D6
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188E1
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188EC

malloc.LIBCMT ref: 000001D3260E4945

Part of subcall function 000001D326118868: _callnewh.LIBCMT ref: 000001D3261188FC
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D326118901

free.LIBCMT ref: 000001D3260E4A2C
free.LIBCMT ref: 000001D3260E4A34
free.LIBCMT ref: 000001D3260E4A40
free.LIBCMT ref: 000001D3260E4A4D

Memory Dump Source

Source File: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction ID: 1486b6fa774ceb279e546b0595c9af86b57211e6106aaa4de1bce35f54848155
Opcode Fuzzy Hash: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction Fuzzy Hash: 23413432B1839142EA15AF2654002ED7795FF5AF98F498036DD254B741DE38EA06F346

Function 000001D327A846C8 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D327A846D9

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

__doserrno.LIBCMT ref: 000001D327A846D1

Part of subcall function 000001D327A7B6A4: _getptd_noexit.LIBCMT ref: 000001D327A7B6A8

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction ID: ceb177ad924e15fa039fc55b4e160c9ee9238190dea3c9cf61b9a165348b50a8
Opcode Fuzzy Hash: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction Fuzzy Hash: 3901F4F09269484EFEDBAF28CC417D83290FF26335F94424AE1258B3E3E77805408A23

Function 000001D327A533EC Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D327A53404

Part of subcall function 000001D327A79468: _FF_MSGBANNER.LIBCMT ref: 000001D327A79498
Part of subcall function 000001D327A79468: _NMSG_WRITE.LIBCMT ref: 000001D327A794A2
Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794D6
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794E1
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794EC

_snprintf.LIBCMT ref: 000001D327A5342E

Part of subcall function 000001D327A79700: _errno.LIBCMT ref: 000001D327A79737
Part of subcall function 000001D327A79700: _invalid_parameter_noinfo.LIBCMT ref: 000001D327A79742

remove.LIBCMT ref: 000001D327A5343F
remove.LIBCMT ref: 000001D327A5344B
free.LIBCMT ref: 000001D327A53455

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction ID: 346a6557e2a1bc6028294109a4dc539096c54597e1685e09313049ee53a5b8e2
Opcode Fuzzy Hash: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction Fuzzy Hash: F2011AB08287449BE685EB18C845BDDB7E1FBD8311F80042EA485C2391CB349640C743

Function 000001D326123AC8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D326123AD9

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

__doserrno.LIBCMT ref: 000001D326123AD1

Part of subcall function 000001D32611AAA4: _getptd_noexit.LIBCMT ref: 000001D32611AAA8

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction ID: c2125c0de57f217d7828be10e89c034d0e0034b52f3c6daedd7b616a81800b66
Opcode Fuzzy Hash: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction Fuzzy Hash: 5D0169B2E15A9481EA055F19D8933E82A919F90B71F558356DA3A073E2C72C7600E223

Function 000001D3260F27EC Relevance: 7.5, APIs: 5, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D3260F2804

Part of subcall function 000001D326118868: _FF_MSGBANNER.LIBCMT ref: 000001D326118898
Part of subcall function 000001D326118868: _NMSG_WRITE.LIBCMT ref: 000001D3261188A2
Part of subcall function 000001D326118868: _callnewh.LIBCMT ref: 000001D3261188D6
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188E1
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188EC

_snprintf.LIBCMT ref: 000001D3260F282E

Part of subcall function 000001D326118B00: _errno.LIBCMT ref: 000001D326118B37
Part of subcall function 000001D326118B00: _invalid_parameter_noinfo.LIBCMT ref: 000001D326118B42

remove.LIBCMT ref: 000001D3260F283F
remove.LIBCMT ref: 000001D3260F284B
free.LIBCMT ref: 000001D3260F2855

Memory Dump Source

Source File: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction ID: 0f6f823627f51d11eb2f0e5384e2bde563698cd4540fc0ccb82ebc260adc7044
Opcode Fuzzy Hash: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction Fuzzy Hash: E3F0FF72938B8086D680EB51F45239EB764FFC4B80F405117B69E53B99CF78E611EB41

Function 000001D327A768D4 Relevance: 6.5, APIs: 5, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D327A76917
free.LIBCMT ref: 000001D327A7693C

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction ID: 197fbdebfabed3a958e430875052a38ad8f943a68cb6f257f963448cff458d44
Opcode Fuzzy Hash: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction Fuzzy Hash: D59129B1A087448FEBA5EF28C4557DEB7E1FB89310F50092EA09AC3391DB759A45C743

Function 000001D326115CD4 Relevance: 6.4, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D326115D17
free.LIBCMT ref: 000001D326115D3C

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction ID: 0598a2c53f4ee3e6d4fb01874039e87db4c90402f747babc5f1b70524e25ac6e
Opcode Fuzzy Hash: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction Fuzzy Hash: 5981DA32A186808BE760DF25E4423DEB7A1FB85740F504427E69983A99DF7DF644EF02

Function 000001D327A792BC Relevance: 6.3, APIs: 5, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D327A792D6

Part of subcall function 000001D327A79468: _FF_MSGBANNER.LIBCMT ref: 000001D327A79498
Part of subcall function 000001D327A79468: _NMSG_WRITE.LIBCMT ref: 000001D327A794A2
Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794D6
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794E1
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794EC

malloc.LIBCMT ref: 000001D327A792F5

Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794FC
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A79501

malloc.LIBCMT ref: 000001D327A7932C
_snprintf.LIBCMT ref: 000001D327A79358

Part of subcall function 000001D327A79700: _errno.LIBCMT ref: 000001D327A79737
Part of subcall function 000001D327A79700: _invalid_parameter_noinfo.LIBCMT ref: 000001D327A79742

malloc.LIBCMT ref: 000001D327A7939B

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction ID: 78a328aa24d3c443a464a225371084ea104a905314fa0a492afae58b91b67f5b
Opcode Fuzzy Hash: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction Fuzzy Hash: AF31DA7451CB489FDB84EF18C054A9AB7E1FB9C315F100A6EA49DD73A1DB34DA41CB42

Function 000001D3261186BC Relevance: 6.3, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D3261186D6

Part of subcall function 000001D326118868: _FF_MSGBANNER.LIBCMT ref: 000001D326118898
Part of subcall function 000001D326118868: _NMSG_WRITE.LIBCMT ref: 000001D3261188A2
Part of subcall function 000001D326118868: _callnewh.LIBCMT ref: 000001D3261188D6
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188E1
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188EC

malloc.LIBCMT ref: 000001D3261186F5

Part of subcall function 000001D326118868: _callnewh.LIBCMT ref: 000001D3261188FC
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D326118901

malloc.LIBCMT ref: 000001D32611872C
_snprintf.LIBCMT ref: 000001D326118758

Part of subcall function 000001D326118B00: _errno.LIBCMT ref: 000001D326118B37
Part of subcall function 000001D326118B00: _invalid_parameter_noinfo.LIBCMT ref: 000001D326118B42

malloc.LIBCMT ref: 000001D32611879B

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction ID: b17103b26d502f5c14c57d439bdaf38d68334a1de098d640ce9ca312b1ac74bb
Opcode Fuzzy Hash: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction Fuzzy Hash: E421C776608B8486DA60DB16E49125EB7A0F7CCB98F104216EEDD43BA8CF3CD651CF40

Function 000001D327A7A1F4 Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D327A7A22C

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

_invalid_parameter_noinfo.LIBCMT ref: 000001D327A7A237
_flush.LIBCMT ref: 000001D327A7A2E9
_fileno.LIBCMT ref: 000001D327A7A30A

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction ID: d112a32c4a7b41bea7171e6188dc2e8e098da6223034bc0c8570cd018d5c8b0b
Opcode Fuzzy Hash: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction Fuzzy Hash: DC51B4B0A18F095AEAEA5A6D58463F972C1F759320F14022F946BC33E2EB71DD4245CB

Function 000001D3261195F4 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D32611962C

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001D326119637
_flush.LIBCMT ref: 000001D3261196E9
_fileno.LIBCMT ref: 000001D32611970A

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction ID: e6f1994db12d98c352d357589f728813dcce9931e9f5080ba65431567be93ca7
Opcode Fuzzy Hash: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction Fuzzy Hash: B5415831B0438446FE288E2365423DEB691BF44FE0F084AA2DE7547BC9DA38F741E642

Function 000001D327A410D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000001D327A41117
clock.LIBCMT ref: 000001D327A41124
clock.LIBCMT ref: 000001D327A4112D
clock.LIBCMT ref: 000001D327A4113A

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: 730bad3e03fb8b94ac7162989eb6797d39954b1c6ec2acc32451168edf365428
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: 7421C9B1C0C7084AEBE5ABACE4422A6B6D0F755360F15022FE9A693342EB519D4282D7

Function 000001D327A89728 Relevance: 6.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001D327A8974C

Part of subcall function 000001D327A7BF24: _getptd.LIBCMT ref: 000001D327A7BF3A
Part of subcall function 000001D327A7BF24: __updatetlocinfo.LIBCMT ref: 000001D327A7BF6F
Part of subcall function 000001D327A7BF24: __updatetmbcinfo.LIBCMT ref: 000001D327A7BF96

_errno.LIBCMT ref: 000001D327A89758

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

_invalid_parameter_noinfo.LIBCMT ref: 000001D327A89763
strchr.LIBCMT ref: 000001D327A89779

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction ID: 6d9360eae796fc236bf61df85fd1cf44be6a4904e8deee9daac9ccf988d2a11e
Opcode Fuzzy Hash: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction Fuzzy Hash: EB210AF0D186654EEFE6AF2850883BA76D1F749335F04066BA0B6C73D1DB608A41CA53

Function 000001D327A79CB4 Relevance: 6.1, APIs: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 000001D327A79CD1

Part of subcall function 000001D327A7E110: _FindPESection.LIBCMT ref: 000001D327A7E139

_initp_misc_cfltcvt_tab.LIBCMT ref: 000001D327A79CE2
_initterm_e.LIBCMT ref: 000001D327A79CF5
_IsNonwritableInCurrentImage.LIBCMT ref: 000001D327A79D3E

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: CurrentImageNonwritable$FindSection_initp_misc_cfltcvt_tab_initterm_e
String ID:
API String ID: 1991439119-0
Opcode ID: 20d8fef81f8701dc950607fd9be9d74995b121df42281fa78a048c32d55c9c51
Instruction ID: 458f3054c6e0a277594d2aa1ea22296132d69aa01cf7cdcede471a7a18a70b37
Opcode Fuzzy Hash: 20d8fef81f8701dc950607fd9be9d74995b121df42281fa78a048c32d55c9c51
Instruction Fuzzy Hash: EF1194715159094BFF97AB24DCC97DE73A4FB5C321F40492B9412C61A2EF348A44C746

Function 000001D3260E04D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

clock.LIBCMT ref: 000001D3260E0517
clock.LIBCMT ref: 000001D3260E0524
clock.LIBCMT ref: 000001D3260E052D
clock.LIBCMT ref: 000001D3260E053A

Memory Dump Source

Source File: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: 25e888e24eee3bb84ea3600e50d88932d910add92f4ee5051409c163d65b5abd
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: BC113A33D08BA441F3B09FB67840BAFB690FF45390F199027EE6643245E934D995E682

Function 000001D326128B28 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001D326128B4C

Part of subcall function 000001D32611B324: _getptd.LIBCMT ref: 000001D32611B33A
Part of subcall function 000001D32611B324: __updatetlocinfo.LIBCMT ref: 000001D32611B36F
Part of subcall function 000001D32611B324: __updatetmbcinfo.LIBCMT ref: 000001D32611B396

_errno.LIBCMT ref: 000001D326128B58

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001D326128B63
strchr.LIBCMT ref: 000001D326128B79

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction ID: 5eba91c365babe1aad4d2074cec509da5d017af7c5c9134f08345f486b3d842e
Opcode Fuzzy Hash: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction Fuzzy Hash: CB2127B2E082F445EBE0561590523FD6AD0EB40BD4F1CC12BEAB707AC5D92CF645E712

Function 000001D3260F70FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000001D3260F7380: malloc.LIBCMT ref: 000001D3260F7397

strrchr.LIBCMT ref: 000001D3260F71F2
_snprintf.LIBCMT ref: 000001D3260F730C

Strings

:, xrefs: 000001D3260F734F

Memory Dump Source

Source File: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintfmallocstrrchr
String ID: :
API String ID: 3587327836-336475711
Opcode ID: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction ID: 674a18d6b4646ac543898604e66f398a4e2d7759b0d8518accd16ee2222d64ec
Opcode Fuzzy Hash: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction Fuzzy Hash: DE612932619A8486E750DF25F88139EB7A0F7C6B90F108116FADE47BA9CF78D940DB41

Function 000001D327A5B940 Relevance: 5.3, APIs: 4, Instructions: 321COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D327A5B9AA

Part of subcall function 000001D327A79468: _FF_MSGBANNER.LIBCMT ref: 000001D327A79498
Part of subcall function 000001D327A79468: _NMSG_WRITE.LIBCMT ref: 000001D327A794A2
Part of subcall function 000001D327A79468: _callnewh.LIBCMT ref: 000001D327A794D6
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794E1
Part of subcall function 000001D327A79468: _errno.LIBCMT ref: 000001D327A794EC

free.LIBCMT ref: 000001D327A5BDE3

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction ID: 70d78b6f69a7438085d1596e7d94fa0443131a1409c62123ed6b28113be35ae2
Opcode Fuzzy Hash: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction Fuzzy Hash: 46D11AB0A597859FDBA5DB18C0447EBB7E0FB9A365F90192EA5C9C3350DB319880CB07

Function 000001D327A79924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D327A79975

Part of subcall function 000001D327A7B714: _getptd_noexit.LIBCMT ref: 000001D327A7B718

_invalid_parameter_noinfo.LIBCMT ref: 000001D327A79980

Strings

B, xrefs: 000001D327A799AC

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction ID: bb269a42dcda1bfbd69ecde5331f9e5e1c6755512615d8e137ef66a358387754
Opcode Fuzzy Hash: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction Fuzzy Hash: E711B270618B084FEB84EF5C94857E9B2D5FB98335F10476EA029C32A1DB34C940CB82

Function 000001D3261212F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__crtCapturePreviousContext.LIBCMT ref: 000001D3261217B5
__raise_securityfailure.LIBCMT ref: 000001D326121857

Strings

sv-FI, xrefs: 000001D326121850

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: CaptureContextPrevious__crt__raise_securityfailure
String ID: sv-FI
API String ID: 37250909-2947700294
Opcode ID: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction ID: 6df72a15d60365cd6948bbb1a6bbc35e6b71bd15902463ea6a2d22ea492c1ffa
Opcode Fuzzy Hash: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction Fuzzy Hash: C8210034A04B0482EB009B18E8533D567A5FB84348FA00127EAAE877A1DF3CF614E302

Function 000001D326118D24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D326118D75

Part of subcall function 000001D32611AB14: _getptd_noexit.LIBCMT ref: 000001D32611AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001D326118D80

Strings

B, xrefs: 000001D326118DAC

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction ID: 2402d22f51adbd1f9e02240c6095ee344d39d6ea098a897d410ba247b597e1c6
Opcode Fuzzy Hash: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction Fuzzy Hash: 9111C872A1474486EB10DF56E4413D9B661FB98FE4F548352AF68077D6CF38E241CB01

Function 000001D3260E10C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMON

Download Yara Rule

APIs

calloc.LIBCMT ref: 000001D3260E116A

Part of subcall function 000001D326128358: _calloc_impl.LIBCMT ref: 000001D326128368
Part of subcall function 000001D326128358: _errno.LIBCMT ref: 000001D32612837B
Part of subcall function 000001D326128358: _errno.LIBCMT ref: 000001D326128385

free.LIBCMT ref: 000001D3260E12F3
free.LIBCMT ref: 000001D3260E12FD
free.LIBCMT ref: 000001D3260E130F

Memory Dump Source

Source File: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction ID: 35b07b71d3c8a9130c03ce33c771d35dc946d7c0368ddbdb138ffae06a00cc1a
Opcode Fuzzy Hash: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction Fuzzy Hash: 4FC14F32608B948AE764CF65E88039E77F4F789B84F10812AEB8D83B58DF38D555DB40

Function 000001D3260FAD40 Relevance: 5.2, APIs: 4, Instructions: 234COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D3260FADAA

Part of subcall function 000001D326118868: _FF_MSGBANNER.LIBCMT ref: 000001D326118898
Part of subcall function 000001D326118868: _NMSG_WRITE.LIBCMT ref: 000001D3261188A2
Part of subcall function 000001D326118868: _callnewh.LIBCMT ref: 000001D3261188D6
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188E1
Part of subcall function 000001D326118868: _errno.LIBCMT ref: 000001D3261188EC

free.LIBCMT ref: 000001D3260FB1E3

Memory Dump Source

Source File: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction ID: 77a85c69be794e9aecd6fa694004e86fe59c2dfcb46a94fdd64637904a111b8d
Opcode Fuzzy Hash: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction Fuzzy Hash: 92C1E8B665C6C0CAD7B0CB15E48039FB7A0FB8A794F50511AEB8A43B58DB39C540EF06

Function 000001D327A44300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D327A44363

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction ID: f663172f7446c7feb77f43c37d44a2cd7c64a336b95c488b42dadfb351c73e29
Opcode Fuzzy Hash: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction Fuzzy Hash: F851A8B0A1CA054BEF999F2894952A973D1FB98320F10455EE86BC3386EF31ED428646

Function 000001D3260EEFEC Relevance: 5.1, APIs: 4, Instructions: 144COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001D3260EF0A9
_snprintf.LIBCMT ref: 000001D3260EF0C9
_snprintf.LIBCMT ref: 000001D3260EF19A

Memory Dump Source

Source File: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction ID: 25396497b68483b4ca226d1c591aedbfe0b9fc9cd82c19766e096e311198c269
Opcode Fuzzy Hash: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction Fuzzy Hash: AA813A32608AC486EB209B50F4413DAB761FBC5794F504217DAAE43BA9DF38E645EB41

Function 000001D3260E3700 Relevance: 5.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D3260E3763

Memory Dump Source

Source File: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction ID: 1269e91f9666d7b51ccf81f5b2db8dff66854ac158f0e8193e48a2309f8ca5f9
Opcode Fuzzy Hash: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction Fuzzy Hash: 0541C132A0879087EB58DB26A5106AD3BA1FB45B84F408426DE6A87785DF34EA05F741

Function 000001D327A77594 Relevance: 5.1, APIs: 4, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001D327A7761F
_snprintf.LIBCMT ref: 000001D327A77644
_snprintf.LIBCMT ref: 000001D327A776A4
_snprintf.LIBCMT ref: 000001D327A776C9

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: c83ad5d08b82b77088db20421ebfa40476c0ffae07ff14779cb37314aafa096a
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: 22415170518A498FEB92EB1CD844BDA77E0F798320F50452BA49AC33E4DB34DA45CB43

Function 000001D327A77D04 Relevance: 5.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D327A77D4E
strtok.LIBCMT ref: 000001D327A77DAC
strtok.LIBCMT ref: 000001D327A77DBE
free.LIBCMT ref: 000001D327A77DD7

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction ID: 0067c181de398a0b0bfff6fa19c04472ce5c14678afbe8e6b8e5bd5bb7528f7a
Opcode Fuzzy Hash: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction Fuzzy Hash: 6D31E170918B4D9FEBD5FB18C484BA977E1FB99325F50061EA49AC33A1D734D941CB02

Function 000001D326116994 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001D326116A1F
_snprintf.LIBCMT ref: 000001D326116A44
_snprintf.LIBCMT ref: 000001D326116AA4
_snprintf.LIBCMT ref: 000001D326116AC9

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: be636fcbb385b7a15b0f341fd1ffbe7e7e5bd3b95e29963819f52c4d9db4653d
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: 44314D35A14A8482E6208B11F4423DA7770FB88BA4F604217EABD43BF4CF3DE641DB42

Function 000001D326117104 Relevance: 5.0, APIs: 4, Instructions: 50stringCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D32611714E
strtok.LIBCMT ref: 000001D3261171AC
strtok.LIBCMT ref: 000001D3261171BE
free.LIBCMT ref: 000001D3261171D7

Memory Dump Source

Source File: 00000008.00000003.2709168077.000001D3260FD000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D3260E0000, based on PE: true

Associated: 00000008.00000003.2709024126.000001D3260E0000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2709168077.000001D32613C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_1d3260e0000_rundll32.jbxd

Yara matches

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction ID: 0a01f6fa8f89c9721730c5badd849f4a0234059dfd34b4ba6205d39da7b66f22
Opcode Fuzzy Hash: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction Fuzzy Hash: 5921ED32914B4485EA609B15F85239A6771FB85BA4F501357EABE437E5CF3CF240DB01

Function 000001D327A793B8 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000001D327A793D8

Part of subcall function 000001D327A79428: _errno.LIBCMT ref: 000001D327A79448

free.LIBCMT ref: 000001D327A793E6
free.LIBCMT ref: 000001D327A793F4
free.LIBCMT ref: 000001D327A793FE

Memory Dump Source

Source File: 00000008.00000002.2712251805.000001D327A41000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D327A41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1d327a41000_rundll32.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction ID: e54fad829a49b766f1c930fb7f92b4c115a2b35a8b7dfebc9720e5201c0fb6bb
Opcode Fuzzy Hash: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction Fuzzy Hash: 46F02874528948AFDAC9FB18C496EDD77E1FB9C310F80145AB059C73A2DA34E940CB16

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 105vjMVwfJ.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Answers

Statistics

CPU Usage

Windows Analysis Report
105vjMVwfJ.dll