Edit tour

Windows Analysis Report
pH6L2VWRbU.dll

Overview

General Information

Sample name:	pH6L2VWRbU.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original sample name:	8923ca4504d75400cf80ed71f381c0b4a3086ec7c8dcfba678e3dc8922042d6c.exe
Analysis ID:	1573676
MD5:	3f3abfe2d3837ec045140a4b1aa5f1bd
SHA1:	d2954695e4f504b6e8f8f344824283457284c28a
SHA256:	8923ca4504d75400cf80ed71f381c0b4a3086ec7c8dcfba678e3dc8922042d6c
Tags:	bootstrap8444-bitmessage-orgexeuser-JAMESWT_MHT
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Found API chain indicative of debugger detection

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7628 cmdline: loaddll64.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 7636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7676 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 7700 cmdline: rundll32.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7684 cmdline: rundll32.exe C:\Users\user\Desktop\pH6L2VWRbU.dll,Init MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7820 cmdline: rundll32.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll",Init MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: pH6L2VWRbU.dll

ReversingLabs: Detection: 18%

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB667380 BCryptGenRandom,SetLastError,SetLastError,	3_2_00007FFDFB667380
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB667330 BCryptCloseAlgorithmProvider,	3_2_00007FFDFB667330
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB667510 BCryptGenRandom,BCryptCloseAlgorithmProvider,SetLastError,	3_2_00007FFDFB667510

Source: pH6L2VWRbU.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\lt-LT\T\orer\CacheStorage\57C8EDB95DF3F0AD4EE2DC2B8CFD41576krnlmp.pdbles\a\ source: rundll32.exe, 00000004.00000003.2237576807.000002615F7FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFrameworkpUpr\Application Data\Application Data\Desktop\\krnlmp.pdbles\a\ source: rundll32.exe, 00000004.00000003.2260721049.000002615F7FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: directory_iterator::directory_iterator: unknown error: "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportArchive\NonCritical_OneDriveSetup.ex_2784e9272a94674726857b0ca955e26e945cd6_00000000_fd232c02-2c1f-427a-a0ea-313316b2b6cf"es\Application Data\Application Data\Desktop\\krnlmp.pdbles\a\ source: rundll32.exe, 00000004.00000003.2267477845.000002615F7FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\ARM\Acrobat_23.006.20320krnlmp.pdbles\*a\ source: rundll32.exe, 00000004.00000002.4202040012.000002615F7FF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2273287316.000002615F7FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdblogion Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Saf source: rundll32.exe, 00000004.00000003.2245331197.000002615D952000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\rundll32.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: a:	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB672048 FindClose,FindFirstFileExW,GetLastError,		3_2_00007FFDFB672048
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6720F8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		3_2_00007FFDFB6720F8

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 14.161.21.105 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 31.29.184.175 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 194.164.163.84 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 1.36.218.247 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 24.177.238.115 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 5.50.197.206 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 5.227.186.88 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 20.191.110.180 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 5.227.176.233 8444	Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 194.164.163.84:8444
Source: global traffic	TCP traffic: 192.168.2.4:49732 -> 1.36.218.247:8444
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 5.50.197.206:8444
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 5.227.176.233:8444
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 5.227.186.88:8444
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 14.161.21.105:8444
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 20.191.110.180:8444
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 24.177.238.115:8444
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 31.29.184.175:8444

Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN
Source: Joe Sandbox View	ASN Name: COMSTAR-VOLGA-ARZAMASRU COMSTAR-VOLGA-ARZAMASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 1.36.218.247
Source: unknown	TCP traffic detected without corresponding DNS query: 1.36.218.247
Source: unknown	TCP traffic detected without corresponding DNS query: 5.50.197.206
Source: unknown	TCP traffic detected without corresponding DNS query: 5.50.197.206
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.176.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.176.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.186.88
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.186.88
Source: unknown	TCP traffic detected without corresponding DNS query: 14.161.21.105
Source: unknown	TCP traffic detected without corresponding DNS query: 14.161.21.105
Source: unknown	TCP traffic detected without corresponding DNS query: 24.177.238.115
Source: unknown	TCP traffic detected without corresponding DNS query: 24.177.238.115
Source: unknown	TCP traffic detected without corresponding DNS query: 1.36.218.247
Source: unknown	TCP traffic detected without corresponding DNS query: 1.36.218.247
Source: unknown	TCP traffic detected without corresponding DNS query: 5.50.197.206
Source: unknown	TCP traffic detected without corresponding DNS query: 5.50.197.206
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.176.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.176.233
Source: unknown	TCP traffic detected without corresponding DNS query: 1.36.218.247
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.176.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.50.197.206
Source: unknown	TCP traffic detected without corresponding DNS query: 1.36.218.247
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.176.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.50.197.206
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.186.88
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.186.88
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.186.88
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.186.88
Source: unknown	TCP traffic detected without corresponding DNS query: 14.161.21.105
Source: unknown	TCP traffic detected without corresponding DNS query: 14.161.21.105
Source: unknown	TCP traffic detected without corresponding DNS query: 14.161.21.105
Source: unknown	TCP traffic detected without corresponding DNS query: 14.161.21.105
Source: unknown	TCP traffic detected without corresponding DNS query: 24.177.238.115
Source: unknown	TCP traffic detected without corresponding DNS query: 24.177.238.115
Source: unknown	TCP traffic detected without corresponding DNS query: 24.177.238.115
Source: unknown	TCP traffic detected without corresponding DNS query: 24.177.238.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.50.197.206
Source: unknown	TCP traffic detected without corresponding DNS query: 5.50.197.206
Source: unknown	TCP traffic detected without corresponding DNS query: 1.36.218.247
Source: unknown	TCP traffic detected without corresponding DNS query: 5.50.197.206
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.176.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.186.88
Source: unknown	TCP traffic detected without corresponding DNS query: 14.161.21.105
Source: unknown	TCP traffic detected without corresponding DNS query: 24.177.238.115
Source: unknown	TCP traffic detected without corresponding DNS query: 1.36.218.247
Source: unknown	TCP traffic detected without corresponding DNS query: 1.36.218.247
Source: unknown	TCP traffic detected without corresponding DNS query: 5.50.197.206
Source: unknown	TCP traffic detected without corresponding DNS query: 5.50.197.206
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.176.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.227.176.233

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FFDFB636F10 recv,WSAGetLastError,

3_2_00007FFDFB636F10

Source: global traffic

DNS traffic detected: DNS query: bootstrap8444.bitmessage.org

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB61B910	3_2_00007FFDFB61B910
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB624FF0	3_2_00007FFDFB624FF0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB60D170	3_2_00007FFDFB60D170
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB69D0C0	3_2_00007FFDFB69D0C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6720F8	3_2_00007FFDFB6720F8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6237B0	3_2_00007FFDFB6237B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB692BD8	3_2_00007FFDFB692BD8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB622BB0	3_2_00007FFDFB622BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB689B7C	3_2_00007FFDFB689B7C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB621AC0	3_2_00007FFDFB621AC0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB65AAC0	3_2_00007FFDFB65AAC0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB685ACC	3_2_00007FFDFB685ACC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB617AA0	3_2_00007FFDFB617AA0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB632A90	3_2_00007FFDFB632A90
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB62AA90	3_2_00007FFDFB62AA90
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB65AA60	3_2_00007FFDFB65AA60
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB64BB10	3_2_00007FFDFB64BB10
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB640B00	3_2_00007FFDFB640B00
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6529B0	3_2_00007FFDFB6529B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB656A30	3_2_00007FFDFB656A30
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB69CA24	3_2_00007FFDFB69CA24
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB61CA10	3_2_00007FFDFB61CA10
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB620860	3_2_00007FFDFB620860
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB68A930	3_2_00007FFDFB68A930
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB61D900	3_2_00007FFDFB61D900
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6228E0	3_2_00007FFDFB6228E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB61CFC0	3_2_00007FFDFB61CFC0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB621FA0	3_2_00007FFDFB621FA0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB68BF70	3_2_00007FFDFB68BF70
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB63AEB0	3_2_00007FFDFB63AEB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB622E90	3_2_00007FFDFB622E90
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB668E90	3_2_00007FFDFB668E90
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB620E80	3_2_00007FFDFB620E80
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB63FF50	3_2_00007FFDFB63FF50
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB68DF3C	3_2_00007FFDFB68DF3C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB685F04	3_2_00007FFDFB685F04
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB650EE0	3_2_00007FFDFB650EE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB61FD60	3_2_00007FFDFB61FD60
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB634E50	3_2_00007FFDFB634E50
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB602E10	3_2_00007FFDFB602E10
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB63ACD0	3_2_00007FFDFB63ACD0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB668CA0	3_2_00007FFDFB668CA0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB64AC80	3_2_00007FFDFB64AC80
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB684D20	3_2_00007FFDFB684D20
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB69ACE8	3_2_00007FFDFB69ACE8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6683D0	3_2_00007FFDFB6683D0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6843BC	3_2_00007FFDFB6843BC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB636390	3_2_00007FFDFB636390
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB68543C	3_2_00007FFDFB68543C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB64E420	3_2_00007FFDFB64E420
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB60C260	3_2_00007FFDFB60C260
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB637350	3_2_00007FFDFB637350
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB694324	3_2_00007FFDFB694324
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6881B9	3_2_00007FFDFB6881B9
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6841B8	3_2_00007FFDFB6841B8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB63A190	3_2_00007FFDFB63A190
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB635160	3_2_00007FFDFB635160
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6330B0	3_2_00007FFDFB6330B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6850B8	3_2_00007FFDFB6850B8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6690A6	3_2_00007FFDFB6690A6
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB69306C	3_2_00007FFDFB69306C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6337C0	3_2_00007FFDFB6337C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6647C0	3_2_00007FFDFB6647C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB66A7A0	3_2_00007FFDFB66A7A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB64D7A0	3_2_00007FFDFB64D7A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB64A7A0	3_2_00007FFDFB64A7A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB679760	3_2_00007FFDFB679760
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB668760	3_2_00007FFDFB668760
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB669768	3_2_00007FFDFB669768
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB628810	3_2_00007FFDFB628810
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB67B6C0	3_2_00007FFDFB67B6C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB634750	3_2_00007FFDFB634750
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6936EC	3_2_00007FFDFB6936EC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6845C0	3_2_00007FFDFB6845C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6185E0	3_2_00007FFDFB6185E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB622480	3_2_00007FFDFB622480
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB63B470	3_2_00007FFDFB63B470
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB65D520	3_2_00007FFDFB65D520
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB66E510	3_2_00007FFDFB66E510
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB64B4F0	3_2_00007FFDFB64B4F0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6694E8	3_2_00007FFDFB6694E8

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFDFB609F60 appears 33 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFDFB61C770 appears 36 times

Source: classification engine

Classification label: mal60.evad.winDLL@10/1@1/9

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\user\Desktop\inventory

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7636:120:WilError_03

Source: pH6L2VWRbU.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pH6L2VWRbU.dll,Init

Source: pH6L2VWRbU.dll

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pH6L2VWRbU.dll,Init
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll",Init
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\pH6L2VWRbU.dll,Init	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll",Init	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll			Jump to behavior

Source: pH6L2VWRbU.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: pH6L2VWRbU.dll

Static file information: File size 1098752 > 1048576

Source: pH6L2VWRbU.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: pH6L2VWRbU.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: pH6L2VWRbU.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: pH6L2VWRbU.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: pH6L2VWRbU.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: pH6L2VWRbU.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: pH6L2VWRbU.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: pH6L2VWRbU.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\lt-LT\T\orer\CacheStorage\57C8EDB95DF3F0AD4EE2DC2B8CFD41576krnlmp.pdbles\a\ source: rundll32.exe, 00000004.00000003.2237576807.000002615F7FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFrameworkpUpr\Application Data\Application Data\Desktop\\krnlmp.pdbles\a\ source: rundll32.exe, 00000004.00000003.2260721049.000002615F7FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: directory_iterator::directory_iterator: unknown error: "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportArchive\NonCritical_OneDriveSetup.ex_2784e9272a94674726857b0ca955e26e945cd6_00000000_fd232c02-2c1f-427a-a0ea-313316b2b6cf"es\Application Data\Application Data\Desktop\\krnlmp.pdbles\a\ source: rundll32.exe, 00000004.00000003.2267477845.000002615F7FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\ARM\Acrobat_23.006.20320krnlmp.pdbles\*a\ source: rundll32.exe, 00000004.00000002.4202040012.000002615F7FF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2273287316.000002615F7FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdblogion Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Saf source: rundll32.exe, 00000004.00000003.2245331197.000002615D952000.00000004.00000020.00020000.00000000.sdmp

Source: pH6L2VWRbU.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: pH6L2VWRbU.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: pH6L2VWRbU.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: pH6L2VWRbU.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: pH6L2VWRbU.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FFDFB6107FC push rbp; iretd

3_2_00007FFDFB6107FD

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 797	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 2085	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 391	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 756	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 852	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_3-50254

Source: C:\Windows\System32\loaddll64.exe TID: 7632	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7728	Thread sleep count: 797 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7716	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7732	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7716	Thread sleep count: 2085 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7732	Thread sleep count: 391 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7732	Thread sleep count: 220 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7732	Thread sleep count: 315 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7732	Thread sleep count: 342 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7732	Thread sleep count: 93 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7740	Thread sleep count: 756 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7736	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7748	Thread sleep count: 273 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7748	Thread sleep count: 293 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7748	Thread sleep count: 318 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7748	Thread sleep count: 277 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7748	Thread sleep count: 56 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7748	Thread sleep count: 231 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7840	Thread sleep count: 852 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7836	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7844	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7844	Thread sleep count: 112 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7844	Thread sleep count: 77 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7844	Thread sleep count: 231 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7844	Thread sleep count: 75 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7844	Thread sleep count: 182 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7844	Thread sleep count: 156 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7844	Thread sleep count: 165 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7844	Thread sleep count: 196 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB672048 FindClose,FindFirstFileExW,GetLastError,		3_2_00007FFDFB672048
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6720F8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		3_2_00007FFDFB6720F8

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: rundll32.exe, 00000005.00000003.1887910801.000002D302596000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-lun-parser_31bf3856ad364e35_10.0.19041.1_none_b6d8bfc73f89cc96
Source: rundll32.exe, 00000005.00000003.1887910801.000002D302596000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-pvhd-parser_31bf3856ad364e35_10.0.19041.1645_none_fe1307608fa06d8c
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364;
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-v..ck-virtualizationv2_31bf3856ad364e35_10.0.19041.1_none_25a2ff96aac272dd
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.19041.1741_none_1bf0e7c12b78479b\r1\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f0441379
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1909066385.000002D3025BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1920379752.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920\rPc
Source: rundll32.exe, 00000003.00000003.1873712596.000002C9DF0F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\r6ce2\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66\f\\*
Source: rundll32.exe, 00000005.00000003.1849480439.000002D3040CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\f1125d
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b\f\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920\f\*
Source: rundll32.exe, 00000005.00000003.1887910801.000002D302596000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920a2
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c\*
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug.resources_31bf3856ad364e35_10.0.19041.1_en-us_5ee8ada67d246bda
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f0441379\X
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f4751718744
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de
Source: rundll32.exe, 00000005.00000003.1887910801.000002D302596000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7c
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug_3
Source: rundll32.exe, 00000005.00000003.1849480439.000002D3040CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\f5fec1\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8\r\\*=
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-v..nthfcvdev.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ca4b4247e291981H
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de0
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135\*
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e22f8x
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: S\amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41b\r6171
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41b\r*d3
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vsQ
Source: rundll32.exe, 00000004.00000003.1901513130.000002615D9A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920\f
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920\fWb
Source: rundll32.exe, 00000003.00000003.1873712596.000002C9DF0F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\r15ba\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66\a\*/b
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf38M
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b
Source: rundll32.exe, 00000005.00000003.1849480439.000002D3040CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\rbe
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp.resources_31bf3856ad364e35_10.0.19041.1_en-us_369e8b635061fdb3
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-deb
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920\r\lc
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vidq
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-v..izationv2.resources_31bf3856ad364e35_10.0.19041.1_en-gb_7788797720472f2d\\*
Source: rundll32.exe, 00000005.00000003.1891196628.000002D302597000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887910801.000002D302596000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-ram-parser_31bf3856ad364e35_10.0.19041.1_none_a7bb53746630ebd3bd5[
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda\f\
Source: rundll32.exe, 00000003.00000003.1873712596.000002C9DF0F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\f\\Df
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8\f\*
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e22f8
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c6\*
Source: rundll32.exe, 00000005.00000003.1909066385.000002D3025BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1920379752.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..apinabout.resources_31bf3856ad364e35_10.0.19041.1_en-us_d314f4eb3925c8b5\*
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-v..izationv2.resources_31bf3856ad364e35_10.0.19041.1_en-gb_7788797720472f2dH
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.19041.1741_none_1bf0e7c12b78479b
Source: rundll32.exe, 00000003.00000003.1873712596.000002C9DF0F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\f\fc1\*$d
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06\*]
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-h..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddaeabc80a3525d6
Source: rundll32.exe, 00000003.00000003.1873712596.000002C9DF0F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\fb1
Source: rundll32.exe, 00000003.00000003.1873712596.000002C9DF0F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\r9485\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8\f
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f4751718744\p
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-ram-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_50c23e4c771f203a
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vid_31b
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f47517187443a\**
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..t-remotefilebrowser_31bf3856ad364e35_10.0.19041.746_none_6fbcad1699b89a67=
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79\r\vmbkmclr.sysb3\*P
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7\r7\**
Source: rundll32.exe, 00000004.00000003.1901513130.000002615D9A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: S\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66\r\
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-synthfcvdev_31bf3856ad364e35_10.0.19041.1741_none_b365912b94b35a98\r\*
Source: rundll32.exe, 00000005.00000003.1783977136.000002D3042B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\wow64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.1_none_97e0d8d7edeea164r\*
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364m
Source: rundll32.exe, 00000003.00000003.1873712596.000002C9DF0F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\r\*
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.867_none_b57fce26790eec1389a67
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b\r\*
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-v..edstorage.resources_31bf3856ad364e35_10.0.19041.1_en-us_8e6d1518accc0bf5h
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135r\*h
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..apinabout.resources_31bf3856ad364e35_10.0.19041.1_en-us_d314f4eb3925c8b58
Source: rundll32.exe, 00000005.00000003.1849480439.000002D3040CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\rcbc
Source: rundll32.exe, 00000004.00000003.1901513130.000002615D9A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.19041.1_none_555170071aa29c2c9d
Source: rundll32.exe, 00000005.00000003.1849480439.000002D3040CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\rf3
Source: rundll32.exe, 00000003.00000002.4200455288.000002C9DD568000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<<(
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920\f\\*
Source: rundll32.exe, 00000004.00000003.1853116730.000002615F47B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\red4f
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2\r2\*X
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1bys
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.1~>
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-v..failoverreplication_31bf3856ad364e35_10.0.19041.1_none_50b60ffc14c70fb2
Source: rundll32.exe, 00000003.00000003.1873712596.000002C9DF0F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\f3715a\*
Source: rundll32.exe, 00000003.00000003.1909295269.000002C9DD5DC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66\r\.a
Source: rundll32.exe, 00000005.00000003.1891196628.000002D302597000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887910801.000002D302596000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-bpa.resources_31bf3856ad364e35_10.0.19041.1_en-us_168291f09487ebd5Z
Source: rundll32.exe, 00000005.00000003.1849480439.000002D3040CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\f\122\*g
Source: rundll32.exe, 00000004.00000003.1853116730.000002615F47B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\raae06
Source: rundll32.exe, 00000005.00000003.1849480439.000002D3040CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\fe16d
Source: rundll32.exe, 00000004.00000003.1887489849.000002615D996000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0cP
Source: rundll32.exe, 00000004.00000003.1853116730.000002615F47B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\f8f0d0\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06M
Source: rundll32.exe, 00000005.00000003.2046771711.000002D3040C2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1908853614.000002D3040C0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1920128896.000002D3040C1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2265742426.000002D3040C4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1849571773.000002D3040B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1849626245.000002D3040C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\r\8fb\*
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ws\WinSxS\amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24\rmicr
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vid.resources_31bf3856ad364e35_10.0.19041.1_en-us_447494df1222bcd81c
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06\
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda\fc\*bb
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: S\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920f0c\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1901513130.000002615D9A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66
Source: rundll32.exe, 00000004.00000003.1901513130.000002615D9A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-management-clients_31bf3856ad364e35_10.0.19041.1_none_a87cce111f2d21d5c8b5
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06h
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..-client.snapinabout_31bf3856ad364e35_10.0.19041.1_none_43a9017744e82ca8(
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-v..rvcluster.resources_31bf3856ad364e35_10.0.19041.1_en-gb_71570953289cd4d0X
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586\*
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580H
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vs
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2\rf590\*
Source: rundll32.exe, 00000003.00000003.1873712596.000002C9DF0F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\r509d3\*
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-hypervcluster_31bf3856ad364e35_10.0.19041.1_none_a2ace16370124ff4
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ws\WinSxS\amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7\rr0\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de0\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66\r**
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920\r\vmms.exe\*x
Source: rundll32.exe, 00000005.00000003.1891196628.000002D302597000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887910801.000002D302596000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41b
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580]
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_en-us_fc0cba9450a52790\
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_en-us_fc0cba9450a52790
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b\f
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b\f\5\*
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b\f\
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b\f]
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vid_31bf385B>
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vsmb.resources_31bf3856ad364e35_10.0.19041.423_en-us_f14a4bbefe65ac87
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b\fP
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66\fAc
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b\r
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.19041.1889_none_e7d7bde611c8c141p
Source: rundll32.exe, 00000004.00000003.1853116730.000002615F47B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1849480439.000002D3040CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\r\\
Source: rundll32.exe, 00000005.00000003.1920538202.000002D302583000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1920469417.000002D30257C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077f%
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.17I
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.h>
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-winhvr_31bf3856ad364e35_10.0.19041.1_none_fc5d2e67adee5611ru
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79 w:
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de135\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920\f
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e3L>
Source: rundll32.exe, 00000003.00000003.1873712596.000002C9DF0F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\f69514\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-h..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddaeabc80a3525d6\\*M
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920\r
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f044137925d6\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920f\
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.[
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none$==
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb075185521358b5\*x
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8\rd0\*X
Source: rundll32.exe, 00000003.00000003.1889983582.000002C9DD65D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de\*M
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_587
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b\f\*`
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66\f
Source: rundll32.exe, 00000003.00000003.1873712596.000002C9DF0F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\r\
Source: rundll32.exe, 00000003.00000003.1890021751.000002C9DD5F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1892014006.000002C9DD5F2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1889881649.000002C9DD5EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.19041.1889_none_e7d7bde611c8c141\r
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955d
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955a
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f0441379\*-c
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586\
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-synthfcvdev_31bf3856ad364e35_10.0.19041.1741_none_b365912b94b35a98X
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586f5\*m
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920\rcc
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66\r6\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f4751718744*
Source: rundll32.exe, 00000005.00000003.1887910801.000002D302596000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vhd-parser_31bf3856ad364e35_10.0.19041.1_none_34b87765e20dcc15X
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c}
Source: rundll32.exe, 00000005.00000003.1891196628.000002D302594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-passth
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2\a7\-
Source: rundll32.exe, 00000004.00000003.2273884370.000002615F472000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1908850102.000002615F472000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1853183068.000002615F45B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1873729562.000002615F472000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\f6395c\*
Source: rundll32.exe, 00000004.00000002.4200428925.000002615D922000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4200331623.000002D302538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7\rr
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8s
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8\f\\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79\vmbkmclr.sys2ca8\*
Source: rundll32.exe, 00000004.00000003.1853116730.000002615F47B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1849480439.000002D3040CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\*
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0ch
Source: rundll32.exe, 00000005.00000003.1849480439.000002D3040CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\re3bc\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda\r\
Source: rundll32.exe, 00000004.00000003.1901513130.000002615D9A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11
Source: rundll32.exe, 00000004.00000003.1890838160.000002615F4BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c\r\vmicrdv.dllationmodel.datatransfer.dllSettings.dllgement.dllan64e35E
Source: rundll32.exe, 00000005.00000003.1887744959.000002D3025BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1887882253.000002D3025C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2\f52790\*
Source: rundll32.exe, 00000004.00000003.1853116730.000002615F47B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1849480439.000002D3040CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\f\*
Source: rundll32.exe, 00000003.00000003.1889855855.000002C9DD5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920\*
Source: rundll32.exe, 00000004.00000003.1887489849.000002615D996000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955p
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.19041.1_none_93cc37f483916b614$
Source: rundll32.exe, 00000004.00000003.1901513130.000002615D9A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ws\WinSxS\amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24\r\*
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-emulatedstorage_31bf3856ad364e35_10.0.19041.1741_none_4fe99c993cb84326
Source: rundll32.exe, 00000005.00000003.1879854890.000002D3025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda
Source: rundll32.exe, 00000003.00000003.1873712596.000002C9DF0F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040\f74140
Source: rundll32.exe, 00000004.00000003.1887468846.000002615D99C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\amd64_microsoft-hyper-v-v..edstorage.resources_31bf3856ad364e35_10.0.19041.1_en-us_8e6d1518accc0bf5aa7\*

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\System32\rundll32.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_3-49491

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FFDFB6740B8 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00007FFDFB6740B8

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB674200 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FFDFB674200
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB6740B8 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FFDFB6740B8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FFDFB681648 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FFDFB681648

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 14.161.21.105 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 31.29.184.175 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 194.164.163.84 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 1.36.218.247 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 24.177.238.115 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 5.50.197.206 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 5.227.186.88 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 20.191.110.180 8444	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 5.227.176.233 8444	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll",#1

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,FormatMessageA,	3_2_00007FFDFB6726A8
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00007FFDFB699C5C
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00007FFDFB699E40
Source: C:\Windows\System32\rundll32.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_00007FFDFB6993F8
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_00007FFDFB68F23C
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_00007FFDFB699824
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_00007FFDFB699754
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,	3_2_00007FFDFB68F628

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FFDFB687BC8 GetSystemTimeAsFileTime,

3_2_00007FFDFB687BC8

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	111 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Virtualization/Sandbox Evasion	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	111 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
pH6L2VWRbU.dll	18%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bootstrap8444.bitmessage.org	194.164.163.84	true	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.191.110.180	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
14.161.21.105	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	true
31.29.184.175	unknown	Russian Federation	39858	COMSTAR-VOLGA-ARZAMASRU	true
5.227.176.233	unknown	Russian Federation	39858	COMSTAR-VOLGA-ARZAMASRU	true
194.164.163.84	bootstrap8444.bitmessage.org	United Kingdom	8897	KCOM-SPNService-ProviderNetworkex-MistralGB	true
1.36.218.247	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	true
24.177.238.115	unknown	United States	20115	CHARTER-20115US	true
5.50.197.206	unknown	France	5410	BOUYGTEL-ISPFR	true
5.227.186.88	unknown	Russian Federation	39858	COMSTAR-VOLGA-ARZAMASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573676
Start date and time:	2024-12-12 13:34:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	pH6L2VWRbU.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original Sample Name:	8923ca4504d75400cf80ed71f381c0b4a3086ec7c8dcfba678e3dc8922042d6c.exe
Detection:	MAL
Classification:	mal60.evad.winDLL@10/1@1/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 61 Number of non-executed functions: 174
Cookbook Comments:	Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: pH6L2VWRbU.dll

Simulations

Behavior and APIs

Time	Type	Description
07:35:13	API Interceptor	1x Sleep call for process: loaddll64.exe modified
07:35:46	API Interceptor	14166763x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
20.191.110.180	dkarts.dll.dll	Get hash	malicious	Unknown	Browse
14.161.21.105	dkarts.dll.dll	Get hash	malicious	Unknown	Browse
31.29.184.175	dkarts.dll.dll	Get hash	malicious	Unknown	Browse
5.227.176.233	dkarts.dll.dll	Get hash	malicious	Unknown	Browse
1.36.218.247	dkarts.dll.dll	Get hash	malicious	Unknown	Browse
24.177.238.115	dkarts.dll.dll	Get hash	malicious	Unknown	Browse
5.50.197.206	dkarts.dll.dll	Get hash	malicious	Unknown	Browse
5.227.186.88	dkarts.dll.dll	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bootstrap8444.bitmessage.org	dkarts.dll.dll	Get hash	malicious	Unknown	Browse	185.158.248.216

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VNPT-AS-VNVNPTCorpVN	dkarts.dll.dll	Get hash	malicious	Unknown	Browse	14.161.21.105
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	113.178.114.34
	RFQ_P.O.1212024.scr	Get hash	malicious	FormBook	Browse	203.161.42.73
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	14.227.226.223
	x86_64.elf	Get hash	malicious	Mirai	Browse	14.182.4.78
	Josho.spc.elf	Get hash	malicious	Unknown	Browse	113.169.120.178
	Josho.arm7.elf	Get hash	malicious	Mirai	Browse	14.172.125.67
	Josho.sh4.elf	Get hash	malicious	Unknown	Browse	14.250.34.64
	Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Get hash	malicious	FormBook	Browse	203.161.49.193
	rebirth.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	14.255.152.82
MICROSOFT-CORP-MSN-AS-BLOCKUS	dkarts.dll.dll	Get hash	malicious	Unknown	Browse	20.191.110.180
	http://annavirgili.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	204.79.197.203
	http://annavirgili.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	204.79.197.203
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	20.140.122.126
	427c7bdc-ea02-97de-e5ef-a2c58c2d0a48.eml	Get hash	malicious	Unknown	Browse	52.109.76.144
	setup (2).msi	Get hash	malicious	Unknown	Browse	204.79.197.237
	Non_disclosure_agreement.lnk.download.lnk	Get hash	malicious	Unknown	Browse	13.107.42.14
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	51.140.146.131
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	20.226.166.194
COMSTAR-VOLGA-ARZAMASRU	dkarts.dll.dll	Get hash	malicious	Unknown	Browse	5.227.186.88
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	31.29.161.146
	splarm.elf	Get hash	malicious	Unknown	Browse	5.227.177.249
	NMdpQecbkg.elf	Get hash	malicious	Mirai	Browse	5.227.176.98
	kqC3GSMydG.elf	Get hash	malicious	Mirai	Browse	5.227.176.91
	NYEg4cbUEE.elf	Get hash	malicious	Mirai	Browse	5.227.176.81
	AQGA3j2t5e.elf	Get hash	malicious	Mirai	Browse	5.227.176.83
	g01frerVyO	Get hash	malicious	Unknown	Browse	5.227.176.90
	8XY8mR9Jz0.elf	Get hash	malicious	Unknown	Browse	5.227.188.88
	HvEXgCpRA0	Get hash	malicious	Mirai	Browse	5.227.176.82

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.875
Encrypted:	false
SSDEEP:	3:hb77qVeQmYIFvn:hb7vzr
MD5:	DB8597B2F0BDDD9AF68DAC74BDF9520E
SHA1:	0DC548535272A0A754321D1A35A14F9B4E2ABE13
SHA-256:	0812658D282E7DADE10C965EED7451871A96641417247B10F75FF8EBEAB1D931
SHA-512:	AEF98A4EF44933BDC242D28198D0594D69E0866D14987C1856926A80007016180E09569E098812F55354BC7297811B25F5E2FD12A96AF4850E42A6CB8F47998B
Malicious:	false
Reputation:	low
Preview:	J*]i...$^^om..0.>.K.b../..=....A

Static File Info

General

File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	6.50810112812364
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	pH6L2VWRbU.dll
File size:	1'098'752 bytes
MD5:	3f3abfe2d3837ec045140a4b1aa5f1bd
SHA1:	d2954695e4f504b6e8f8f344824283457284c28a
SHA256:	8923ca4504d75400cf80ed71f381c0b4a3086ec7c8dcfba678e3dc8922042d6c
SHA512:	fb580c67471016cfff964a8f100c3d80f407968700b8412ae96c564b624514d75d123ce184b581d6362c1efcd47d0a6c8660a69d6cf7754da8ab7d268e8f0508
SSDEEP:	24576:9gjkdHyKhERnZGXA9O+4E7xPh0lhSMXlEo:9gjcO/fw0uT
TLSH:	E8359E06B3A800B9D0BAD17CCA471746D7B2B80013A19BDF1BD1665E9F67BE19E3E311
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... /..dN..dN..dN../6..nN../6...N../6..vN..u...nN..u...kN..u...9N......eN..dN...N../6..mN......IN......eN......eN......eN..RichdN.

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180073b1c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6758BD14 [Tue Dec 10 22:13:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	1ec5dfedbfd3d85f88163e124ab2eb1b

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007FE609118387h
call 00007FE609118CE8h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007FE609118220h
int3
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+18h], ebx
dec eax
mov dword ptr [eax+20h], esi
dec eax
mov dword ptr [eax+10h], edx
dec eax
mov dword ptr [eax+08h], ecx
push edi
inc ecx
push esi
inc ecx
push edi
dec eax
sub esp, 30h
dec ebp
mov edi, ecx
dec ebp
mov esi, eax
dec eax
mov esi, edx
dec eax
mov edi, ecx
xor ebx, ebx
dec eax
mov dword ptr [eax-20h], ebx
mov byte ptr [eax-28h], bl
dec ecx
cmp ebx, esi
je 00007FE6091183A3h
dec eax
mov ecx, edi
dec ecx
mov eax, edi
dec eax
mov edx, dword ptr [00032909h]
call edx
dec eax
add edi, esi
dec eax
mov dword ptr [esp+50h], edi
dec eax
inc ebx
dec eax
mov dword ptr [esp+28h], ebx
jmp 00007FE60911835Ch
mov byte ptr [esp+20h], 00000001h
dec eax
mov ebx, dword ptr [esp+60h]
dec eax
mov esi, dword ptr [esp+68h]
dec eax
add esp, 30h
inc ecx
pop edi
inc ecx
pop esi
pop edi
ret
dec eax
mov eax, esp
dec esp
mov dword ptr [eax+20h], ecx
dec esp
mov dword ptr [eax+18h], eax
dec eax
mov dword ptr [eax+10h], edx
push ebx
push esi
push edi
inc ecx
push esi
dec eax
sub esp, 38h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xfdd70	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xfddb0	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x110000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x107000	0x8064	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x111000	0x1908	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe9230	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xe9400	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xe90f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa6000	0x498	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa4f60	0xa5000	eb052a0e226432727af8ec23474a6564	False	0.4926195549242424	data	6.460614320656879	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xa6000	0x58ca2	0x58e00	f930a5299b32ced35aac8ba13c149a45	False	0.4118539029535865	data	5.910982572298807	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xff000	0x7654	0x4400	d6f55a277fa36843a6b3cbde13dcdc6b	False	0.16055836397058823	data	4.19393639646241	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x107000	0x8064	0x8200	0fe057acb28de74beaad8a9d910f5bcb	False	0.4846153846153846	data	5.887842713008446	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x110000	0x1e0	0x200	aa509642125d4a9e176e608bdcf1d305	False	0.529296875	data	4.708553337303423	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x111000	0x1908	0x1a00	eb67f784e102933bb742dc448b7c79be	False	0.32572115384615385	data	5.383294772612287	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x110060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
WS2_32.dll	connect, closesocket, ioctlsocket, getsockopt, ntohs, inet_pton, freeaddrinfo, getaddrinfo, WSAGetLastError, WSACleanup, WSAStartup, socket, shutdown, send, select, recv, htons
KERNEL32.dll	InitializeCriticalSectionEx, SetEndOfFile, WriteConsoleW, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, HeapSize, HeapReAlloc, SetCurrentDirectoryW, WaitForSingleObject, CreateThread, GetModuleFileNameW, CloseHandle, GetDriveTypeA, GetLastError, SetLastError, QueryPerformanceCounter, QueryPerformanceFrequency, ReadConsoleW, SetFilePointerEx, GetFileSizeEx, ReadFile, GetConsoleMode, GetConsoleOutputCP, WriteFile, FlushFileBuffers, GetFileType, GetStdHandle, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, SleepConditionVariableSRW, Sleep, GetCurrentThreadId, FormatMessageA, GetCurrentDirectoryW, CreateDirectoryW, CreateFileW, FindClose, FindFirstFileW, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, SetFileInformationByHandle, AreFileApisANSI, GetModuleHandleW, GetProcAddress, GetFileInformationByHandleEx, MultiByteToWideChar, WideCharToMultiByte, LocalFree, GetLocaleInfoEx, WaitForSingleObjectEx, GetExitCodeThread, GetNativeSystemInfo, EnterCriticalSection, LeaveCriticalSection, RtlUnwind, DeleteCriticalSection, GetSystemTimeAsFileTime, EncodePointer, DecodePointer, LCMapStringEx, WakeAllConditionVariable, GetStringTypeW, GetCPInfo, InitializeSListHead, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, RtlPcToFileHeader, RaiseException, RtlUnwindEx, InterlockedPushEntrySList, InterlockedFlushSList, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, ExitProcess, HeapFree, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree
USER32.dll	TranslateMessage, DispatchMessageA, PostThreadMessageA, GetKeyState, CallNextHookEx, UnhookWindowsHookEx, SetWindowsHookExA, GetWindowTextA, GetForegroundWindow, GetKeyNameTextA, GetMessageA
bcrypt.dll	BCryptCloseAlgorithmProvider, BCryptGenRandom, BCryptOpenAlgorithmProvider

Exports

Name	Ordinal	Address
Init	1	0x180005ee0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 13:35:11.184983015 CET	49730	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:11.185276031 CET	49731	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:11.193972111 CET	49732	8444	192.168.2.4	1.36.218.247
Dec 12, 2024 13:35:11.195348024 CET	49733	8444	192.168.2.4	1.36.218.247
Dec 12, 2024 13:35:11.209351063 CET	49734	8444	192.168.2.4	5.50.197.206
Dec 12, 2024 13:35:11.209681034 CET	49735	8444	192.168.2.4	5.50.197.206
Dec 12, 2024 13:35:11.224145889 CET	49736	8444	192.168.2.4	5.227.176.233
Dec 12, 2024 13:35:11.224663973 CET	49737	8444	192.168.2.4	5.227.176.233
Dec 12, 2024 13:35:11.239475965 CET	49738	8444	192.168.2.4	5.227.186.88
Dec 12, 2024 13:35:11.239583015 CET	49739	8444	192.168.2.4	5.227.186.88
Dec 12, 2024 13:35:11.255636930 CET	49740	8444	192.168.2.4	14.161.21.105
Dec 12, 2024 13:35:11.256122112 CET	49741	8444	192.168.2.4	14.161.21.105
Dec 12, 2024 13:35:11.270786047 CET	49742	8444	192.168.2.4	20.191.110.180
Dec 12, 2024 13:35:11.271188974 CET	49743	8444	192.168.2.4	20.191.110.180
Dec 12, 2024 13:35:11.289680958 CET	49744	8444	192.168.2.4	24.177.238.115
Dec 12, 2024 13:35:11.289953947 CET	49745	8444	192.168.2.4	24.177.238.115
Dec 12, 2024 13:35:11.305413961 CET	8444	49730	194.164.163.84	192.168.2.4
Dec 12, 2024 13:35:11.305459023 CET	8444	49731	194.164.163.84	192.168.2.4
Dec 12, 2024 13:35:11.305567980 CET	49731	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:11.305598021 CET	49730	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:11.314222097 CET	8444	49732	1.36.218.247	192.168.2.4
Dec 12, 2024 13:35:11.314433098 CET	49732	8444	192.168.2.4	1.36.218.247
Dec 12, 2024 13:35:11.315298080 CET	8444	49733	1.36.218.247	192.168.2.4
Dec 12, 2024 13:35:11.315470934 CET	49733	8444	192.168.2.4	1.36.218.247
Dec 12, 2024 13:35:11.330321074 CET	8444	49734	5.50.197.206	192.168.2.4
Dec 12, 2024 13:35:11.330549002 CET	49734	8444	192.168.2.4	5.50.197.206
Dec 12, 2024 13:35:11.330595016 CET	8444	49735	5.50.197.206	192.168.2.4
Dec 12, 2024 13:35:11.330830097 CET	49735	8444	192.168.2.4	5.50.197.206
Dec 12, 2024 13:35:11.344294071 CET	8444	49736	5.227.176.233	192.168.2.4
Dec 12, 2024 13:35:11.344548941 CET	49736	8444	192.168.2.4	5.227.176.233
Dec 12, 2024 13:35:11.344872952 CET	8444	49737	5.227.176.233	192.168.2.4
Dec 12, 2024 13:35:11.344958067 CET	49737	8444	192.168.2.4	5.227.176.233
Dec 12, 2024 13:35:11.350375891 CET	49733	8444	192.168.2.4	1.36.218.247
Dec 12, 2024 13:35:11.350469112 CET	49730	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:11.350522041 CET	49737	8444	192.168.2.4	5.227.176.233
Dec 12, 2024 13:35:11.350593090 CET	49734	8444	192.168.2.4	5.50.197.206
Dec 12, 2024 13:35:11.350754023 CET	49731	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:11.350877047 CET	49732	8444	192.168.2.4	1.36.218.247
Dec 12, 2024 13:35:11.350877047 CET	49736	8444	192.168.2.4	5.227.176.233
Dec 12, 2024 13:35:11.350920916 CET	49735	8444	192.168.2.4	5.50.197.206
Dec 12, 2024 13:35:11.359764099 CET	8444	49738	5.227.186.88	192.168.2.4
Dec 12, 2024 13:35:11.359808922 CET	8444	49739	5.227.186.88	192.168.2.4
Dec 12, 2024 13:35:11.359952927 CET	49738	8444	192.168.2.4	5.227.186.88
Dec 12, 2024 13:35:11.360008955 CET	49739	8444	192.168.2.4	5.227.186.88
Dec 12, 2024 13:35:11.364372969 CET	49739	8444	192.168.2.4	5.227.186.88
Dec 12, 2024 13:35:11.364653111 CET	49738	8444	192.168.2.4	5.227.186.88
Dec 12, 2024 13:35:11.375904083 CET	8444	49740	14.161.21.105	192.168.2.4
Dec 12, 2024 13:35:11.376137972 CET	49740	8444	192.168.2.4	14.161.21.105
Dec 12, 2024 13:35:11.376342058 CET	8444	49741	14.161.21.105	192.168.2.4
Dec 12, 2024 13:35:11.376409054 CET	49741	8444	192.168.2.4	14.161.21.105
Dec 12, 2024 13:35:11.380316019 CET	49741	8444	192.168.2.4	14.161.21.105
Dec 12, 2024 13:35:11.380508900 CET	49740	8444	192.168.2.4	14.161.21.105
Dec 12, 2024 13:35:11.391127110 CET	8444	49742	20.191.110.180	192.168.2.4
Dec 12, 2024 13:35:11.391216993 CET	49742	8444	192.168.2.4	20.191.110.180
Dec 12, 2024 13:35:11.391263008 CET	8444	49743	20.191.110.180	192.168.2.4
Dec 12, 2024 13:35:11.391344070 CET	49743	8444	192.168.2.4	20.191.110.180
Dec 12, 2024 13:35:11.395797968 CET	49743	8444	192.168.2.4	20.191.110.180
Dec 12, 2024 13:35:11.395987988 CET	49742	8444	192.168.2.4	20.191.110.180
Dec 12, 2024 13:35:11.409972906 CET	8444	49744	24.177.238.115	192.168.2.4
Dec 12, 2024 13:35:11.410070896 CET	8444	49745	24.177.238.115	192.168.2.4
Dec 12, 2024 13:35:11.410209894 CET	49744	8444	192.168.2.4	24.177.238.115
Dec 12, 2024 13:35:11.410301924 CET	49745	8444	192.168.2.4	24.177.238.115
Dec 12, 2024 13:35:11.411525965 CET	49745	8444	192.168.2.4	24.177.238.115
Dec 12, 2024 13:35:11.411706924 CET	49744	8444	192.168.2.4	24.177.238.115
Dec 12, 2024 13:35:11.470865011 CET	8444	49733	1.36.218.247	192.168.2.4
Dec 12, 2024 13:35:11.470907927 CET	8444	49737	5.227.176.233	192.168.2.4
Dec 12, 2024 13:35:11.470938921 CET	8444	49730	194.164.163.84	192.168.2.4
Dec 12, 2024 13:35:11.470967054 CET	8444	49734	5.50.197.206	192.168.2.4
Dec 12, 2024 13:35:11.471024990 CET	8444	49731	194.164.163.84	192.168.2.4
Dec 12, 2024 13:35:11.471054077 CET	8444	49732	1.36.218.247	192.168.2.4
Dec 12, 2024 13:35:11.471107006 CET	8444	49736	5.227.176.233	192.168.2.4
Dec 12, 2024 13:35:11.471134901 CET	8444	49735	5.50.197.206	192.168.2.4
Dec 12, 2024 13:35:11.484678984 CET	8444	49739	5.227.186.88	192.168.2.4
Dec 12, 2024 13:35:11.484771013 CET	8444	49738	5.227.186.88	192.168.2.4
Dec 12, 2024 13:35:11.501112938 CET	8444	49741	14.161.21.105	192.168.2.4
Dec 12, 2024 13:35:11.501157045 CET	8444	49740	14.161.21.105	192.168.2.4
Dec 12, 2024 13:35:11.516511917 CET	8444	49743	20.191.110.180	192.168.2.4
Dec 12, 2024 13:35:11.516601086 CET	8444	49742	20.191.110.180	192.168.2.4
Dec 12, 2024 13:35:11.531688929 CET	8444	49745	24.177.238.115	192.168.2.4
Dec 12, 2024 13:35:11.531733990 CET	8444	49744	24.177.238.115	192.168.2.4
Dec 12, 2024 13:35:13.499041080 CET	8444	49743	20.191.110.180	192.168.2.4
Dec 12, 2024 13:35:13.499317884 CET	49743	8444	192.168.2.4	20.191.110.180
Dec 12, 2024 13:35:13.502304077 CET	8444	49742	20.191.110.180	192.168.2.4
Dec 12, 2024 13:35:13.502469063 CET	49742	8444	192.168.2.4	20.191.110.180
Dec 12, 2024 13:35:13.506360054 CET	8444	49735	5.50.197.206	192.168.2.4
Dec 12, 2024 13:35:13.506392002 CET	8444	49734	5.50.197.206	192.168.2.4
Dec 12, 2024 13:35:13.506460905 CET	49734	8444	192.168.2.4	5.50.197.206
Dec 12, 2024 13:35:13.506577015 CET	49735	8444	192.168.2.4	5.50.197.206
Dec 12, 2024 13:35:13.746716976 CET	49746	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:13.755237103 CET	49747	8444	192.168.2.4	1.36.218.247
Dec 12, 2024 13:35:13.770823002 CET	49748	8444	192.168.2.4	5.50.197.206
Dec 12, 2024 13:35:13.786555052 CET	49749	8444	192.168.2.4	5.227.176.233
Dec 12, 2024 13:35:13.802639008 CET	49750	8444	192.168.2.4	5.227.186.88
Dec 12, 2024 13:35:13.818181038 CET	49751	8444	192.168.2.4	14.161.21.105
Dec 12, 2024 13:35:13.833419085 CET	49752	8444	192.168.2.4	20.191.110.180
Dec 12, 2024 13:35:13.849054098 CET	49753	8444	192.168.2.4	24.177.238.115
Dec 12, 2024 13:35:13.867924929 CET	8444	49746	194.164.163.84	192.168.2.4
Dec 12, 2024 13:35:13.868014097 CET	49746	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:13.875058889 CET	8444	49747	1.36.218.247	192.168.2.4
Dec 12, 2024 13:35:13.875137091 CET	49747	8444	192.168.2.4	1.36.218.247
Dec 12, 2024 13:35:13.879980087 CET	49746	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:13.880018950 CET	49747	8444	192.168.2.4	1.36.218.247
Dec 12, 2024 13:35:13.890913010 CET	8444	49748	5.50.197.206	192.168.2.4
Dec 12, 2024 13:35:13.891005993 CET	49748	8444	192.168.2.4	5.50.197.206
Dec 12, 2024 13:35:13.895648956 CET	49748	8444	192.168.2.4	5.50.197.206
Dec 12, 2024 13:35:13.907078981 CET	8444	49749	5.227.176.233	192.168.2.4
Dec 12, 2024 13:35:13.907159090 CET	49749	8444	192.168.2.4	5.227.176.233
Dec 12, 2024 13:35:13.911305904 CET	49749	8444	192.168.2.4	5.227.176.233
Dec 12, 2024 13:35:13.922815084 CET	8444	49750	5.227.186.88	192.168.2.4
Dec 12, 2024 13:35:13.922930956 CET	49750	8444	192.168.2.4	5.227.186.88
Dec 12, 2024 13:35:13.927063942 CET	49750	8444	192.168.2.4	5.227.186.88
Dec 12, 2024 13:35:13.938117981 CET	8444	49751	14.161.21.105	192.168.2.4
Dec 12, 2024 13:35:13.938323021 CET	49751	8444	192.168.2.4	14.161.21.105
Dec 12, 2024 13:35:13.942640066 CET	49751	8444	192.168.2.4	14.161.21.105
Dec 12, 2024 13:35:13.953459024 CET	8444	49752	20.191.110.180	192.168.2.4
Dec 12, 2024 13:35:13.953527927 CET	49752	8444	192.168.2.4	20.191.110.180
Dec 12, 2024 13:35:13.958281040 CET	49752	8444	192.168.2.4	20.191.110.180
Dec 12, 2024 13:35:13.969456911 CET	8444	49753	24.177.238.115	192.168.2.4
Dec 12, 2024 13:35:13.969578028 CET	49753	8444	192.168.2.4	24.177.238.115
Dec 12, 2024 13:35:13.973783016 CET	49753	8444	192.168.2.4	24.177.238.115
Dec 12, 2024 13:35:14.000441074 CET	8444	49746	194.164.163.84	192.168.2.4
Dec 12, 2024 13:35:14.000485897 CET	8444	49747	1.36.218.247	192.168.2.4
Dec 12, 2024 13:35:14.015403986 CET	8444	49748	5.50.197.206	192.168.2.4
Dec 12, 2024 13:35:14.031409025 CET	8444	49749	5.227.176.233	192.168.2.4
Dec 12, 2024 13:35:14.046909094 CET	8444	49750	5.227.186.88	192.168.2.4
Dec 12, 2024 13:35:14.062468052 CET	8444	49751	14.161.21.105	192.168.2.4
Dec 12, 2024 13:35:14.078119993 CET	8444	49752	20.191.110.180	192.168.2.4
Dec 12, 2024 13:35:14.094799042 CET	8444	49753	24.177.238.115	192.168.2.4
Dec 12, 2024 13:35:15.450031996 CET	8444	49731	194.164.163.84	192.168.2.4
Dec 12, 2024 13:35:15.458374023 CET	49731	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:15.475064993 CET	49754	8444	192.168.2.4	31.29.184.175
Dec 12, 2024 13:35:15.580046892 CET	8444	49731	194.164.163.84	192.168.2.4
Dec 12, 2024 13:35:15.580164909 CET	49731	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:15.596383095 CET	8444	49754	31.29.184.175	192.168.2.4
Dec 12, 2024 13:35:15.596498013 CET	49754	8444	192.168.2.4	31.29.184.175
Dec 12, 2024 13:35:15.598761082 CET	49754	8444	192.168.2.4	31.29.184.175
Dec 12, 2024 13:35:15.718740940 CET	8444	49754	31.29.184.175	192.168.2.4
Dec 12, 2024 13:35:16.064963102 CET	8444	49752	20.191.110.180	192.168.2.4
Dec 12, 2024 13:35:16.065047979 CET	49752	8444	192.168.2.4	20.191.110.180
Dec 12, 2024 13:35:16.069636106 CET	8444	49748	5.50.197.206	192.168.2.4
Dec 12, 2024 13:35:16.069772959 CET	49748	8444	192.168.2.4	5.50.197.206
Dec 12, 2024 13:35:16.527734041 CET	8444	49730	194.164.163.84	192.168.2.4
Dec 12, 2024 13:35:16.543416023 CET	49730	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:16.555342913 CET	49755	8444	192.168.2.4	31.29.184.175
Dec 12, 2024 13:35:16.663693905 CET	8444	49730	194.164.163.84	192.168.2.4
Dec 12, 2024 13:35:16.663846016 CET	49730	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:16.675477028 CET	8444	49755	31.29.184.175	192.168.2.4
Dec 12, 2024 13:35:16.675709963 CET	49755	8444	192.168.2.4	31.29.184.175
Dec 12, 2024 13:35:16.676827908 CET	49755	8444	192.168.2.4	31.29.184.175
Dec 12, 2024 13:35:16.796619892 CET	8444	49755	31.29.184.175	192.168.2.4
Dec 12, 2024 13:35:18.137037992 CET	8444	49746	194.164.163.84	192.168.2.4
Dec 12, 2024 13:35:18.146505117 CET	49746	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:18.184212923 CET	49756	8444	192.168.2.4	31.29.184.175
Dec 12, 2024 13:35:18.268158913 CET	8444	49746	194.164.163.84	192.168.2.4
Dec 12, 2024 13:35:18.268357992 CET	49746	8444	192.168.2.4	194.164.163.84
Dec 12, 2024 13:35:18.304794073 CET	8444	49756	31.29.184.175	192.168.2.4
Dec 12, 2024 13:35:18.304889917 CET	49756	8444	192.168.2.4	31.29.184.175
Dec 12, 2024 13:35:18.318008900 CET	49756	8444	192.168.2.4	31.29.184.175
Dec 12, 2024 13:35:18.438437939 CET	8444	49756	31.29.184.175	192.168.2.4
Dec 12, 2024 13:35:33.197920084 CET	8444	49733	1.36.218.247	192.168.2.4
Dec 12, 2024 13:35:33.198005915 CET	49733	8444	192.168.2.4	1.36.218.247
Dec 12, 2024 13:35:33.213407040 CET	8444	49732	1.36.218.247	192.168.2.4
Dec 12, 2024 13:35:33.213485956 CET	49732	8444	192.168.2.4	1.36.218.247
Dec 12, 2024 13:35:33.244890928 CET	8444	49739	5.227.186.88	192.168.2.4
Dec 12, 2024 13:35:33.244915009 CET	8444	49736	5.227.176.233	192.168.2.4
Dec 12, 2024 13:35:33.245032072 CET	49739	8444	192.168.2.4	5.227.186.88
Dec 12, 2024 13:35:33.247045040 CET	49736	8444	192.168.2.4	5.227.176.233
Dec 12, 2024 13:35:33.260636091 CET	8444	49737	5.227.176.233	192.168.2.4
Dec 12, 2024 13:35:33.260859013 CET	49737	8444	192.168.2.4	5.227.176.233
Dec 12, 2024 13:35:33.276298046 CET	8444	49738	5.227.186.88	192.168.2.4
Dec 12, 2024 13:35:33.276396990 CET	49738	8444	192.168.2.4	5.227.186.88
Dec 12, 2024 13:35:33.276541948 CET	8444	49740	14.161.21.105	192.168.2.4
Dec 12, 2024 13:35:33.276556969 CET	8444	49741	14.161.21.105	192.168.2.4
Dec 12, 2024 13:35:33.276601076 CET	49740	8444	192.168.2.4	14.161.21.105
Dec 12, 2024 13:35:33.276688099 CET	49741	8444	192.168.2.4	14.161.21.105
Dec 12, 2024 13:35:33.307897091 CET	8444	49745	24.177.238.115	192.168.2.4
Dec 12, 2024 13:35:33.308084011 CET	49745	8444	192.168.2.4	24.177.238.115
Dec 12, 2024 13:35:33.323127031 CET	8444	49744	24.177.238.115	192.168.2.4
Dec 12, 2024 13:35:33.323245049 CET	49744	8444	192.168.2.4	24.177.238.115
Dec 12, 2024 13:35:35.775774956 CET	8444	49747	1.36.218.247	192.168.2.4
Dec 12, 2024 13:35:35.778233051 CET	49747	8444	192.168.2.4	1.36.218.247
Dec 12, 2024 13:35:35.806730986 CET	8444	49749	5.227.176.233	192.168.2.4
Dec 12, 2024 13:35:35.807132959 CET	49749	8444	192.168.2.4	5.227.176.233
Dec 12, 2024 13:35:35.822261095 CET	8444	49751	14.161.21.105	192.168.2.4
Dec 12, 2024 13:35:35.822421074 CET	8444	49750	5.227.186.88	192.168.2.4
Dec 12, 2024 13:35:35.822454929 CET	49751	8444	192.168.2.4	14.161.21.105
Dec 12, 2024 13:35:35.822489977 CET	49750	8444	192.168.2.4	5.227.186.88
Dec 12, 2024 13:35:35.869533062 CET	8444	49753	24.177.238.115	192.168.2.4
Dec 12, 2024 13:35:35.870187998 CET	49753	8444	192.168.2.4	24.177.238.115
Dec 12, 2024 13:35:37.494235992 CET	8444	49754	31.29.184.175	192.168.2.4
Dec 12, 2024 13:35:37.494424105 CET	49754	8444	192.168.2.4	31.29.184.175
Dec 12, 2024 13:35:38.572627068 CET	8444	49755	31.29.184.175	192.168.2.4
Dec 12, 2024 13:35:38.572696924 CET	49755	8444	192.168.2.4	31.29.184.175
Dec 12, 2024 13:35:40.197621107 CET	8444	49756	31.29.184.175	192.168.2.4
Dec 12, 2024 13:35:40.197722912 CET	49756	8444	192.168.2.4	31.29.184.175

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 13:35:10.717806101 CET	51580	53	192.168.2.4	1.1.1.1
Dec 12, 2024 13:35:11.176650047 CET	53	51580	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 13:35:10.717806101 CET	192.168.2.4	1.1.1.1	0x1670	Standard query (0)	bootstrap8444.bitmessage.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 13:35:11.176650047 CET	1.1.1.1	192.168.2.4	0x1670	No error (0)	bootstrap8444.bitmessage.org	194.164.163.84	A (IP address)	IN (0x0001)	false
Dec 12, 2024 13:35:11.176650047 CET	1.1.1.1	192.168.2.4	0x1670	No error (0)	bootstrap8444.bitmessage.org	185.158.248.216	A (IP address)	IN (0x0001)	false
Dec 12, 2024 13:35:11.176650047 CET	1.1.1.1	192.168.2.4	0x1670	No error (0)	bootstrap8444.bitmessage.org	85.25.152.9	A (IP address)	IN (0x0001)	false
Dec 12, 2024 13:35:11.176650047 CET	1.1.1.1	192.168.2.4	0x1670	No error (0)	bootstrap8444.bitmessage.org	85.114.135.102	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	07:35:09
Start date:	12/12/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll"
Imagebase:	0x7ff78e8d0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:35:09
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	07:35:09
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll",#1
Imagebase:	0x7ff699a40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	07:35:09
Start date:	12/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\pH6L2VWRbU.dll,Init
Imagebase:	0x7ff6bc340000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	07:35:10
Start date:	12/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll",#1
Imagebase:	0x7ff6bc340000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	07:35:13
Start date:	12/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\pH6L2VWRbU.dll",Init
Imagebase:	0x7ff6bc340000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.4%
Total number of Nodes:	1584
Total number of Limit Nodes:	10

Executed Functions

Function 00007FFDFB60D170 Relevance: 41.2, APIs: 18, Strings: 5, Instructions: 925COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNELBASE ref: 00007FFDFB60D340
__std_fs_code_page.LIBCPMT ref: 00007FFDFB60D384
__std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FFDFB60D3EE
__std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FFDFB60D441
__std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FFDFB60D5CF
__std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FFDFB60D57C

Part of subcall function 00007FFDFB671D58: MultiByteToWideChar.KERNEL32 ref: 00007FFDFB671D74
Part of subcall function 00007FFDFB671D58: GetLastError.KERNEL32 ref: 00007FFDFB671D82

__std_fs_code_page.LIBCPMT ref: 00007FFDFB60D514

Part of subcall function 00007FFDFB671D30: AreFileApisANSI.KERNEL32(?,?,?,?,00007FFDFB608708), ref: 00007FFDFB671D42

__std_fs_code_page.LIBCPMT ref: 00007FFDFB60D7EF
__std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FFDFB60D851
__std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FFDFB60D89F
__std_fs_code_page.LIBCPMT ref: 00007FFDFB60DDED
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FFDFB60DE58

Part of subcall function 00007FFDFB671DA0: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000100000000), ref: 00007FFDFB671DFB

__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FFDFB60DF39
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60E229
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60E26B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60E290
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60E296

Strings

directory_iterator::directory_iterator, xrefs: 00007FFDFB60E24E
exists, xrefs: 00007FFDFB60E21C
status, xrefs: 00007FFDFB60E1FF
directory_iterator::operator++, xrefs: 00007FFDFB60E29E
directory_entry::status, xrefs: 00007FFDFB60E25F

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: __std_fs_convert_narrow_to_wide$__std_fs_code_page_invalid_parameter_noinfo_noreturn$ByteCharMultiWide__std_fs_convert_wide_to_narrow$ApisDriveErrorFileLastType
String ID: directory_entry::status$directory_iterator::directory_iterator$directory_iterator::operator++$exists$status
API String ID: 497817043-1599448591
Opcode ID: 089c25010aede620c3ee6f1aad9fc8b09ef9640c3f2b009ad9a8235de9e3c2bb
Instruction ID: 3ebf9c6c23884a449626a8ab21c24082c5130d813d095290c7cde8bd65c9af75
Opcode Fuzzy Hash: 089c25010aede620c3ee6f1aad9fc8b09ef9640c3f2b009ad9a8235de9e3c2bb
Instruction Fuzzy Hash: CC928372B1AAC681EB208B16E4507EAA361FB89790F545235DAED47BEDDF3CD441CB00

Function 00007FFDFB6720F8 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FFDFB6721A5
GetLastError.KERNEL32 ref: 00007FFDFB6721AF
FindFirstFileW.KERNEL32 ref: 00007FFDFB6721C6
GetLastError.KERNEL32 ref: 00007FFDFB6721D2
FindClose.KERNEL32 ref: 00007FFDFB6721E0
__std_fs_open_handle.LIBCPMT ref: 00007FFDFB672273
CloseHandle.KERNEL32 ref: 00007FFDFB672289
CloseHandle.KERNEL32 ref: 00007FFDFB6723FC

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: cbb52d49409fda87dcf39da38a887af207d25e082b269dd45f47db89adc4384e
Instruction ID: c9499c6d50566062c06da557fcf032dd9f884aa70c617491e4bb3b9093fcdeec
Opcode Fuzzy Hash: cbb52d49409fda87dcf39da38a887af207d25e082b269dd45f47db89adc4384e
Instruction Fuzzy Hash: 37918631B0AA0346EB645B25B824A796391FF56BB8F244734DA7E4F6FCDE3CE4418600

Function 00007FFDFB69D0C0 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFDFB69CCA4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB69CCE5
Part of subcall function 00007FFDFB69CCA4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB69CD63
Part of subcall function 00007FFDFB69CCA4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB69CDB4

CreateFileW.KERNELBASE ref: 00007FFDFB69D1C6
CreateFileW.KERNEL32 ref: 00007FFDFB69D216
GetLastError.KERNEL32 ref: 00007FFDFB69D246
GetFileType.KERNELBASE ref: 00007FFDFB69D25B
GetLastError.KERNEL32 ref: 00007FFDFB69D265
CloseHandle.KERNEL32 ref: 00007FFDFB69D298
CloseHandle.KERNEL32 ref: 00007FFDFB69D3FB
CreateFileW.KERNEL32 ref: 00007FFDFB69D430
GetLastError.KERNEL32 ref: 00007FFDFB69D43F

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: cf7de675378a5cbfd29ab63b7c289bb692dbbc831a8b675e2e34d6ff1defbea5
Instruction ID: 04999eab6e39ed81288512b6e5928ac32c7a6070cc4d61b37b254e8d483f4c61
Opcode Fuzzy Hash: cf7de675378a5cbfd29ab63b7c289bb692dbbc831a8b675e2e34d6ff1defbea5
Instruction Fuzzy Hash: 30C19137B29A4685EB10CF65C4A0AAC3765FB49B98B015235DF2E5B7E9CF38D455C300

Function 00007FFDFB61B910 Relevance: 12.5, APIs: 8, Instructions: 502
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Xtime_get_ticks.LIBCPMT ref: 00007FFDFB61F0AB

Part of subcall function 00007FFDFB6060A0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6061E8
Part of subcall function 00007FFDFB6060A0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6061EE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61F1FE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61F204
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61F66E

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskXtime_get_ticks
String ID:
API String ID: 1158503968-0
Opcode ID: bc057f2473daa175748766e53bd64e022376ac78503f272540ecfc597dbde49d
Instruction ID: a3ab5a811f09c51e6833fdd32aa69d81cea0a0f258e1d1b43be48cde60f4d3f5
Opcode Fuzzy Hash: bc057f2473daa175748766e53bd64e022376ac78503f272540ecfc597dbde49d
Instruction Fuzzy Hash: 6B22E362B0AB8295EB10CF65D4607AD2361EB48B98F145636DF6C1BBEDDF38E055C340

Function 00007FFDFB624FF0 Relevance: 11.2, APIs: 7, Instructions: 668COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB625A70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB625A76
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB625A7C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB625A82
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB625A88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB625A8E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB625A9A

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: b022d2ec1b42bdcaf3782a26730692957c5448a4463a9acc213311ea670f82a6
Instruction ID: e151abe49138539c6365ec160711da35e1b07e8f17c7af20377292ca2213c5d9
Opcode Fuzzy Hash: b022d2ec1b42bdcaf3782a26730692957c5448a4463a9acc213311ea670f82a6
Instruction Fuzzy Hash: 9652B362B1A78246FF208F6994656BD63A1EB857E4F104332EE7D1BAEDDF6CD0418700

Function 00007FFDFB6237B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB623886
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB623892

Strings

UUUUUUUU, xrefs: 00007FFDFB623956

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: UUUUUUUU
API String ID: 73155330-4023394949
Opcode ID: 6b8db1faa9fabe018d9285c54ddd36226c2c255d7b81799916a537a232d1c5f4
Instruction ID: 1371cefaf4b40d54ac88cf4223a2926a8493a5c52fa120970562d83b0068cd5b
Opcode Fuzzy Hash: 6b8db1faa9fabe018d9285c54ddd36226c2c255d7b81799916a537a232d1c5f4
Instruction Fuzzy Hash: 78719072715B8182EB54CB25F9512A9B3A8FB48BD0F149636EBAD47BD9CF38D061C300

Function 00007FFDFB6726A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00007FFDFB6726CE
FormatMessageA.KERNELBASE ref: 00007FFDFB672701

Strings

!x-sys-default-locale, xrefs: 00007FFDFB6726C1

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: ad935c524a6dec67042784d27dc58e6aa16cb5516add0b3ce72735b210b29e54
Instruction ID: 2f6a28d9f8ab874669949ae74c52a80da3f56deb3b6fdc2fe79d4935bd5e74f1
Opcode Fuzzy Hash: ad935c524a6dec67042784d27dc58e6aa16cb5516add0b3ce72735b210b29e54
Instruction Fuzzy Hash: EF018471B1978382E7118B21B920B6A77A6FB85789F148035DA5D0AAE9CF3CD945CB00

Function 00007FFDFB636F10 Relevance: 3.0, APIs: 2, Instructions: 26networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FFDFB636F2E
WSAGetLastError.WS2_32 ref: 00007FFDFB636F39

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 74f32e9412ac67f6e650f41e1d29d0b809624680fa79bec77c7590b538dc1e4f
Instruction ID: d01fcd430b5bc7d7f5224bedd910e38d3c3132dcfd0e6717ec9ea616f208f784
Opcode Fuzzy Hash: 74f32e9412ac67f6e650f41e1d29d0b809624680fa79bec77c7590b538dc1e4f
Instruction Fuzzy Hash: 15F01522F0E40781FF604775AD6483922929B55B35B688370D63D8E7F4CE2C98E58200

Function 00007FFDFB60803B Relevance: 13.7, APIs: 9, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f3b622d7e8694473c6c6e16b422feae893ddfb54f874e7b7deb90370d846621
Instruction ID: 8148474575635d82df359a80cfffbbfae6f005b3a1d98e8dc594e5fd753d0c99
Opcode Fuzzy Hash: 8f3b622d7e8694473c6c6e16b422feae893ddfb54f874e7b7deb90370d846621
Instruction Fuzzy Hash: 4A41F953F0E6C34BF7128B35AC309792B509BA6B94F4C5076DAD90A5FBEE2CA485C300

Function 00007FFDFB608100 Relevance: 13.7, APIs: 9, Instructions: 156
windowkeyboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32 ref: 00007FFDFB608198
GetKeyState.USER32 ref: 00007FFDFB6081AF
GetKeyState.USER32 ref: 00007FFDFB6081C4
GetMessageA.USER32 ref: 00007FFDFB6081F3
TranslateMessage.USER32 ref: 00007FFDFB608205
DispatchMessageA.USER32 ref: 00007FFDFB608210
GetMessageA.USER32 ref: 00007FFDFB608223
UnhookWindowsHookEx.USER32 ref: 00007FFDFB608230
CloseHandle.KERNEL32 ref: 00007FFDFB608239

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Message$HookStateWindows$CloseDispatchHandleTranslateUnhook
String ID:
API String ID: 3174565155-0
Opcode ID: ee03ecaaf2d7d0fb30deef92977deca93fbd09c32946a9f92d2eca31e66d8f4f
Instruction ID: 726393ac4d41e5471616a2a8cb772b2618e3eb505e29f1d216a7f2a9b2a7f196
Opcode Fuzzy Hash: ee03ecaaf2d7d0fb30deef92977deca93fbd09c32946a9f92d2eca31e66d8f4f
Instruction Fuzzy Hash: 0821A723B1AA8356FB116B25FD20E792760BFD9B88F485130ED5D094B8EF3CA585C700

Function 00007FFDFB609390 Relevance: 12.5, APIs: 8, Instructions: 493
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60953A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB609540
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6096EF
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6096F5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60988D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB609893
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6099DA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6099E0

Part of subcall function 00007FFDFB67329C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6732CC
Part of subcall function 00007FFDFB67329C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6732D2

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4131450254-0
Opcode ID: 4d8872390ca6885f2755a488882e0b7765ea9b18d28c1549018fb8de563b5751
Instruction ID: b4c3da33455dd06be1748edcc89ddf9af0bde216fb308925835c5fa14a8e7b04
Opcode Fuzzy Hash: 4d8872390ca6885f2755a488882e0b7765ea9b18d28c1549018fb8de563b5751
Instruction Fuzzy Hash: FC02B262B0A74281EB149F1AE5146AD6366EB46BE4F584731DFBD0B7E9EE7CE041C300

Function 00007FFDFB68F2B8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FFDFB68FB00,?,?,?,?,00007FFDFB689B19,?,?,?,?,00007FFDFB670BEC), ref: 00007FFDFB68F434
GetProcAddressForCaller.KERNELBASE(?,?,?,00007FFDFB68FB00,?,?,?,?,00007FFDFB689B19,?,?,?,?,00007FFDFB670BEC), ref: 00007FFDFB68F440

Strings

ext-ms-, xrefs: 00007FFDFB68F391
api-ms-, xrefs: 00007FFDFB68F37E

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: AddressCallerFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3520295827-537541572
Opcode ID: fac27ec3388f263f1e39d88759a50297de9a3eacf0620e0a0a350d79358b812c
Instruction ID: 7f249046182f51f207fc8f84afbcd3a1914f0d0de17f30c63fe39390e70b8fe8
Opcode Fuzzy Hash: fac27ec3388f263f1e39d88759a50297de9a3eacf0620e0a0a350d79358b812c
Instruction Fuzzy Hash: 7241D232B1BE0382EB169B16A8649692395BF05BD0F488935DD6E4F7ECEE7CE4458340

Function 00007FFDFB67380C Relevance: 12.2, APIs: 8, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDFB673834
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDFB673886
_RTC_Initialize.LIBCMT ref: 00007FFDFB6738B4
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDFB6738DA
__scrt_release_startup_lock.LIBCMT ref: 00007FFDFB673905

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: d27437b5d63ed5d4306fe20deebea955c2e905071bc7dc1f0f01ce21576cc12b
Instruction ID: 5e4af08b05caad51dd8223a676c6a6aaac10eda9c54167e0ddb12d6ed00dee2e
Opcode Fuzzy Hash: d27437b5d63ed5d4306fe20deebea955c2e905071bc7dc1f0f01ce21576cc12b
Instruction Fuzzy Hash: 6381B121F0A24385FB549B65A461A796690EF85B80F688035DA6C4F7FEEE3CE8478700

Function 00007FFDFB636760 Relevance: 12.1, APIs: 8, Instructions: 68
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FFDFB636792
WSAGetLastError.WS2_32 ref: 00007FFDFB6367A1
ioctlsocket.WS2_32 ref: 00007FFDFB6367BC
connect.WS2_32 ref: 00007FFDFB6367CE
WSAGetLastError.WS2_32 ref: 00007FFDFB6367D9
closesocket.WS2_32 ref: 00007FFDFB6367E9

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorLast$closesocketconnectioctlsocketsocket
String ID:
API String ID: 1359816349-0
Opcode ID: 39dd50236cfafcb7601ae828c0674d468b8022b5d7a821f4e6baed1cc42d40f8
Instruction ID: 4c203185f214e6393dabe1955916076a4185846d57ab7f947abc62323ba0ebe0
Opcode Fuzzy Hash: 39dd50236cfafcb7601ae828c0674d468b8022b5d7a821f4e6baed1cc42d40f8
Instruction Fuzzy Hash: 96219C72B0964286EB508F79E85466823A0EB48FB8F149330DA3D8F7E8DF3CD4858700

Function 00007FFDFB676A90 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFDFB676C2E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFDFB676F57

Strings

csm, xrefs: 00007FFDFB676C55
csm, xrefs: 00007FFDFB676BD7
csm, xrefs: 00007FFDFB676B75

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 86f70044e9b801db0a36925008141f5f3a80cff1a65b42b6f3ac88d6b9c6f9b1
Instruction ID: fd5b793108ce1ea059270bf50df6278475b63276da5cb9953c18e5c70f4ea7bf
Opcode Fuzzy Hash: 86f70044e9b801db0a36925008141f5f3a80cff1a65b42b6f3ac88d6b9c6f9b1
Instruction Fuzzy Hash: 96E1A773A096838AEB10DF65E490ABD3BA0FB45748F244135DE6D4B6E9DF38E581CB40

Function 00007FFDFB604620 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFDFB671144: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB671161
Part of subcall function 00007FFDFB671144: std::locale::_Setgloballocale.LIBCPMT ref: 00007FFDFB671184
Part of subcall function 00007FFDFB671144: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB671219

GetModuleFileNameW.KERNEL32(?,00007FFDFB604FB9,?,?,?,?,00007FFDFB602E09,?,?,?,?,00007FFDFB6013A1), ref: 00007FFDFB6047ED
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFB60203C), ref: 00007FFDFB60480F

Strings

ios_base::failbit set, xrefs: 00007FFDFB604746
ios_base::eofbit set, xrefs: 00007FFDFB60474D
ios_base::badbit set, xrefs: 00007FFDFB60473B

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$CurrentDirectoryFileLockit::_Lockit::~_ModuleNameSetgloballocalestd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3950130698-1866435925
Opcode ID: c2ed5789f868c68b1f47cf0c7976ca9e49e2de42e793f4521e1ce3075f05a869
Instruction ID: cec9e7488a0fe82b49bf1a520d5905d6dd6c66fca235f40144d65db7234fd769
Opcode Fuzzy Hash: c2ed5789f868c68b1f47cf0c7976ca9e49e2de42e793f4521e1ce3075f05a869
Instruction Fuzzy Hash: E0B15F32B0AB4282EB209F16E5A066973A4FB45FC4F584535DAAD0B7B9DF3CD491C340

Function 00007FFDFB60B450 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_fs_code_page.LIBCPMT ref: 00007FFDFB60B4AF

Part of subcall function 00007FFDFB671D30: AreFileApisANSI.KERNEL32(?,?,?,?,00007FFDFB608708), ref: 00007FFDFB671D42

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60B6BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60B6C1

Strings

", ", xrefs: 00007FFDFB60B5AA
: ", xrefs: 00007FFDFB60B577

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 1190743560-747220369
Opcode ID: 8c89c7d122e534f9dee339fa2876868dcb4f4e0b7ee5407399f2af437675f0a4
Instruction ID: 54408af641032fd5b13ae4b33b948dbf415d076c8d0f553c25ac896e371d4d3d
Opcode Fuzzy Hash: 8c89c7d122e534f9dee339fa2876868dcb4f4e0b7ee5407399f2af437675f0a4
Instruction Fuzzy Hash: 2B716D72B15A468AEB00DF66D1607AD2371EB49BC8F148531EEAD1BBE9DF38D152C340

Function 00007FFDFB637040 Relevance: 7.6, APIs: 5, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32 ref: 00007FFDFB6370A2
getsockopt.WS2_32 ref: 00007FFDFB6370D9
_Xtime_get_ticks.LIBCPMT ref: 00007FFDFB637111
shutdown.WS2_32 ref: 00007FFDFB637163
closesocket.WS2_32 ref: 00007FFDFB63716F

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Xtime_get_ticksclosesocketgetsockoptselectshutdown
String ID:
API String ID: 3691980445-0
Opcode ID: c11567532b74d8886d3d7ded0112bccaaec703242630cc9581770f6b9352ed6a
Instruction ID: e46c3a728f7ec1a4e6cb3dcb62986c236588ca4650325a6bd49cff2c445d0784
Opcode Fuzzy Hash: c11567532b74d8886d3d7ded0112bccaaec703242630cc9581770f6b9352ed6a
Instruction Fuzzy Hash: 5E415F7370AA4685DB50CF25E4A4A2973A5EB84F94F188136DA6D4B7F8CF3CD445C700

Function 00007FFDFB683B50 Relevance: 7.6, APIs: 5, Instructions: 60
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB683B7B
CreateThread.KERNELBASE ref: 00007FFDFB683BBC
GetLastError.KERNEL32(?,?,?,?,?,00007FFDFB6199EE), ref: 00007FFDFB683BCA
CloseHandle.KERNEL32(?,?,?,?,?,00007FFDFB6199EE), ref: 00007FFDFB683BE0
FreeLibrary.KERNEL32(?,?,?,?,?,00007FFDFB6199EE), ref: 00007FFDFB683BEF

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 99777dbfb1ab3b35bd5ce1dbae2fe987180edb9c4937ced0f73f80d2fe3bb09c
Instruction ID: c14751c820ab7406b9c33b927a467b9daeb71eb98d650658bf69c4754cef973d
Opcode Fuzzy Hash: 99777dbfb1ab3b35bd5ce1dbae2fe987180edb9c4937ced0f73f80d2fe3bb09c
Instruction Fuzzy Hash: 00211D75B0AB4385EF14DB65A420979B3A4BF88B94F088535EE6D4B7B9DF3CE4408740

Function 00007FFDFB690F1C Relevance: 6.2, APIs: 4, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,?,00000000,00000000,00000000,00007FFDFB690F07), ref: 00007FFDFB691038
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,?,00000000,00000000,00000000,00007FFDFB690F07), ref: 00007FFDFB6910C3

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: cdbac25eb94036b68be2bf32beff7597bbd0c85076b4bc485098a4ff3e7edc18
Instruction ID: 92ed0aeb2e38ca95a23163d11e2088e428bb895bc527a7b19997d1bc14c72e0e
Opcode Fuzzy Hash: cdbac25eb94036b68be2bf32beff7597bbd0c85076b4bc485098a4ff3e7edc18
Instruction Fuzzy Hash: 0991F632F09653A5F7509F659461ABD3BA4BB04B8CF244139DE2E6B6E8CF39D482C700

Function 00007FFDFB609FA0 Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60A0B9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB60A0BF

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 6e0433e4903703358321312571658274a30d0a53fbf1085410c8f09ba746fe34
Instruction ID: d2b01f920546f7c33d8252b6c032d3045e1066d45628a8238ebdc916755a83dc
Opcode Fuzzy Hash: 6e0433e4903703358321312571658274a30d0a53fbf1085410c8f09ba746fe34
Instruction Fuzzy Hash: 7D71C162B0AB4681EB049F25E5502683360FB55BD8F589731DBBC0B6E9EF78E5E1C340

Function 00007FFDFB6023B0 Relevance: 6.2, APIs: 4, Instructions: 156COMMONLIBRARYCODE

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FFDFB60250B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB602583
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB602589
__std_exception_copy.LIBVCRUNTIME ref: 00007FFDFB6025C8

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: __std_exception_copy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3081569584-0
Opcode ID: cf2727a89a6df3fcf2f109d9cdc5695eeba21d53f9047657b31915a917fa9806
Instruction ID: ee600da4aa493e8f0270f99c098065ac111508b9f8b5e2ace186275af8d2668a
Opcode Fuzzy Hash: cf2727a89a6df3fcf2f109d9cdc5695eeba21d53f9047657b31915a917fa9806
Instruction Fuzzy Hash: AB518422B1AB8781EB119F15E5607B96360FF55798F148231EABC0A7E9EE7CE1D18700

Function 00007FFDFB6779BC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDFB6779E6

Strings

csm, xrefs: 00007FFDFB677B7A
csm, xrefs: 00007FFDFB677A0B

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 282cf80225fd299b1abca99f13e083387eb35b3b8e667bb542359d771bf21bed
Instruction ID: 7fcd17a561a5a099d10f1277334d42b8e9a00b3ecaa510e09d97faa6f200768f
Opcode Fuzzy Hash: 282cf80225fd299b1abca99f13e083387eb35b3b8e667bb542359d771bf21bed
Instruction Fuzzy Hash: 09719272A0A6838AD7608F25E464A7D7BA0EB04F89F249136DE5C4BAEDCF3CD551C740

Function 00007FFDFB6748F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDFB670E42), ref: 00007FFDFB674948
RaiseException.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FFDFB670E42), ref: 00007FFDFB674989

Strings

csm, xrefs: 00007FFDFB674976

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 6c0ee941a5fd2032a55f7790bdc9da8f6e480a48f6324f8c867cc612cbbbd1ec
Instruction ID: d3f0f541b67a101ff6dbd68d0579463a105ae64a65219299759ced6a505d4d76
Opcode Fuzzy Hash: 6c0ee941a5fd2032a55f7790bdc9da8f6e480a48f6324f8c867cc612cbbbd1ec
Instruction Fuzzy Hash: FE112E32619B8282EB618F15F85466977E4FB88B94F684234DBDD0B7A8DF3CD551CB00

Function 00007FFDFB636F70 Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

inet_pton.WS2_32 ref: 00007FFDFB636F8E
getaddrinfo.WS2_32 ref: 00007FFDFB636FA6
freeaddrinfo.WS2_32 ref: 00007FFDFB636FC8

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: freeaddrinfogetaddrinfoinet_pton
String ID:
API String ID: 1485407518-0
Opcode ID: 71f05dd9818d35825532a9016005242d26091936dfc728d4d261b762eb1db1fc
Instruction ID: 203f53e1e76726e0cfea59a8e24f5dc2b1cba258b094117a03648fdc6060c3e3
Opcode Fuzzy Hash: 71f05dd9818d35825532a9016005242d26091936dfc728d4d261b762eb1db1fc
Instruction Fuzzy Hash: 9BF0F662B1814283EB008F61E89452AA7A4EBC8B40F549030EA2E4B7A8CE3CC4D48A00

Function 00007FFDFB683A88 Relevance: 4.5, APIs: 3, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB68D6E8: GetLastError.KERNEL32(?,?,0000FBDB617AEA9A,00007FFDFB687021,?,?,?,?,00007FFDFB695AFA,?,?,00000000,00007FFDFB697537,?,?,?), ref: 00007FFDFB68D6F7
Part of subcall function 00007FFDFB68D6E8: SetLastError.KERNEL32(?,?,0000FBDB617AEA9A,00007FFDFB687021,?,?,?,?,00007FFDFB695AFA,?,?,00000000,00007FFDFB697537,?,?,?), ref: 00007FFDFB68D797

CloseHandle.KERNEL32(?,?,?,00007FFDFB683C35,?,?,?,?,00007FFDFB683A79), ref: 00007FFDFB683AC3
FreeLibraryAndExitThread.KERNELBASE(?,?,?,00007FFDFB683C35,?,?,?,?,00007FFDFB683A79), ref: 00007FFDFB683AD9
ExitThread.KERNEL32 ref: 00007FFDFB683AE2

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: bc521eb744b56d4d7c43ec361a909a3c4422a81733ababd830c44482d6106520
Instruction ID: 862033fb90e0ebf803b9616b775e732f0da88323835e917cf2e420e4e48ad6cd
Opcode Fuzzy Hash: bc521eb744b56d4d7c43ec361a909a3c4422a81733ababd830c44482d6106520
Instruction Fuzzy Hash: 7CF0EC21B0AA8781EF15AB2194A497D6355AF40F78F1C8735E63D0A2E8DF69D845C340

Function 00007FFDFB601AA0 Relevance: 3.9, APIs: 3, Instructions: 104sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FFDFB601BC8
Sleep.KERNEL32 ref: 00007FFDFB601BDB
Sleep.KERNEL32 ref: 00007FFDFB601C09

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f1f3be0d8289f931219a798eca4acb91415a810092496b3f375f625ec87347fc
Instruction ID: adee77b92d9b72f11d37bf528b7c639ffb3f63190e956f6c272b014928d43979
Opcode Fuzzy Hash: f1f3be0d8289f931219a798eca4acb91415a810092496b3f375f625ec87347fc
Instruction Fuzzy Hash: 8E31F441B0B38B01DE188B5BA4359B982519F85BD0F1C9036E9AE0F3F9FE3CE1415640

Function 00007FFDFB630EE0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB631156

Strings

exists, xrefs: 00007FFDFB631164

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: exists
API String ID: 3668304517-2996790960
Opcode ID: 557432e78ac4bb59e3dd722b2fb915ee1686ce18a60d76e7648752bb6f0d75b6
Instruction ID: b97f172ef63745226484ba5f914df567f559def9440aec152fd96ec71cf88c09
Opcode Fuzzy Hash: 557432e78ac4bb59e3dd722b2fb915ee1686ce18a60d76e7648752bb6f0d75b6
Instruction Fuzzy Hash: D3718D62B16A4396FB109B65C461AFC2361FB40788F548036DA2D6BBEDDF38E895C340

Function 00007FFDFB60A250 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6023B0: __std_exception_copy.LIBVCRUNTIME ref: 00007FFDFB60250B

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60A378

Strings

Unknown exception, xrefs: 00007FFDFB60A2D8

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID: Unknown exception
API String ID: 1109970293-410509341
Opcode ID: 272b772ca72e2427ca6ae95a7410aa6c99451e4cd49d01b1462d97e0007adf58
Instruction ID: de4622227bb3a00254536db52bde65e5c69871bb2c2fa0b4242dede2f9a1e636
Opcode Fuzzy Hash: 272b772ca72e2427ca6ae95a7410aa6c99451e4cd49d01b1462d97e0007adf58
Instruction Fuzzy Hash: 4331A462A19BC680DB108B28E4516A96360FB99BE8F145331EAAD467E9EF3CD180C300

Function 00007FFDFB6192B0 Relevance: 3.5, APIs: 2, Instructions: 549COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB619AEA
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB619B00

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 4fcbc9f217030a8848bf38beef8000aec68b2bb5a45489cf0f56deadd8864356
Instruction ID: 7b47ce579cc3525102f5f338af2f7070a213007f5d7e2c9ebd804f3690c3f2b4
Opcode Fuzzy Hash: 4fcbc9f217030a8848bf38beef8000aec68b2bb5a45489cf0f56deadd8864356
Instruction Fuzzy Hash: 3D423932706B8695EB64CF65D8A06EC37A4FB48F88F545036DA5E1BBA8DF38D585C300

Function 00007FFDFB61E8F0 Relevance: 3.2, APIs: 2, Instructions: 175COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61EBAA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61EBB0

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: f117e100b09410e0a1919b0bd5c4200c13b1afd9900784983f740f603c94a894
Instruction ID: 7ab83fd88ab74bbae70ef3993409fda5dc3e65bfa7e9e6a8ed75dd90801d144f
Opcode Fuzzy Hash: f117e100b09410e0a1919b0bd5c4200c13b1afd9900784983f740f603c94a894
Instruction Fuzzy Hash: 9261AB61B0A78751FF709B14A5207B96361FF45B94F449231EBBD0B6EEDE2CE0558B00

Function 00007FFDFB604790 Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FFDFB604FB9,?,?,?,?,00007FFDFB602E09,?,?,?,?,00007FFDFB6013A1), ref: 00007FFDFB6047ED
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFB60203C), ref: 00007FFDFB60480F

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: CurrentDirectoryFileModuleName
String ID:
API String ID: 3981628254-0
Opcode ID: f1b0872ea2d59bf33b17546a330973ff1834ffd44612060ebb7ed0de1d25a9d1
Instruction ID: a40d9af6146bd837de8f7cd9b4a7258fb2d314259bb937fd5b6a439046e95fdf
Opcode Fuzzy Hash: f1b0872ea2d59bf33b17546a330973ff1834ffd44612060ebb7ed0de1d25a9d1
Instruction Fuzzy Hash: CA716F32B0AB4282EB509F16D8A05697364FB85FC4B598532DAAD0B7F9DF3CD891C340

Function 00007FFDFB603E40 Relevance: 3.1, APIs: 2, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB603FCC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB603FD2

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d51f63c508b1c6f47152e6513895ae8384bcd36d7e021995f60aa0b87e8b8d1b
Instruction ID: ddfdf9118ad2dd5d04dd94bd05344114c7ed937b88c4b32af221cb48cee900bb
Opcode Fuzzy Hash: d51f63c508b1c6f47152e6513895ae8384bcd36d7e021995f60aa0b87e8b8d1b
Instruction Fuzzy Hash: 4741B322719B8681DB048F25E45476D7361FB8ABC4F149131EBAD0B7A9DF7CE4918300

Function 00007FFDFB6085B0 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6086C8
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6086CE

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: c6d4f628b08a21704d5fcb098e5f0cf7210ce84c82b8fb47dc30fe333833a882
Instruction ID: 277c79dfd21bfa3565f9f3f8b70a016c64e93c50a6e21ccba45390df77082846
Opcode Fuzzy Hash: c6d4f628b08a21704d5fcb098e5f0cf7210ce84c82b8fb47dc30fe333833a882
Instruction Fuzzy Hash: CF319821B1B74385EB249F52A5506B96260EB067F4F6D0B30DABD1F7EADE7CE4518300

Function 00007FFDFB60C070 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6726A8: GetLocaleInfoEx.KERNEL32 ref: 00007FFDFB6726CE
Part of subcall function 00007FFDFB6726A8: FormatMessageA.KERNELBASE ref: 00007FFDFB672701

LocalFree.KERNEL32 ref: 00007FFDFB60C0F4

Strings

error, xrefs: 00007FFDFB60C0BD

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: FormatFreeInfoLocalLocaleMessage
String ID: error
API String ID: 334183667-1574812785
Opcode ID: 462e93a2a7ea56a182f9dae578cb09aebdbf4b1920f62f982d4549374f346732
Instruction ID: 1f12b518051727f6ebfca732a0dab5e63d6800b0c0c2413e39ab562607cc692d
Opcode Fuzzy Hash: 462e93a2a7ea56a182f9dae578cb09aebdbf4b1920f62f982d4549374f346732
Instruction Fuzzy Hash: 1F01E52260974281D7108F25E450329B7A0EB95BD8F088135EA9D0F7ADDF3CD590CB00

Function 00007FFDFB671F90 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00007FFDFB631101), ref: 00007FFDFB671F9F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FFDFB631101), ref: 00007FFDFB671FB5

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 757ce9c9e08d4847cf2f9e5cc3410e908989f10ec60d5e69d6bf4818a7408166
Instruction ID: 7c898516e21fde4a6cb06fc72f3d1ea3657bc2b0b95fb1668daf5a71452ffada
Opcode Fuzzy Hash: 757ce9c9e08d4847cf2f9e5cc3410e908989f10ec60d5e69d6bf4818a7408166
Instruction Fuzzy Hash: 2D01A72170C68386EB105769F450B29A791DBD47D4F544035D9694A7E9DF7CC844CF00

Function 00007FFDFB683A18 Relevance: 3.0, APIs: 2, Instructions: 31threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFDFB683A26
ExitThread.KERNEL32 ref: 00007FFDFB683A2E

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 17418eb81ec3f01867f5d5f14eefeeead7987301525fe47a36211ace609e8039
Instruction ID: c2c36534a4a12962118af3c7a1787beeeb0c538395e7a94b3b31144f9263b266
Opcode Fuzzy Hash: 17418eb81ec3f01867f5d5f14eefeeead7987301525fe47a36211ace609e8039
Instruction Fuzzy Hash: 41F03026F1BA4346EF14AB71943597D12A4AF58B45F18D434E93A4F3FADF2CE8448340

Function 00007FFDFB636FE0 Relevance: 3.0, APIs: 2, Instructions: 27networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FFDFB636FFE
WSAGetLastError.WS2_32 ref: 00007FFDFB637009

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorLastsend
String ID:
API String ID: 1802528911-0
Opcode ID: f3e46029d5772f344bcda0da26d45a1d25a26c566ccafb9aacb14fb370f76f93
Instruction ID: 650b026ca00600be98795aa3904189cd69db5ce757dbcc34768c4dcebd783bfe
Opcode Fuzzy Hash: f3e46029d5772f344bcda0da26d45a1d25a26c566ccafb9aacb14fb370f76f93
Instruction Fuzzy Hash: 7EF015A2F0A40781EB645775A864C3922949B59B35F6C5330EA3D8A7F4DF2C98D58200

Function 00007FFDFB636E40 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00007FFDFB636E62
closesocket.WS2_32 ref: 00007FFDFB636E6E

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: closesocketshutdown
String ID:
API String ID: 572888783-0
Opcode ID: 2ff24bd5920609b28a39566270504161875c5185a9e5713c51adad6fe44eae40
Instruction ID: 4c0ee6748f804494d83117ee69cba3b015d046cfc86bd4b8fcddcf986a10fa59
Opcode Fuzzy Hash: 2ff24bd5920609b28a39566270504161875c5185a9e5713c51adad6fe44eae40
Instruction Fuzzy Hash: A5F0AC66B0590981DF109F66D8A56282364E799F74F549321DA3D4B3F4CF2CC89A8711

Function 00007FFDFB67329C Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6732CC
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6732D2

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2580385b278e020394163aac2d1191409e56aaf6b6bf7d391eac677159168c8f
Instruction ID: f94a82b77501c3e12851541bcdc71246bc0677720831d4c13f08f05213a8df0f
Opcode Fuzzy Hash: 2580385b278e020394163aac2d1191409e56aaf6b6bf7d391eac677159168c8f
Instruction Fuzzy Hash: 99E0BD40F1B60B86FB2822A229268B801849F093B0E2C1B309D3E4D2EBAD1CA4968124

Function 00007FFDFB68F150 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,07A1D02583480000,00007FFDFB69847E,?,?,?,00007FFDFB6987FB,?,?,00000000,00007FFDFB69792D,?,?,00007FFDFB68C2FE,00007FFDFB69785F), ref: 00007FFDFB68F166
GetLastError.KERNEL32(?,?,07A1D02583480000,00007FFDFB69847E,?,?,?,00007FFDFB6987FB,?,?,00000000,00007FFDFB69792D,?,?,00007FFDFB68C2FE,00007FFDFB69785F), ref: 00007FFDFB68F170

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: f11037f5edfbf42a9deee101c04b3b61a4e096c9f67bd90de0004014c67794f1
Instruction ID: 842c47199e582c78d85f6153d13ed98fd5e570b0cf43ca5a34fbef823f88ad42
Opcode Fuzzy Hash: f11037f5edfbf42a9deee101c04b3b61a4e096c9f67bd90de0004014c67794f1
Instruction Fuzzy Hash: 89E08660F1BA0346FF156BF19C7483512515F48B40B448834D93D5F2F9DF2CE8458210

Function 00007FFDFB6260C0 Relevance: 1.7, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB637040: select.WS2_32 ref: 00007FFDFB6370A2
Part of subcall function 00007FFDFB637040: getsockopt.WS2_32 ref: 00007FFDFB6370D9

_Xtime_get_ticks.LIBCPMT ref: 00007FFDFB626144

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Xtime_get_ticksgetsockoptselect
String ID:
API String ID: 1005471539-0
Opcode ID: 0d19c897b4ba49168a14ea28512a1af9b5bd5a11909fdbc67f7435003416c13b
Instruction ID: 67f8a06c1cc31f5e3a9274d4a5208afa35ce09d0f2fb30b7dbeefbfe97d6ec36
Opcode Fuzzy Hash: 0d19c897b4ba49168a14ea28512a1af9b5bd5a11909fdbc67f7435003416c13b
Instruction Fuzzy Hash: 8B617162B0A78382FF649B25E9605A963A1FB45BC4F444136CEAD4BBE9DF3CE551C300

Function 00007FFDFB60B730 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60B8D2

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: bb0296bee2c423671b67c711bb50c3c51c975d5a4596ff2d0be9e26b6d1aa91c
Instruction ID: efdc5a9045605bb94380d73bfda7def8aee3f6f67d81c3d65573d678ac422cfd
Opcode Fuzzy Hash: bb0296bee2c423671b67c711bb50c3c51c975d5a4596ff2d0be9e26b6d1aa91c
Instruction Fuzzy Hash: FD41A5B6B0A64682DB549B16D05067D37A0FB4DBD0F588631DBAD077E8DF78D492C700

Function 00007FFDFB60B2A0 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 00007FFDFB60B341

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: 3e70b05b9e45052def08f7674481f97674654eb7707a456d048aa7bb23f37626
Instruction ID: ff3721b7feff17dc00069f152653684ea170ce262c2c4b37757c18b826b2ac72
Opcode Fuzzy Hash: 3e70b05b9e45052def08f7674481f97674654eb7707a456d048aa7bb23f37626
Instruction Fuzzy Hash: 6941D726B1A60341FB648A16E4B0B7D1290EF9A7D4F5C8135D9BF8B6EDDD3CE9418700

Function 00007FFDFB60A520 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60A608

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e1cd14a13005fc96928d26870f00520be21b7431fcab899014090829d16f7556
Instruction ID: fad6d55e9e92c5c310379ecf2e1d664f111832a149af561794fa69cdecf806b8
Opcode Fuzzy Hash: e1cd14a13005fc96928d26870f00520be21b7431fcab899014090829d16f7556
Instruction Fuzzy Hash: 86215E22716A4681EB15DF66D06077C63A0FB89FC8F188535DE9E0B7ADCE38D8518340

Function 00007FFDFB675148 Relevance: 1.6, APIs: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlUnwindEx.NTDLL ref: 00007FFDFB67524C

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Unwind
String ID:
API String ID: 3419175465-0
Opcode ID: b8ff46583accbce3905757664e7e3a7c093d0a25e9bb5b7fa43e3e971774cc07
Instruction ID: 63ddb22ea72b17fb9c9f111596f9b3b0113aa32fd80c6c3a17596b159e3cf782
Opcode Fuzzy Hash: b8ff46583accbce3905757664e7e3a7c093d0a25e9bb5b7fa43e3e971774cc07
Instruction Fuzzy Hash: 1731D727A15F848AE740CF68E5512AC37B4F798B48F15A215DF8C16726EF35E1A5C340

Function 00007FFDFB636870 Relevance: 1.6, APIs: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB673D60: AcquireSRWLockExclusive.KERNEL32(?,?,?,00007FFDFB658054,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00007FFDFB673D70

WSAStartup.WS2_32 ref: 00007FFDFB636963

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: AcquireExclusiveLockStartup
String ID:
API String ID: 2099235001-0
Opcode ID: 88d748167582de356a28182cb4cea580d1f3321c7efc9fbc1cbf8e7f2d389bbb
Instruction ID: 683529a69f990dd942f0d7e4ac186e74c482f1cd1eab126912bc3eaec7b89913
Opcode Fuzzy Hash: 88d748167582de356a28182cb4cea580d1f3321c7efc9fbc1cbf8e7f2d389bbb
Instruction Fuzzy Hash: 4531EE22E1AB8382F710DB10D9617B82720FBE9714F566336DABD063F5DF68A5D18300

Function 00007FFDFB602BC0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB602C18

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 482ce59d7e8c258f1327ccc8b09f5aec7ad2a54863282383d8443bd07c7a2b6b
Instruction ID: a7f370a7eb9ad25f0bbdbc5d29f4c218dac1ae03e04d563cc76f1e4a7bd50d46
Opcode Fuzzy Hash: 482ce59d7e8c258f1327ccc8b09f5aec7ad2a54863282383d8443bd07c7a2b6b
Instruction Fuzzy Hash: E1119172B11A8A82EB54AF2AD49473D2351EB46F98F1C8031CA6D0F7E9CF2CC8818740

Function 00007FFDFB608500 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6085A2

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: b3a4cf01d8e3b0bbd9f93e6e1181de7a736276568b9d6cf326aa00229b550730
Instruction ID: 3fb70c5a580a5f659d655c43e29fea2c13e40aba44ca05ad37e8a0640a0f5518
Opcode Fuzzy Hash: b3a4cf01d8e3b0bbd9f93e6e1181de7a736276568b9d6cf326aa00229b550730
Instruction Fuzzy Hash: D101E9A2B1964341EF10DB15E45127E6361EB8ABE4F185332EBBD0B7EDEE2CD0C18600

Function 00007FFDFB60BEF0 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB60BF70

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: fff385fa39524c2d2563ba7ec1d471bf166fab1a67f7869e259a0ccbfe3ed554
Instruction ID: e2d712f0120ea9acddea84100d1eeb1609b5764e10812a63284d5010ee2c5e48
Opcode Fuzzy Hash: fff385fa39524c2d2563ba7ec1d471bf166fab1a67f7869e259a0ccbfe3ed554
Instruction Fuzzy Hash: 46018461A1AB4282E701DB61E061BB66290FF98384F489134FAAE0A3E9DF3CD1558B00

Function 00007FFDFB60BAF0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60BB4B

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: ccdc006c7259c2f4ffcc47a8514a4352897b42faacfe0ab8532af73d0d23ac09
Instruction ID: dc08e0b2c091734460ba08895b29730e54e560c65b963fddf939e9f487cfd87a
Opcode Fuzzy Hash: ccdc006c7259c2f4ffcc47a8514a4352897b42faacfe0ab8532af73d0d23ac09
Instruction Fuzzy Hash: DDF082A1B1268691EF089B29D09577C23A1EB09FC8F689031CB6D4A6ADDF6DD9D1C340

Function 00007FFDFB60ACA0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60ACDC

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: a873d3e6ffc528d8c2f8a5a0f89adec08bdcbb6ee6f3ff6513724ac88ae8373e
Instruction ID: 291499378a2daf9aa27ea1d155660ea0d05e90cf0df7fd5171886c1b354af5f0
Opcode Fuzzy Hash: a873d3e6ffc528d8c2f8a5a0f89adec08bdcbb6ee6f3ff6513724ac88ae8373e
Instruction Fuzzy Hash: B6F0A051B5A50782EE14976A94A57BC12419F8ABF4F684331DA7D0E3EACD1CA0C29304

Function 00007FFDFB636BB0 Relevance: 1.5, APIs: 1, Instructions: 35networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB636F70: inet_pton.WS2_32 ref: 00007FFDFB636F8E
Part of subcall function 00007FFDFB636F70: getaddrinfo.WS2_32 ref: 00007FFDFB636FA6

htons.WS2_32 ref: 00007FFDFB636C02

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: getaddrinfohtonsinet_pton
String ID:
API String ID: 885370656-0
Opcode ID: 675e6b29f07a634f173ce4ed76fad9e3ff1f631715f922197fbe8067e59944f3
Instruction ID: daed3a8507a2e4b65e455e3cfb548d2fff2a18ceed887647f05c77fbbc666771
Opcode Fuzzy Hash: 675e6b29f07a634f173ce4ed76fad9e3ff1f631715f922197fbe8067e59944f3
Instruction Fuzzy Hash: 94F08656B1D69241FB209B16B86167AA370FF8CB89F044132FE9D4B7A9DE3CC4418B44

Function 00007FFDFB636C40 Relevance: 1.5, APIs: 1, Instructions: 34networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FFDFB636C86

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: htons
String ID:
API String ID: 4207154920-0
Opcode ID: 68e015f56d0d515fe3b16cf67434ce09b7f2f23037adfaa1b3f2e0eccb9a7a39
Instruction ID: 68089296a1b2a567bb98818b46fd832dbe597d0fb991d99018210def3e96be5b
Opcode Fuzzy Hash: 68e015f56d0d515fe3b16cf67434ce09b7f2f23037adfaa1b3f2e0eccb9a7a39
Instruction Fuzzy Hash: CDF08666B1969582EB109B26F46576AB360FF8CB89F004132FA8D4B799DF3CC441CB44

Function 00007FFDFB68A610 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB68A624

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 681bac6248219897df9d84beb0d65650723fa7027b7ad84f42809d3d983647d3
Instruction ID: ad690ab76139f88b2f5095c326bd8c7c1feb000ade30d566c242eedd7a4f3674
Opcode Fuzzy Hash: 681bac6248219897df9d84beb0d65650723fa7027b7ad84f42809d3d983647d3
Instruction Fuzzy Hash: FEE01261F0B90386FB106B908461BBD12505F44724F90D434DA2C4F2EFCE6EE5466771

Function 00007FFDFB608250 Relevance: 1.5, APIs: 1, Instructions: 17threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FFDFB608276

Part of subcall function 00007FFDFB683854: SetConsoleCtrlHandler.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFB68A80C), ref: 00007FFDFB6838D8

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ConsoleCreateCtrlHandlerThread
String ID:
API String ID: 4150460699-0
Opcode ID: 2e3714b9488ae62c7fe38ac2feb3e2868cd5c09b0a238fcad1db31fdf8a4d57a
Instruction ID: 31a5bd9abf27b8cc827ff74cf6ef54b09b6296a62138c2a57e7e62cab3104549
Opcode Fuzzy Hash: 2e3714b9488ae62c7fe38ac2feb3e2868cd5c09b0a238fcad1db31fdf8a4d57a
Instruction Fuzzy Hash: ADE04F60F0AE4391EB14DB11A826BA57394BF88384FC8803AC5AD0A2F8DF3CD209C740

Function 00007FFDFB605EE0 Relevance: 1.5, APIs: 1, Instructions: 14threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FFDFB605EFD

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 6963fcda02c1b1e02f4fd61dab9834b1fe81f6c4201c8230bdf58792cfaa221d
Instruction ID: 9514d95a112fb8406d18faefa7230c09482e01e0f560ecbbf70617da0498bbae
Opcode Fuzzy Hash: 6963fcda02c1b1e02f4fd61dab9834b1fe81f6c4201c8230bdf58792cfaa221d
Instruction Fuzzy Hash: 27E0EC32F0AF4282E7148B31BC2196632A5BB88754B144336D9AD867B8EF3C91518600

Function 00007FFDFB672028 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 00007FFDFB672032

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: ac43dd58bc682948c35146ec3914bd8b1b9b9f8f5cc3ff0fde307912eb9bfecb
Instruction ID: f33c5d7edcc83bacc2f76427c0da7d2d7ca84c897d768bcbb9bb702f46a4b7fa
Opcode Fuzzy Hash: ac43dd58bc682948c35146ec3914bd8b1b9b9f8f5cc3ff0fde307912eb9bfecb
Instruction Fuzzy Hash: 6BC08C24F0B40382EBA83B351CB5C301590DF12738FB40734D63C4C4FAAD1CA4D68121

Function 00007FFDFB672008 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,?,?,00007FFDFB60B918), ref: 00007FFDFB67200C

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 1c4175096d54c4dc926e5d01b109e57cb083de561e3d50d74dca1b3961808497
Instruction ID: 93d684327bc8c9e5b3ca28d1a19c78bdddc7b3ae012fca8262ac93276b68d8eb
Opcode Fuzzy Hash: 1c4175096d54c4dc926e5d01b109e57cb083de561e3d50d74dca1b3961808497
Instruction Fuzzy Hash: E2C04C14F1B503C9EF542B665C925251594AB55B49F904034C1398D1A4DD1C95E7CA21

Function 00007FFDFB68F18C Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FFDFB68D74A,?,?,0000FBDB617AEA9A,00007FFDFB687021,?,?,?,?,00007FFDFB695AFA,?,?,00000000), ref: 00007FFDFB68F1E1

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: f64346e72675fa8aad3f9e120cb5e669997a02d7599356c5ffd5529e6dc6746f
Instruction ID: 11e00e4def92da925efd74cc7e8e49c29e52677fc4cae7afa52e83d93873ed54
Opcode Fuzzy Hash: f64346e72675fa8aad3f9e120cb5e669997a02d7599356c5ffd5529e6dc6746f
Instruction Fuzzy Hash: 6EF06D70B0BA0341FF5A5B61D870AB513955F89B80F0C9834CD6E8E7F9DE2CE5858220

Function 00007FFDFB692A30 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FFDFB695AE1,?,?,00000000,00007FFDFB697537,?,?,?,00007FFDFB68C027,?,?,?,00007FFDFB68BF1D), ref: 00007FFDFB692A6E

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: d9c19b20f6bc403a7affa7417bac8794d25fd13905217543c5607bb5ec217786
Instruction ID: 2345d55a3a6b23c763e9757cb745ff43ed84e9a07eb26bcfb500878a35a95208
Opcode Fuzzy Hash: d9c19b20f6bc403a7affa7417bac8794d25fd13905217543c5607bb5ec217786
Instruction Fuzzy Hash: CFF0FE92F0B64745FF6877615861A7521845F447A8F085A34DD3E8E2F9DE2CE4415224

Non-executed Functions

Function 00007FFDFB679760 Relevance: 85.0, APIs: 33, Strings: 15, Instructions: 1002COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB679803
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB6798BE
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67992C
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67994D
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB6799A0
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB6799CE

Strings

protected: , xrefs: 00007FFDFB67A591
`template static data member constructor helper', xrefs: 00007FFDFB67A465
/, xrefs: 00007FFDFB67A4B2
public: , xrefs: 00007FFDFB67A5BE
}' , xrefs: 00007FFDFB6799A5, 00007FFDFB67A0D1
[thunk]:, xrefs: 00007FFDFB67A654
virtual , xrefs: 00007FFDFB679B9B
extern "C" , xrefs: 00007FFDFB67A6AC
private: , xrefs: 00007FFDFB679C2C
`local static destructor helper', xrefs: 00007FFDFB67A424
`adjustor{, xrefs: 00007FFDFB67A0A6
`vtordispex{, xrefs: 00007FFDFB679FB3
static , xrefs: 00007FFDFB679B0E
`template static data member destructor helper', xrefs: 00007FFDFB67A4AB
`vtordisp{, xrefs: 00007FFDFB67A047

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: /$[thunk]:$`adjustor{$`local static destructor helper'$`template static data member constructor helper'$`template static data member destructor helper'$`vtordispex{$`vtordisp{$extern "C" $private: $protected: $public: $static $virtual $}'
API String ID: 2943138195-2884338863
Opcode ID: 960fc956296f137f6efaad2bc03ebe0093a768204d11612e8ec5e73ebe96abf4
Instruction ID: 7202fb82b1b0995a675e46011e210d3ab82eea40753417bf52efb002974c940c
Opcode Fuzzy Hash: 960fc956296f137f6efaad2bc03ebe0093a768204d11612e8ec5e73ebe96abf4
Instruction Fuzzy Hash: 20A27272B2978396E710DB14F4A09AEB7A0FB84344F641035EA998BAEDDF7CD544CB40

Function 00007FFDFB67B6C0 Relevance: 51.4, APIs: 26, Strings: 3, Instructions: 676COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67B7E1
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67B80C
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67BA56
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67BA7E
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67BA8F
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67BAB7
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67BAC8
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67C0F9
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67C10A
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67C118

Strings

const , xrefs: 00007FFDFB67BD7A
volatile , xrefs: 00007FFDFB67BD20
&& , xrefs: 00007FFDFB67BE23

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: && $const $volatile
API String ID: 2943138195-2785535105
Opcode ID: 963915be2bf3a9ec657c5b3728676a4033c95082d2efe9328b97ef3b1314b07c
Instruction ID: 6a7d908b06820be67df1af692932b599d8ff2254f183144d1cad60fdedff416a
Opcode Fuzzy Hash: 963915be2bf3a9ec657c5b3728676a4033c95082d2efe9328b97ef3b1314b07c
Instruction Fuzzy Hash: 80625276B19B8385E720CB14E4A05ADB7A0FB88784F645136EA9D4BAEDDF3CD544CB00

Function 00007FFDFB6337C0 Relevance: 39.4, APIs: 14, Strings: 8, Instructions: 936COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB672480: __std_fs_open_handle.LIBCPMT ref: 00007FFDFB6724C0
Part of subcall function 00007FFDFB672480: SetFileInformationByHandle.KERNEL32 ref: 00007FFDFB6724EA
Part of subcall function 00007FFDFB672480: CloseHandle.KERNEL32 ref: 00007FFDFB67253C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB633E56
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB633E75
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB633E81
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB633EDF

Strings

ios_base::failbit set, xrefs: 00007FFDFB633E98
, xrefs: 00007FFDFB634445
exists, xrefs: 00007FFDFB633E68
ios_base::eofbit set, xrefs: 00007FFDFB633E9F
, xrefs: 00007FFDFB634681
, xrefs: 00007FFDFB6342B3
ios_base::badbit set, xrefs: 00007FFDFB633E8C
, xrefs: 00007FFDFB633806

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Handle$CloseConcurrency::cancel_current_taskFileInformation__std_fs_open_handle
String ID: $ $ $ $exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3306587042-2910608515
Opcode ID: bd9c39b21e110216a2712acc8f261fb5a4c078b0c837f5ec32435def3da59bf1
Instruction ID: c716eb28b5f1161ce91a1eca7c1bfe80eb64ed579c97388676df93a9ac008e7d
Opcode Fuzzy Hash: bd9c39b21e110216a2712acc8f261fb5a4c078b0c837f5ec32435def3da59bf1
Instruction Fuzzy Hash: C392B322B1AA8285EB208F25D4607FD6361FB85798F545231EAAD4BBEDDF3CD581C700

Function 00007FFDFB60C260 Relevance: 25.1, APIs: 13, Strings: 1, Instructions: 632COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 00007FFDFB60C315
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FFDFB60C376
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FFDFB60C454
__std_fs_code_page.LIBCPMT ref: 00007FFDFB60C52D
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FFDFB60C58C
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FFDFB60C669
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60CD74
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60CD7A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60CD9F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB60CDAA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60CDAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60CDBA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60CDC0

Strings

", xrefs: 00007FFDFB60CBAC

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_fs_convert_wide_to_narrow$__std_fs_code_page$Concurrency::cancel_current_task
String ID: "
API String ID: 3550869863-123907689
Opcode ID: 233daeabd1cd8c1018619fb52947abdea5615b9b39a6af41623cdf1516a90b68
Instruction ID: 87793c7f1f19999f5ca060b0318ef0c6af90e5fecf76b34ca1cb594975703056
Opcode Fuzzy Hash: 233daeabd1cd8c1018619fb52947abdea5615b9b39a6af41623cdf1516a90b68
Instruction Fuzzy Hash: D1527272B1AAC641EB209B16E4607EAA751FB8A7D4F545231DAED0BAEDDF3CD041C700

Function 00007FFDFB69ACE8 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FFDFB69AD36
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB69B3A2
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB69B518
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB69B7D6
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB69B9F6
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB69BC33
memcpy_s.LIBCPMT ref: 00007FFDFB69BD0E
memcpy_s.LIBCPMT ref: 00007FFDFB69BDB9
memcpy_s.LIBCPMT ref: 00007FFDFB69BE88

Strings

1#SNAN, xrefs: 00007FFDFB69AE46
1#QNAN, xrefs: 00007FFDFB69AE4F
1#IND, xrefs: 00007FFDFB69AE23
1#INF, xrefs: 00007FFDFB69AE5F

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 4c74ba6f1e82afe78f0777f859f0492d91bf5cd1da6bd2d05ca870d785e406f4
Instruction ID: d4fa4d8f2ed5b54f993e833444a5b16361f42cc6398fd9b64c5af21295816b2b
Opcode Fuzzy Hash: 4c74ba6f1e82afe78f0777f859f0492d91bf5cd1da6bd2d05ca870d785e406f4
Instruction Fuzzy Hash: 02B2C576B1A2878BE7248E64D460BFD37A1FB4874CF545135DA2D5BAECDB38A900CB40

Function 00007FFDFB62AA90 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 302COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB62ABFC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB62AC02
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB62ACEE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB62AEDE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB62AEE4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB62AEEA

Strings

HMAC(, xrefs: 00007FFDFB62AD53
unknown, xrefs: 00007FFDFB62AF0A
/, xrefs: 00007FFDFB62AAE6
AES, xrefs: 00007FFDFB62AAC7
DHC, xrefs: 00007FFDFB62AC5E
CBC, xrefs: 00007FFDFB62AB1A

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: /$AES$CBC$DHC$HMAC($unknown
API String ID: 3668304517-2398975054
Opcode ID: de3f59454ef7c93f2774429c72d0e42d2c1bfbde8c1ae50c8f05b541a39c93da
Instruction ID: af6d0b667975a4190f03b3baaa07987b10f4efbaab63785921dfb8f42b64dfc7
Opcode Fuzzy Hash: de3f59454ef7c93f2774429c72d0e42d2c1bfbde8c1ae50c8f05b541a39c93da
Instruction Fuzzy Hash: 6CD18562F19B8685EB00CB24E4517AD7361FB95794F109321EAAC0BBEADF7CD181C740

Function 00007FFDFB6683D0 Relevance: 20.2, Strings: 16, Instructions: 225COMMON

Download Yara Rule

Strings

Cent, xrefs: 00007FFDFB668651
Genu, xrefs: 00007FFDFB6684A6
enti, xrefs: 00007FFDFB668562
nGen, xrefs: 00007FFDFB66859A
VIA2, xrefs: 00007FFDFB668672
uine, xrefs: 00007FFDFB66858E
Auth, xrefs: 00007FFDFB668551
ter!, xrefs: 00007FFDFB66857A
sbet, xrefs: 00007FFDFB668572
Hygo, xrefs: 00007FFDFB668581
aurH, xrefs: 00007FFDFB668666
AMDi, xrefs: 00007FFDFB668569
ntel, xrefs: 00007FFDFB6684B3
auls, xrefs: 00007FFDFB66865A
cAMD, xrefs: 00007FFDFB66855A
ineI, xrefs: 00007FFDFB6684BF

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: AMDi$Auth$Cent$Genu$Hygo$VIA2$auls$aurH$cAMD$enti$ineI$nGen$ntel$sbet$ter!$uine
API String ID: 0-2699536740
Opcode ID: 3b72357e12d661d4ddf3bf7e98ce3c41f974fa0f157da889232cb4ddb76a246d
Instruction ID: 54fcf822ace00e6ae42c8fc535029352cd77c3323928aea9c409b4537b352154
Opcode Fuzzy Hash: 3b72357e12d661d4ddf3bf7e98ce3c41f974fa0f157da889232cb4ddb76a246d
Instruction Fuzzy Hash: 31A1D222F1E2934EF71887759821ABD2BB26F25344F58403BD8A99E7FACE1CB541C311

Function 00007FFDFB628810 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 331COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6756BC: __unDName.LIBVCRUNTIME ref: 00007FFDFB67570F

Part of subcall function 00007FFDFB6756BC: InterlockedPushEntrySList.KERNEL32 ref: 00007FFDFB675797

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB628D36
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB628D42
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB628D48
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB628D4E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB628D54
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB628D5A

Part of subcall function 00007FFDFB601730: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6018A3
Part of subcall function 00007FFDFB601730: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6018A9

Strings

NameValuePairs: type mismatch for ', xrefs: 00007FFDFB6288A9
', stored ', xrefs: 00007FFDFB6288F4, 00007FFDFB628916
SubgroupGenerator, xrefs: 00007FFDFB628813
#, xrefs: 00007FFDFB6288A0
', trying to retrieve ', xrefs: 00007FFDFB6289E9, 00007FFDFB628A0E

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskEntryInterlockedListNamePush__un
String ID: #$', stored '$', trying to retrieve '$NameValuePairs: type mismatch for '$SubgroupGenerator
API String ID: 1741147312-2170633926
Opcode ID: 5320fef91ff1fe629345609f8603af62de21104dcf472f51f2d52004c03f4725
Instruction ID: 0517f34af73bdc778764bc125459ea08bc57839adb02fa4ba75dd2ef67d32f88
Opcode Fuzzy Hash: 5320fef91ff1fe629345609f8603af62de21104dcf472f51f2d52004c03f4725
Instruction Fuzzy Hash: 7EE19362F19B8685FB00CB64D8507AD6761FB99794F509331EEAC1A7EADF78E184C300

Function 00007FFDFB6647C0 Relevance: 17.0, APIs: 7, Strings: 2, Instructions: 1234COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB665A1B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB665A21
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB665A27
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB665A2D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB665A33
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB665A39
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB665A3F

Part of subcall function 00007FFDFB63EB60: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB63EC09

Strings

gfffffff, xrefs: 00007FFDFB665667
gfffffff, xrefs: 00007FFDFB665401

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task_invalid_parameter_noinfo
String ID: gfffffff$gfffffff
API String ID: 4144643359-161084747
Opcode ID: 6152d5daaabe515bbe2c925a5567c5577517ace25716d1a51408f83415d9d61d
Instruction ID: 1e96c92d64ac4023ef76a67899b4bdb62ba8242d56e2094e60f8ff04f1f822ef
Opcode Fuzzy Hash: 6152d5daaabe515bbe2c925a5567c5577517ace25716d1a51408f83415d9d61d
Instruction Fuzzy Hash: 46B28C72B15A868AEB10CF26D5646ED6762FB85BC8F044132DA5E4FBADDF38E544C300

Function 00007FFDFB64BB10 Relevance: 16.5, Strings: 12, Instructions: 1528COMMON

Download Yara Rule

Strings

PointerToPrimeSelector, xrefs: 00007FFDFB64C616
EquivalentTo, xrefs: 00007FFDFB64BE00
RandomNumberType, xrefs: 00007FFDFB64BFBA
Integer: missing Max argument, xrefs: 00007FFDFB64D1AD
Seed, xrefs: 00007FFDFB64C008
Integer: Min must be no greater than Max, xrefs: 00007FFDFB64D1E8
Min, xrefs: 00007FFDFB64BB70
BitLength, xrefs: 00007FFDFB64BC1C
Integer: invalid RandomNumberType argument, xrefs: 00007FFDFB64D137
Max, xrefs: 00007FFDFB64BBF7
Mod, xrefs: 00007FFDFB64BE2A
Integer: invalid EquivalentTo and/or Mod argument, xrefs: 00007FFDFB64D172

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: BitLength$EquivalentTo$Integer: Min must be no greater than Max$Integer: invalid EquivalentTo and/or Mod argument$Integer: invalid RandomNumberType argument$Integer: missing Max argument$Max$Min$Mod$PointerToPrimeSelector$RandomNumberType$Seed
API String ID: 2573137834-484113829
Opcode ID: b2739d95b21fca1f4215a032039f21fd4c22d5711a200a054858df05db96091d
Instruction ID: c827d2d9a080eed5b1e57035d189eb0d0437f62b60e069e18c4ad6e6da9e08c1
Opcode Fuzzy Hash: b2739d95b21fca1f4215a032039f21fd4c22d5711a200a054858df05db96091d
Instruction Fuzzy Hash: E7E27D72B0AA8785EB60CF65C460BE923A1FB85798F545132DA2D4BBEDDF38D645C300

Function 00007FFDFB634E50 Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 566COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB63514A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB635150

Strings

, xrefs: 00007FFDFB63565D
, xrefs: 00007FFDFB634E86

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: e6a12e82bb29877c1af8846ed27c1c05fba44faf1b73e8ced408a70cc7c6782b
Instruction ID: 5f877cbeefba0387132292e328190a19b6dffc605d051db9478a6cd824ba4d33
Opcode Fuzzy Hash: e6a12e82bb29877c1af8846ed27c1c05fba44faf1b73e8ced408a70cc7c6782b
Instruction Fuzzy Hash: 12320362B1AB8285EB10CB64D464BBD6361FB85794F584235EAAD4BBEDDF3CD481C300

Function 00007FFDFB61FD60 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 545COMMON

Download Yara Rule

Strings

{}.{}.{}.{}:{}, xrefs: 00007FFDFB61FDB9
:::, xrefs: 00007FFDFB620317
{:x}, xrefs: 00007FFDFB6200DC
[{}]:{}, xrefs: 00007FFDFB620435

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: :::$[{}]:{}${:x}${}.{}.{}.{}:{}
API String ID: 0-2927033935
Opcode ID: d08cdd1ccda687c2c3afedb5d2e9a313da8b6d5a66edc85ca7bf703770bd7577
Instruction ID: efa36dca214c4d000c2ac7854c62e7f066c2ff73b398eb2bdfa2c210cea04fb0
Opcode Fuzzy Hash: d08cdd1ccda687c2c3afedb5d2e9a313da8b6d5a66edc85ca7bf703770bd7577
Instruction Fuzzy Hash: ED32F122B1A79299FB11CB719420BAD37A0FB45788F104236EEAD1BBE9DB3DD541C300

Function 00007FFDFB636390 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 254threadCOMMON

Download Yara Rule

APIs

_Xtime_get_ticks.LIBCPMT ref: 00007FFDFB6363D8
GetCurrentThreadId.KERNEL32 ref: 00007FFDFB6365C0
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB636705
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB63670B
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB636742
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB63674D
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB636758

Part of subcall function 00007FFDFB672B90: GetNativeSystemInfo.KERNEL32 ref: 00007FFDFB672B99

Strings

Divisor is zero; invalid parameters for PoW., xrefs: 00007FFDFB636717

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentInfoNativeSystemThreadXtime_get_ticks_invalid_parameter_noinfo_noreturn
String ID: Divisor is zero; invalid parameters for PoW.
API String ID: 1900549356-3674321665
Opcode ID: 242d1100e05bd6c9e254b7558ee42e158a53b5af51712946743ab1daa085a446
Instruction ID: 485207eabda20a54c65491218d6007ebbfa79a1b088b1dba1f6f759db026c216
Opcode Fuzzy Hash: 242d1100e05bd6c9e254b7558ee42e158a53b5af51712946743ab1daa085a446
Instruction Fuzzy Hash: EEB1D422B0AB8681FB018B28D9146E967A0FF45794F549231EE6C1B7E9EF3CE5C1C700

Function 00007FFDFB621FA0 Relevance: 11.2, APIs: 3, Strings: 3, Instructions: 723COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6060A0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6061E8
Part of subcall function 00007FFDFB6060A0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6061EE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB622466
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB62246C

Strings

inv, xrefs: 00007FFDFB62219B
pong, xrefs: 00007FFDFB622931
object, xrefs: 00007FFDFB622606

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: inv$object$pong
API String ID: 3936042273-4231517554
Opcode ID: 87a6493ee3d1886c5dc275717d76ed95bfdc28a9e973ca4cd1a4cb2671b59c1f
Instruction ID: 7a12868d67acb8f8ae5992e90191fe81f23e0cf2fbc4ff2df6f446b971131162
Opcode Fuzzy Hash: 87a6493ee3d1886c5dc275717d76ed95bfdc28a9e973ca4cd1a4cb2671b59c1f
Instruction Fuzzy Hash: 3662E262B1E6C282EB10DB65E4505AEA760FB987D4F544235EAEE0BBEDDF2CD045C700

Function 00007FFDFB6993F8 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDFB68D570: GetLastError.KERNEL32 ref: 00007FFDFB68D57F
Part of subcall function 00007FFDFB68D570: FlsGetValue.KERNEL32 ref: 00007FFDFB68D594
Part of subcall function 00007FFDFB68D570: SetLastError.KERNEL32 ref: 00007FFDFB68D61F

TranslateName.LIBCMT ref: 00007FFDFB699462
TranslateName.LIBCMT ref: 00007FFDFB69949D
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FFDFB68E0F4), ref: 00007FFDFB6994E4
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FFDFB68E0F4), ref: 00007FFDFB69951C
GetLocaleInfoW.KERNEL32 ref: 00007FFDFB6996D9

Strings

utf8, xrefs: 00007FFDFB699600

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 49ded6ac914bdd7bbad0fbaa8655bda7fb920357ca3513ee042515aebd278f70
Instruction ID: 471cad388bd14b643ad9ced33aecfab72e7ccf713387892b0921cb939d31e00e
Opcode Fuzzy Hash: 49ded6ac914bdd7bbad0fbaa8655bda7fb920357ca3513ee042515aebd278f70
Instruction Fuzzy Hash: A9919D32B0A74385EB249F21D461AB923A4EF44B88F448135DA6C4F7EAEF3DE955C700

Function 00007FFDFB699E40 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDFB68D570: GetLastError.KERNEL32 ref: 00007FFDFB68D57F
Part of subcall function 00007FFDFB68D570: FlsGetValue.KERNEL32 ref: 00007FFDFB68D594
Part of subcall function 00007FFDFB68D570: SetLastError.KERNEL32 ref: 00007FFDFB68D61F

Part of subcall function 00007FFDFB68D570: FlsSetValue.KERNEL32 ref: 00007FFDFB68D5B5

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FFDFB699FB0

Part of subcall function 00007FFDFB68D570: FlsSetValue.KERNEL32 ref: 00007FFDFB68D5E2
Part of subcall function 00007FFDFB68D570: FlsSetValue.KERNEL32 ref: 00007FFDFB68D5F3
Part of subcall function 00007FFDFB68D570: FlsSetValue.KERNEL32 ref: 00007FFDFB68D604

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FFDFB68E0ED), ref: 00007FFDFB699F97
ProcessCodePage.LIBCMT ref: 00007FFDFB699FDA
IsValidCodePage.KERNEL32 ref: 00007FFDFB699FEC
IsValidLocale.KERNEL32 ref: 00007FFDFB69A002
GetLocaleInfoW.KERNEL32 ref: 00007FFDFB69A05E
GetLocaleInfoW.KERNEL32 ref: 00007FFDFB69A07A

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 6bd6ae66028dacdd368c07ed33241e7c999addca86feab7801735da85c82ba6b
Instruction ID: 69bba4acd4d9dde50d92effa10751ca9ce1be094de9cca9957f9f5589fbca1ee
Opcode Fuzzy Hash: 6bd6ae66028dacdd368c07ed33241e7c999addca86feab7801735da85c82ba6b
Instruction Fuzzy Hash: D4716922B0A60389FF509B64D860ABD77B4AF48B4CF448435CA2D4B6E9EF3DE845C351

Function 00007FFDFB6740B8 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFB6740D4
RtlCaptureContext.KERNEL32 ref: 00007FFDFB674101
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFB67411B
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFB67415C
IsDebuggerPresent.KERNEL32 ref: 00007FFDFB6741B0
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB6741CD
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB6741D8

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: fce3fad4e658a5f31667ce0b9cef0c56bdd04b7ff759e0a301e8b793741a1bfc
Instruction ID: 4702e287954a650d127f1b795b81a7d181d0c871017a4621ddfe8fc492859b7d
Opcode Fuzzy Hash: fce3fad4e658a5f31667ce0b9cef0c56bdd04b7ff759e0a301e8b793741a1bfc
Instruction Fuzzy Hash: 96314F76705B8286EB609F60E8A4BE97364FB84748F44403ADB5D4BBA8DF3CD548C710

Function 00007FFDFB681648 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFDFB6816C1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFB6816D9
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFB681714
IsDebuggerPresent.KERNEL32 ref: 00007FFDFB68174D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB681757
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB681762

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 030991f1092f9a0d968cfc55bded795b95ac8ca4e2dc8021679d52bb4764a83a
Instruction ID: 4205ae99c7797de4dfb313a5bae0cf15e49b7f4f684686ccd343dfb1e0880446
Opcode Fuzzy Hash: 030991f1092f9a0d968cfc55bded795b95ac8ca4e2dc8021679d52bb4764a83a
Instruction Fuzzy Hash: B5316536705F8285DB60CF25E8606AD73A4FB88754F540135EAAD4BBA9DF3CD145CB00

Function 00007FFDFB667380 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

BCryptGenRandom.BCRYPT ref: 00007FFDFB6673F6
SetLastError.KERNEL32 ref: 00007FFDFB667429

Part of subcall function 00007FFDFB666F80: GetLastError.KERNEL32 ref: 00007FFDFB666FAC

Part of subcall function 00007FFDFB6748F8: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDFB670E42), ref: 00007FFDFB674948
Part of subcall function 00007FFDFB6748F8: RaiseException.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FFDFB670E42), ref: 00007FFDFB674989

SetLastError.KERNEL32 ref: 00007FFDFB6674AE

Strings

GenerateBlock size, xrefs: 00007FFDFB66742F
BCryptGenRandom, xrefs: 00007FFDFB6674B4

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorLast$CryptExceptionFileHeaderRaiseRandom
String ID: BCryptGenRandom$GenerateBlock size
API String ID: 1032801275-1797140735
Opcode ID: 5875973860635c51ffda38f039c4b02d66f6b4236ce161c1de35bf49ab93f856
Instruction ID: 69b3cd8e2ddedaaf318ddc776282444394906e0e04f100c114aad67608ca0816
Opcode Fuzzy Hash: 5875973860635c51ffda38f039c4b02d66f6b4236ce161c1de35bf49ab93f856
Instruction Fuzzy Hash: 7F317C21B0AA4796EB109B15F874AB96321FF81784F444032D96D8E6FEDF2CE945C700

Function 00007FFDFB65AAC0 Relevance: 8.0, APIs: 2, Strings: 2, Instructions: 964COMMON

Download Yara Rule

Strings

p, xrefs: 00007FFDFB65AD03
p, xrefs: 00007FFDFB65B553

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: p$p
API String ID: 0-173875672
Opcode ID: cd64c5e4d9a9cf0c74d2fbd58e5014e1ea2173474dcac39114749083e4c75a3d
Instruction ID: 95b77d02d268ae85529c11cb34277800d8a5ddd01265deac042c97c68bf33d81
Opcode Fuzzy Hash: cd64c5e4d9a9cf0c74d2fbd58e5014e1ea2173474dcac39114749083e4c75a3d
Instruction Fuzzy Hash: A882BF76B0968286EB14CF25D2A06BD67A1FB89784F184035DE5E4BBEDDF38E461C700

Function 00007FFDFB640B00 Relevance: 7.8, Strings: 4, Instructions: 2779COMMON

Download Yara Rule

Strings

DB7C2ABF62E35E668076BEAD208B, xrefs: 00007FFDFB640B41
FFFFFFFE FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 00000000 FFFFFFFF FFFFFFFC, xrefs: 00007FFDFB640B43
28E9FA9E 9D9F5E34 4D5A9E4B CF6509A7 F39789F5 15AB8F92 DDBCBD41 4D940E93, xrefs: 00007FFDFB640B45
FFFFFFFE FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 00000000 FFFFFFFF FFFFFFFF, xrefs: 00007FFDFB640B47

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: 28E9FA9E 9D9F5E34 4D5A9E4B CF6509A7 F39789F5 15AB8F92 DDBCBD41 4D940E93$DB7C2ABF62E35E668076BEAD208B$FFFFFFFE FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 00000000 FFFFFFFF FFFFFFFC$FFFFFFFE FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 00000000 FFFFFFFF FFFFFFFF
API String ID: 2573137834-3528890889
Opcode ID: a9719ec63d65ca62ae8c162b1cae3d8e9a4fd1b00f96566775911fdc7cad6e22
Instruction ID: c360f4e883f94c50797d4335e0118683f1f71dcdd657d49f5ed93ec22681b3b2
Opcode Fuzzy Hash: a9719ec63d65ca62ae8c162b1cae3d8e9a4fd1b00f96566775911fdc7cad6e22
Instruction Fuzzy Hash: 7353E2B6B00F5996EB44CFA9D45479C3379F308B88F894022DB4E63B68DB79C59AC341

Function 00007FFDFB65AA60 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 592COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB65BA7E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB65BA84

Strings

p, xrefs: 00007FFDFB65B553

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: p
API String ID: 73155330-2181537457
Opcode ID: be077e50881402fba07bb951e6cde301b0c9b11d3884739358ee4c7bf07c7b46
Instruction ID: eb0246ec811fdf4880b2e929d50cfd5c594eba1e4649d9007fc10fea0947d093
Opcode Fuzzy Hash: be077e50881402fba07bb951e6cde301b0c9b11d3884739358ee4c7bf07c7b46
Instruction Fuzzy Hash: 7532AF76B0968686EB14CF25D1A06AD67A1FB89BC4F184035DE6D4BBEDDF38E461C300

Function 00007FFDFB621AC0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6060A0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6061E8
Part of subcall function 00007FFDFB6060A0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6061EE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB621F91
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB621F97

Strings

getdata, xrefs: 00007FFDFB621CBB

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: getdata
API String ID: 3936042273-195123596
Opcode ID: ce11896b2dfd3257eec0d544d8d1a4b40fa81ab3403027c8c24cc203dce7cb62
Instruction ID: e4479d75b2e2b136ac545a1729a3e1cc1146ba0f58912d59fbb763b7020c5a13
Opcode Fuzzy Hash: ce11896b2dfd3257eec0d544d8d1a4b40fa81ab3403027c8c24cc203dce7cb62
Instruction Fuzzy Hash: C8E1F26271E6C682EB108B55E4605AEA760FB957D0F444236EAEE4BBEDCF3CD145CB00

Function 00007FFDFB622480 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6060A0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6061E8
Part of subcall function 00007FFDFB6060A0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6061EE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6228D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6228D7

Strings

object, xrefs: 00007FFDFB622606

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: object
API String ID: 3936042273-2829954028
Opcode ID: 929b9db25eee1d12021f6c90c1f73a74af58a9036d3898b9146332cf822e251a
Instruction ID: f5bf8bb0a0ac91ead8d3b82ce3c00263ca6857b8de2bc3f4c2e124dc4e780004
Opcode Fuzzy Hash: 929b9db25eee1d12021f6c90c1f73a74af58a9036d3898b9146332cf822e251a
Instruction Fuzzy Hash: 39D1B26271EAC682EB10DB55E4605AEA760FB947C4F405136EADE0BBEDDF2CD145CB00

Function 00007FFDFB622E90 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6060A0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6061E8
Part of subcall function 00007FFDFB6060A0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6061EE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6231CA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6231D0

Strings

version, xrefs: 00007FFDFB622EFE

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: version
API String ID: 3936042273-3206337475
Opcode ID: 91f48cefcc0ec8405d58b09ab6a021c7e04db677e4be469a4a2e7b2216dc6a57
Instruction ID: def06e49c2f62ae3de053b6b34204c60b4df1281366578d3615c5ecfe46f6e5f
Opcode Fuzzy Hash: 91f48cefcc0ec8405d58b09ab6a021c7e04db677e4be469a4a2e7b2216dc6a57
Instruction Fuzzy Hash: 2EA1BF6272A6C686EB10CB55E4505AEB760FB98BC4F405236FA9E0BAEDDF2CD145C700

Function 00007FFDFB650EE0 Relevance: 5.0, APIs: 3, Instructions: 477COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB651074
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB651264
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB65153F

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 18be743803b70afbf5d5b59732c367e8040d209a2e43f9d66865871c5f48d42d
Instruction ID: 1c5d7d5f3aee5958ab79eba88d37bed1272b98a5f498352cd19deb826ce9bbc9
Opcode Fuzzy Hash: 18be743803b70afbf5d5b59732c367e8040d209a2e43f9d66865871c5f48d42d
Instruction Fuzzy Hash: 5A129D72B0AA8385EF108F65D460ABD63A1FB84794F444132DA6D4BAEDDF3CE5A0C740

Function 00007FFDFB68A930 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FFDFB68A996
memcpy_s.LIBCPMT ref: 00007FFDFB68A9C1

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 3a169fb333f111df0ae1304fb82a5a5346c1f6606d896419b7e9c4814cfa7d1e
Instruction ID: c615ee6ec16dd0e503e26ca0b2459378e34504214493207c33021b862bc87e4b
Opcode Fuzzy Hash: 3a169fb333f111df0ae1304fb82a5a5346c1f6606d896419b7e9c4814cfa7d1e
Instruction Fuzzy Hash: FEC12A72B1BA8687D724CF15A154A6AB792FB84784F44C134DF5E4BBA8DB3CE801CB40

Function 00007FFDFB63FF50 Relevance: 4.8, APIs: 3, Instructions: 338COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB640040
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB640088
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB6403E7

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d8a4a4ab7e79f2d1b816014c4f045dfae84a1d5aefe3d1c0c73fa98dc4ad17b5
Instruction ID: 1992f7cbc4d64a9a7584ae6dfddee15e0ee5e0b552c67261e9b6757e93a03da2
Opcode Fuzzy Hash: d8a4a4ab7e79f2d1b816014c4f045dfae84a1d5aefe3d1c0c73fa98dc4ad17b5
Instruction Fuzzy Hash: 77C10362B2ABA7C2EF119A659064BBE6294EF45BD4F044131DE2D0B7F9DF3CE6458300

Function 00007FFDFB632A90 Relevance: 4.7, APIs: 3, Instructions: 247COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6086E0: __std_fs_code_page.LIBCPMT ref: 00007FFDFB608703
Part of subcall function 00007FFDFB6086E0: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FFDFB608751
Part of subcall function 00007FFDFB6086E0: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FFDFB608789

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB632E5C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB632E68
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB632E6E

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: __std_fs_convert_narrow_to_wide_invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task__std_fs_code_page
String ID:
API String ID: 1808005240-0
Opcode ID: 4d9ca0b5403d51fdc7d70407bc8f7de383df0aea40f934cbddfa62846b388cc5
Instruction ID: f027b884d03361a082ffe58f7d77f3be2df09965efb838d51ef47927d1c859d6
Opcode Fuzzy Hash: 4d9ca0b5403d51fdc7d70407bc8f7de383df0aea40f934cbddfa62846b388cc5
Instruction Fuzzy Hash: 5DB1B432B1A78785EB209F25D4A07A96391FB84798F544232EA6D4BBEDDF3CD541C700

Function 00007FFDFB63B470 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 625COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB63B5FE

Strings

, xrefs: 00007FFDFB63B718

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: b2087c9c81ba20577fea4acbab9454eb2222dcd41d04f0d3735005c3a56680a5
Instruction ID: 2589003d786136a518f97b2e28f2433f3a53dfac2455c0df8aad5e89c9755d31
Opcode Fuzzy Hash: b2087c9c81ba20577fea4acbab9454eb2222dcd41d04f0d3735005c3a56680a5
Instruction Fuzzy Hash: FA525B767105A68BD310CF2A8464EBE37A4EB4D305B4D4212EBE98B7D5DA3CE611CB70

Function 00007FFDFB6330B0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 418COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6337A7

Strings

exists, xrefs: 00007FFDFB63379A

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: exists
API String ID: 3668304517-2996790960
Opcode ID: 5b508bbcc92ef3f7d56b9597b2ba3134f182e0b8bb81ccac500b527b525dd36b
Instruction ID: 1910aede39404dd270e87161bfdedc3689ee8f606ca8049a43d37d040f5a3062
Opcode Fuzzy Hash: 5b508bbcc92ef3f7d56b9597b2ba3134f182e0b8bb81ccac500b527b525dd36b
Instruction Fuzzy Hash: 12128E32B09BC289EB208F25D8607E977A1FB45748F588135DA6D4BBE9DF38D585C700

Function 00007FFDFB622BB0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

verack, xrefs: 00007FFDFB622C01

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: verack
API String ID: 73155330-569966326
Opcode ID: f97d579481b7b5d25855aebdcab9da45f5d28ec67d5a0081ff29610a448e22a2
Instruction ID: 424bfe4278407af977e19cf78fe887adcce56bb2b2876f178c16e4ba4c909291
Opcode Fuzzy Hash: f97d579481b7b5d25855aebdcab9da45f5d28ec67d5a0081ff29610a448e22a2
Instruction Fuzzy Hash: 4781B17272AAC682EB10DB15E4505AEA760FB987C4F505136FADE0BBADDF2CD144CB40

Function 00007FFDFB6228E0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

pong, xrefs: 00007FFDFB622931

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: pong
API String ID: 0-559432015
Opcode ID: 8bebf32230d1c5fe46eb471e75ecad1c3cdd76d0ee4937883389b3b6fae79dd5
Instruction ID: 25b5cecb03272bd5efc2dff7c64331485b64f3fcc890adb79f945db43c15da5d
Opcode Fuzzy Hash: 8bebf32230d1c5fe46eb471e75ecad1c3cdd76d0ee4937883389b3b6fae79dd5
Instruction Fuzzy Hash: 4B61B33272A6C686EB10DB55E4505AEA361FB897C4F405226FADE0BB9DCF3CD544CB40

Function 00007FFDFB68F628 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FFDFB68E2C6), ref: 00007FFDFB68F69C

Strings

GetLocaleInfoEx, xrefs: 00007FFDFB68F644, 00007FFDFB68F655

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 58daed6010697032d07d9d84abc96063966c158098ea6bfbb4672780173c8ee4
Instruction ID: 775ff739993115431288d2d9edb7abf6437a17b5dc1888e2af574d0bb542c7bc
Opcode Fuzzy Hash: 58daed6010697032d07d9d84abc96063966c158098ea6bfbb4672780173c8ee4
Instruction Fuzzy Hash: F801A721B09A4285EB409B56B4208AAB764FF89FD0F548435DE6D1B7FDCE3CD5458340

Function 00007FFDFB656A30 Relevance: 3.4, APIs: 2, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3c123c898a904628d088db1ab54b11102033e3e331651c3f28599f52597cd3
Instruction ID: 75ea5407fa729345a5ccafc0b5f21bedfce46b4fa5a6b3ddb3731424f06bb1f9
Opcode Fuzzy Hash: 7d3c123c898a904628d088db1ab54b11102033e3e331651c3f28599f52597cd3
Instruction Fuzzy Hash: 70F1EF73B0AA0286EB10CF65D8646ED2762FB84B88F054531DE2E6B7ADDF38E555C340

Function 00007FFDFB634750 Relevance: 3.3, APIs: 2, Instructions: 302COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB6060A0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6061E8
Part of subcall function 00007FFDFB6060A0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6061EE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB634C3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB634C43

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: adebdad0da50ad89550ab99704ad1c51c17a613daf0020265ca504455b19b573
Instruction ID: 87b0dd106144026b48118e7d1c49453fefea24edb28cbff5e5bdf6312ec57263
Opcode Fuzzy Hash: adebdad0da50ad89550ab99704ad1c51c17a613daf0020265ca504455b19b573
Instruction Fuzzy Hash: B0D17F327197C286D7108B25E4607AEA761FB85784F585236EA9E4BBEDCF3CD485C700

Function 00007FFDFB64AC80 Relevance: 3.3, APIs: 2, Instructions: 283COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB64AD5D
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB64AE32

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8c6d71691b88bc4147e555c6e5d1d04bd74c90452714550f26fa892231bd121
Instruction ID: c677f170b73446d6c8099b5d87466e7e63f2edad5f58084f5bf679f336a762a4
Opcode Fuzzy Hash: f8c6d71691b88bc4147e555c6e5d1d04bd74c90452714550f26fa892231bd121
Instruction Fuzzy Hash: 90C1CBA2B0AA8394EB10DF65D560BFD33A1AB44B98F544535DA2D0B7EDDF38E641C380

Function 00007FFDFB637350 Relevance: 3.3, APIs: 2, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a71ef8b6ea4b144a232c33d099812a9d805b836aa268b1de02a8452d96270b5
Instruction ID: ffd650dc4d4ec7a7139358b317da55c7bbccc10bc6e2794ccd098cce4536c7bf
Opcode Fuzzy Hash: 4a71ef8b6ea4b144a232c33d099812a9d805b836aa268b1de02a8452d96270b5
Instruction Fuzzy Hash: 29B1C522F1A74289FB108B65D420BBC33A2AB55798F144735DE7C1ABEADF38E1D18340

Function 00007FFDFB694324 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FFDFB694573
RaiseException.KERNEL32 ref: 00007FFDFB694584

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: cd9a1f9ad87af480bb8b06b9ac514f9e2f65f345fdffbf54b3f83fb453aed285
Instruction ID: 5d577895b8b8df15d301ce0425c1ca503492c1c79c029d78d3acfe09ba07f855
Opcode Fuzzy Hash: cd9a1f9ad87af480bb8b06b9ac514f9e2f65f345fdffbf54b3f83fb453aed285
Instruction Fuzzy Hash: BEB15B73605B898BEB25CF29C85676C3BA0F744B4CF198925DA6D8B7B8CB39D451C700

Function 00007FFDFB69306C Relevance: 2.6, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

Strings

gfff, xrefs: 00007FFDFB6931F6
e+000, xrefs: 00007FFDFB693179

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 80ea245ef8c248250bfbdf3d78d2f9bd8283e1c0b7d3643b362a300fede182c0
Instruction ID: b7f07e8ae0cd3fe0886c64aa6f15a3cb81b92b58b4dae0509cfc2ad93f9014ac
Opcode Fuzzy Hash: 80ea245ef8c248250bfbdf3d78d2f9bd8283e1c0b7d3643b362a300fede182c0
Instruction Fuzzy Hash: 62516662B196C246E7248E35E921B697B91F744B98F08C231CBB84FBE9DF3DE4418700

Function 00007FFDFB61CFC0 Relevance: 1.8, Strings: 1, Instructions: 597COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FFDFB61D7EF

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 9b0b4a276a3e04a97b3f6e9cfffecdb135cd72df040ae0495a0dcb73a670d90a
Instruction ID: df42bea781a38e2fc003d3d729bd640f170a0b056c8dc69fe6e31747b3146d10
Opcode Fuzzy Hash: 9b0b4a276a3e04a97b3f6e9cfffecdb135cd72df040ae0495a0dcb73a670d90a
Instruction Fuzzy Hash: FF224662B0939A4ADB648F1AA460B7A7694F785BC4F105135CE9E4BBE9DF3CE441C700

Function 00007FFDFB6185E0 Relevance: 1.7, Strings: 1, Instructions: 437COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FFDFB618C22

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: b9a30c33fd8558fa5b75072f9cb42e26c7abdc5680f7b4992a55fec7a8791953
Instruction ID: 78c5e0d21c2497533a4670a1eb9314cd3cd42ec8f919ad730962d614d8b8b2c4
Opcode Fuzzy Hash: b9a30c33fd8558fa5b75072f9cb42e26c7abdc5680f7b4992a55fec7a8791953
Instruction Fuzzy Hash: DBF14B6572E28392E7198E29D424B7D7696BB41F80F006136EE6E8F7F8EB3CD5408311

Function 00007FFDFB61CA10 Relevance: 1.7, Strings: 1, Instructions: 404COMMON

Download Yara Rule

Strings

2, xrefs: 00007FFDFB61CC59

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: edb5278980dd36de3f27e6bebf3f243b3a4678fcaad72eb11a4b5ab9f5d9f0d7
Instruction ID: eac3f5f5664f973578a0279adc6720d1e694b3c0a2a6eeefa48c61babd84452b
Opcode Fuzzy Hash: edb5278980dd36de3f27e6bebf3f243b3a4678fcaad72eb11a4b5ab9f5d9f0d7
Instruction Fuzzy Hash: BBD17CA2F0A79B06CB14862AA561BBDA690BB54FC4F145035DE5E8FFF9DA3CD4448700

Function 00007FFDFB617AA0 Relevance: 1.6, Strings: 1, Instructions: 395COMMON

Download Yara Rule

Strings

x, xrefs: 00007FFDFB617B89

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 713ac39e9c7230e8d4eb87eea6be2b19562ad51e455e505d8ac702b7e9d14308
Instruction ID: cd4141a6c3e195da69e0e1964704ff2b677d111a393fbf8d02c3c0942181ad5d
Opcode Fuzzy Hash: 713ac39e9c7230e8d4eb87eea6be2b19562ad51e455e505d8ac702b7e9d14308
Instruction Fuzzy Hash: 6CE15BA1B0A38B59EB248F25D560B796695BB51FC0F549031CE5E4BBFAEE3CD441C300

Function 00007FFDFB699754 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDFB68D570: GetLastError.KERNEL32 ref: 00007FFDFB68D57F
Part of subcall function 00007FFDFB68D570: FlsGetValue.KERNEL32 ref: 00007FFDFB68D594
Part of subcall function 00007FFDFB68D570: SetLastError.KERNEL32 ref: 00007FFDFB68D61F

EnumSystemLocalesW.KERNEL32(?,?,?,00007FFDFB699F43,?,00000000,00000092,?,?,00000000,?,00007FFDFB68E0ED), ref: 00007FFDFB6997F2

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: d78b4ce8c848f9dd37d503210fb26c82bad365a3ef5931eb54b70e8a07abceaf
Instruction ID: 08860f786f3ad4928c3116979eb1d0391e03d832542c3ad80e051e9aae722ece
Opcode Fuzzy Hash: d78b4ce8c848f9dd37d503210fb26c82bad365a3ef5931eb54b70e8a07abceaf
Instruction Fuzzy Hash: 4F11E767F0964686EB148F25D050AB87BA0FB50F94F948136C6794B3E4DE78D5D1C740

Function 00007FFDFB699824 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDFB68D570: GetLastError.KERNEL32 ref: 00007FFDFB68D57F
Part of subcall function 00007FFDFB68D570: FlsGetValue.KERNEL32 ref: 00007FFDFB68D594
Part of subcall function 00007FFDFB68D570: SetLastError.KERNEL32 ref: 00007FFDFB68D61F

EnumSystemLocalesW.KERNEL32(?,?,?,00007FFDFB699EFF,?,00000000,00000092,?,?,00000000,?,00007FFDFB68E0ED), ref: 00007FFDFB6998A2

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 8d124199e0873d7e3fd008f94e19e4e240248db30e7e620eace9a20178ae5c8a
Instruction ID: 8177486159a604d9a17b81bc94eea98ff5add0c8dc21c2e4daeacac167e731bd
Opcode Fuzzy Hash: 8d124199e0873d7e3fd008f94e19e4e240248db30e7e620eace9a20178ae5c8a
Instruction Fuzzy Hash: 8D01B972F0914346E7145F16E550B7976A5EB40B68F458235D6784B6ECDF7C9480C700

Function 00007FFDFB68F23C Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FFDFB68F5F7,?,?,?,?,?,?,?,?,00000000,00007FFDFB698DA4), ref: 00007FFDFB68F28B

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 864adca64f10ed86be7b73c3629bf17d0b271d808e48494e099bf2f8eccfee10
Instruction ID: 05f4a3d5ba6ce99ae6f26df05312ced5d3da21d4e44c7ebe55e9677af16ecf42
Opcode Fuzzy Hash: 864adca64f10ed86be7b73c3629bf17d0b271d808e48494e099bf2f8eccfee10
Instruction Fuzzy Hash: CCF03172B05B4283E704DB29E8A19A53365FB99BC0F549035DA6D8B3B9DF7CD451C300

Function 00007FFDFB687BC8 Relevance: 1.5, APIs: 1, Instructions: 28timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFB687BDC

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 1ad08d5821c16f67af062276ea3528555dc2660cba87232dabe49151298403a0
Instruction ID: 47c68a945ffb3d8626e72164ab249ab803921d35002d9b5167471ba22c994328
Opcode Fuzzy Hash: 1ad08d5821c16f67af062276ea3528555dc2660cba87232dabe49151298403a0
Instruction Fuzzy Hash: 2AF082E1B2AA8942EE248755A8247A49292AF5CBE0E04A331ED3D4E7D9EF2CD1518700

Function 00007FFDFB667330 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FFDFB667354

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: AlgorithmCloseCryptProvider
String ID:
API String ID: 3378198380-0
Opcode ID: 70f517824e45b9851c3dc871d4ac550522a3f63869e21d730c1e66dd46bfdf32
Instruction ID: a9719135e9b250d4423ad09428c53c99b9026ec04ff75555c9ae029abf48ca2a
Opcode Fuzzy Hash: 70f517824e45b9851c3dc871d4ac550522a3f63869e21d730c1e66dd46bfdf32
Instruction Fuzzy Hash: 01E09231B0A60745FB449B16F4716796251EF88B40F6C81309D2C4F3A9CD3CD4928700

Function 00007FFDFB692BD8 Relevance: 1.5, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

Strings

gfffffff, xrefs: 00007FFDFB692F1A

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: ea6801fa90d8fc96189ce452aff9b5266326b0e3370ba437820448fc258c93c4
Instruction ID: db66a3ddf0df538b6331f7726edfc646022fc7d7819bc13b0fe4349b7094d519
Opcode Fuzzy Hash: ea6801fa90d8fc96189ce452aff9b5266326b0e3370ba437820448fc258c93c4
Instruction Fuzzy Hash: 4AA14662B0A78786FB21DF25A460BA97790AB54B8CF048131DE6D4B7E9DE3DE405C700

Function 00007FFDFB684D20 Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDFB684F2A

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4f1aa22ed8fb5c11e340679a982366e0c0954e14d72a6eb53d09cb18ece037b1
Instruction ID: 0257268991bf971bda36a1b10988c4bf6db34b568ab0cc087443cec76c514655
Opcode Fuzzy Hash: 4f1aa22ed8fb5c11e340679a982366e0c0954e14d72a6eb53d09cb18ece037b1
Instruction Fuzzy Hash: EDB17C72B0AA4785E7648F29D064A7D3BA0EF49B48F188139DA6D4B3EDCF39D840C751

Function 00007FFDFB6529B0 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

DB7C2ABF62E35E668076BEAD208B, xrefs: 00007FFDFB6529B2

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: DB7C2ABF62E35E668076BEAD208B
API String ID: 0-1114148540
Opcode ID: aabd03ef1719d7c80ca3c297e06dc179a55077514131f93257853fda8283bac6
Instruction ID: d4a0061b2185e456cf5b52fbe055823160a3b03ca3b6e0153a17ee008aa00e6f
Opcode Fuzzy Hash: aabd03ef1719d7c80ca3c297e06dc179a55077514131f93257853fda8283bac6
Instruction Fuzzy Hash: C131F032718B8986DB108B2AE84079DBB54F7D5B98F485139DF8D47BA8CBBDD045C700

Function 00007FFDFB6881B9 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84856ccd1dc3a6676b39ab3d1c80dbfe7562f0e17ec7d9dec58ad6743201a4a3
Instruction ID: ff9cdbc8557af2348fb9b45131b0a26de611b63b5f3bff2dbe1bc682b5d7f3c7
Opcode Fuzzy Hash: 84856ccd1dc3a6676b39ab3d1c80dbfe7562f0e17ec7d9dec58ad6743201a4a3
Instruction Fuzzy Hash: EF420221B2AE4789E7539B75A861D356724BF563C0F018733E92E7A6F8DF2CE4528600

Function 00007FFDFB64D7A0 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 768259bce8f5d1253c97174183ac0006708df65520d3fa76edfdceb9cfa0210c
Instruction ID: d959c2fbe151b29aeef8fefbbd326a4910e6e086825e95985524dd0815a1aca0
Opcode Fuzzy Hash: 768259bce8f5d1253c97174183ac0006708df65520d3fa76edfdceb9cfa0210c
Instruction Fuzzy Hash: 7712DC72B0AA82C5EB008F65E4A0BAA77A1FB44794F445135EA6D4BBEDCF3CD580C700

Function 00007FFDFB61D900 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d38fae4eb85284ada6379fc8398675071a72d5dd664eb0936eee1d335475c8
Instruction ID: 07c2a2edd92506e67dca2422af146278055407cba716efaf26e6563b4f99012a
Opcode Fuzzy Hash: f4d38fae4eb85284ada6379fc8398675071a72d5dd664eb0936eee1d335475c8
Instruction Fuzzy Hash: 42C18863F1946707D72CC92EA4A1BB89695E7D8790F046036EE4B8BBF4EB78D844C740

Function 00007FFDFB63AEB0 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832832dc364959410312b08ae791d2c06a811db9f110b507999a7588ef3f3727
Instruction ID: 3fb074d6b91a1c72f0c6fa33150da4457e4bf37075256d6b88c489feafd49e77
Opcode Fuzzy Hash: 832832dc364959410312b08ae791d2c06a811db9f110b507999a7588ef3f3727
Instruction Fuzzy Hash: 78F1257222A1904FD324CF19A26057ABBE0F758791F848229EFD647B99C73DF825DB10

Function 00007FFDFB668E90 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78b4fa3eb0fabe06b317e87bcdbcbad3bf88d85b4e424219ddb129872bd64bb
Instruction ID: 04cbe1e2874acdaf164fd20bb3882df27f7707f1ea4c8c9b158e61e68cefa71a
Opcode Fuzzy Hash: c78b4fa3eb0fabe06b317e87bcdbcbad3bf88d85b4e424219ddb129872bd64bb
Instruction Fuzzy Hash: 840260339261609BE781CB1EC059B6B33A9F744355F23833BDE9267281D637AC09D7A4

Function 00007FFDFB685ACC Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac7898b75f84a8c33d528a5d020cc9611644f072e3a27786c5b160d31b9b22f
Instruction ID: bdea29625182ed986e3a1523f4cb1371de1a5c0bad5e71426f9f9862f3579eab
Opcode Fuzzy Hash: aac7898b75f84a8c33d528a5d020cc9611644f072e3a27786c5b160d31b9b22f
Instruction Fuzzy Hash: B6E18232B0AA4386EB658A28C578B7D2791EF55B58F14C235CE6D1E2FDDF29E841C700

Function 00007FFDFB66A7A0 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab41f9421c0c718e7f5ee1b96c53c8c0c5532be5994e9007b22f095d90db5dc3
Instruction ID: 4abd7b67989e76e5e9fcb349350f3ab51346bffecd27cf3da219efc202d8d3eb
Opcode Fuzzy Hash: ab41f9421c0c718e7f5ee1b96c53c8c0c5532be5994e9007b22f095d90db5dc3
Instruction Fuzzy Hash: 9BB10633B295828BEB51CF25E954A6977D2F794BD4F04C131DA595BF98DA3CE802CB00

Function 00007FFDFB685F04 Relevance: .3, Instructions: 327COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e36062198daae6387ab13480e921487df1d804465fa8b2d567dfddd8f88c27
Instruction ID: 595661596f7a2f54774712f4a2330ff452cfee9c39f81b144b7a0260ec000fab
Opcode Fuzzy Hash: 00e36062198daae6387ab13480e921487df1d804465fa8b2d567dfddd8f88c27
Instruction Fuzzy Hash: 6CD1B622B0AE4785EB698E298974A7D27A0FF45B48F148235CE6D0F6E9CF3DD845C740

Function 00007FFDFB635160 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 4d01ac14e4503eb6c61a4958a9179e75bce3f1d4c40fc9a39546503f1bb8fa11
Instruction ID: d007d3e6cf225d55efe82c219c2f0f2d5c56b245ad22b0c17eb4564f8dcea3f8
Opcode Fuzzy Hash: 4d01ac14e4503eb6c61a4958a9179e75bce3f1d4c40fc9a39546503f1bb8fa11
Instruction Fuzzy Hash: 13E11663B1AB8285EB10CB65D0506AD77A1FB85798F484235EAAD0BBEDDF3CD481C700

Function 00007FFDFB620860 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0253b0dcf0567cbc5810274d52cbaf3c9cf2ac960e29321d24127f6c30400da8
Instruction ID: dc7a09b6628d74ce182972d60cd157069eb5873e30af40fea6eaa2bd6c8e69d6
Opcode Fuzzy Hash: 0253b0dcf0567cbc5810274d52cbaf3c9cf2ac960e29321d24127f6c30400da8
Instruction Fuzzy Hash: B7C1EE73725BD883DB44CB19D0549DE7BA9F388780B865123DA6E83B44EF38CA18CB40

Function 00007FFDFB68DF3C Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: a0fbdd269cac7214de097bd9cc6e8b6bbbe12fabbfbe42cc4adf3ce9bd37f889
Instruction ID: 7ca15e6a480a8c277e3e998e4c6493e7cd00c182e6ef390fbfe06c08ec5ea590
Opcode Fuzzy Hash: a0fbdd269cac7214de097bd9cc6e8b6bbbe12fabbfbe42cc4adf3ce9bd37f889
Instruction Fuzzy Hash: 4FC1C726B0AA8745EB609B619420BBE27A1FF94788F408135EEAD4F6EDDF3CD545C700

Function 00007FFDFB620E80 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b5c6f3078becf20f1199bc39b726f0b573c71f3f802b3308f7ea4c483213bd
Instruction ID: 038daf849520a445e2e3904a70fdf3c989c57c0b71ca3f347e17164725dc0f4b
Opcode Fuzzy Hash: e7b5c6f3078becf20f1199bc39b726f0b573c71f3f802b3308f7ea4c483213bd
Instruction Fuzzy Hash: B2B19463709685C7DB58CB2DD8507AA7792E359B84F09C239CBAA4BB8CCB7CE104C740

Function 00007FFDFB64A7A0 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90bc551d4986c25560af851d0b98203b8f4f41d8b6a4e14eae8b4e0dfe0ec33b
Instruction ID: 4d01eb2d8116e2676189ddce50155efa487ac97cbb9a582ee6125a4a14cbf54c
Opcode Fuzzy Hash: 90bc551d4986c25560af851d0b98203b8f4f41d8b6a4e14eae8b4e0dfe0ec33b
Instruction Fuzzy Hash: A0A10172B05A4696EB20DF65E064BAE3362FB88B88F118136DF5D4BB98DF38D140C340

Function 00007FFDFB6850B8 Relevance: .2, Instructions: 247COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4939da3f87401d80799ed6090340d6e42fa13b713726f734e2122f47d893e6c4
Instruction ID: 797f8109d3fae151945747778c630b8c88b0173fdade01cf8df56ca39be89f1b
Opcode Fuzzy Hash: 4939da3f87401d80799ed6090340d6e42fa13b713726f734e2122f47d893e6c4
Instruction Fuzzy Hash: 81B19172A0AB468AE7658F29C07067C3BA1FB49B48F248135CA5E4B3E9DF39D441C741

Function 00007FFDFB68543C Relevance: .2, Instructions: 241COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5d8334c57f654b4f87f1b1becb07e4aed738b33c56dcc07a699d05cdee5fa8
Instruction ID: cc51f0fd0f57abcd5c01fcf6b9a912e5db8c44e0d93f00a2ee8e35e7e784cbe4
Opcode Fuzzy Hash: ae5d8334c57f654b4f87f1b1becb07e4aed738b33c56dcc07a699d05cdee5fa8
Instruction Fuzzy Hash: A5B17E76A1AB86C6EB658F29C06063C3BA4EB49B48F248135CB5E4B3F9DF39D441C701

Function 00007FFDFB668760 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59d5aaad13707aa235c32b79884c24521481d0c12a08fffdfc77972a4780151
Instruction ID: c3284c123d1adb45a683a301694c213f8229aa309bec770834880132bc1aef7a
Opcode Fuzzy Hash: d59d5aaad13707aa235c32b79884c24521481d0c12a08fffdfc77972a4780151
Instruction Fuzzy Hash: 0191A033F09B8289E3118F7D9441AED6761BB95748F149325EFD82AE9CDB38D54AC300

Function 00007FFDFB6690A6 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d286b13ffae1578e684bb1020083730452a778b0e1c4c2c8477c30c38cd9494
Instruction ID: 3d886071040f5890d74d9598f1cb208dcbc899181ee4144107114147082c22cb
Opcode Fuzzy Hash: 9d286b13ffae1578e684bb1020083730452a778b0e1c4c2c8477c30c38cd9494
Instruction Fuzzy Hash: BFA11E338261709BD380CB1ED059B6F33A9F784355F23832BDE9267281C637AC0997A5

Function 00007FFDFB689B7C Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4ec0ca32672841d429cf7105d5c8347aef15274cb6a582a0444d5454670d5500
Instruction ID: 89536149dc693be941ab2d556bc67736ba6e6d0481b764fea96f6955eb21b9f5
Opcode Fuzzy Hash: 4ec0ca32672841d429cf7105d5c8347aef15274cb6a582a0444d5454670d5500
Instruction Fuzzy Hash: 95818172B06E5285EB648E65D4A177D23A0FF44B98F149636EE6E8B7E8CF38D041C340

Function 00007FFDFB6936EC Relevance: .2, Instructions: 198COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ae756d4a93f95da4527f56551ff8f8597df9d6aa363f67877cc7ab23149139
Instruction ID: 0d935306505c5ee535583de61c1a39a6f76a5f1b555e446a0a7edbf292463e84
Opcode Fuzzy Hash: 24ae756d4a93f95da4527f56551ff8f8597df9d6aa363f67877cc7ab23149139
Instruction Fuzzy Hash: E481E972B0D78245E774CB1994A0B796A91FB85798F104239DBAE4BBEDDF3CD4008B00

Function 00007FFDFB69CA24 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 06a9625e579e200d604ef73943dbe4ac053193aff4e6d7d3d02975631ca7891a
Instruction ID: b4be1782658a3ae309998dc3daba14b27ce17fb632018960a1da8addc1510c15
Opcode Fuzzy Hash: 06a9625e579e200d604ef73943dbe4ac053193aff4e6d7d3d02975631ca7891a
Instruction Fuzzy Hash: 3461CA21F1E19386FB64C6288460A7D66A1AF41768F544239D63D4FEFDDE7DE8409B00

Function 00007FFDFB64E420 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94553d4758cb7cbcde5823fce3c8384a055d69f7125dde9cfd6c4786c244cd6
Instruction ID: 269869519c3a0ab70c1cfae6a4333cf3978b92e0c4d39515d41b49f5982c713a
Opcode Fuzzy Hash: c94553d4758cb7cbcde5823fce3c8384a055d69f7125dde9cfd6c4786c244cd6
Instruction Fuzzy Hash: 5451B632B19A87C6EB24CB15E450B6967A0FB99B88F444131EE9D4BB9CDF3CD641CB00

Function 00007FFDFB6843BC Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: d2d973474a614342ae1bd739872bdc7e9205c38f161a4cab2607fd06593303ca
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: D8516D77B1AA5286E7248B29D064B3C27A0EF55F58F648131CE5D1B7E8CB3AE853C740

Function 00007FFDFB6841B8 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: 71f661d5577b67e8d9296008c5711fe4b847fd3fcc555a2b1d3a53e5c7834c0c
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: A7516336B19A5286E7648B29D060B3C27A0EF49B58F248131CE5D1F7F8DB3AE852C740

Function 00007FFDFB6845C0 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: d248296e56ecf6a1f5c14014b072ca66280851c72a503f7febd9836e0e1d64ce
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: 91516376B19E5285E7248B29C064B2827A0EF45B58F658131CE5D1B7FDCF3AE893C740

Function 00007FFDFB68BF70 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 41f28692be7ae92745315fde3f78477b385e9e500dc97b00c5f08b2ed9f30c9f
Instruction ID: 9b3c6e7b901601327012dd983e2ede10663bd0e3d44aabeb730779afec345146
Opcode Fuzzy Hash: 41f28692be7ae92745315fde3f78477b385e9e500dc97b00c5f08b2ed9f30c9f
Instruction Fuzzy Hash: D141EA73B15A5681EF04CF6AD9645697791BB48FC4B45D032DE5D8BBACDE3DD0428300

Function 00007FFDFB602E10 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 000c09e6b72f793487ff7eeb3392127ee352edceebd5e4b25d96442f0d5c4590
Instruction ID: 165464564e996e4597bc8928ad98946796c262fc5eef42265f55a195192a3151
Opcode Fuzzy Hash: 000c09e6b72f793487ff7eeb3392127ee352edceebd5e4b25d96442f0d5c4590
Instruction Fuzzy Hash: 2941B0B3711A8581EF44CB75D465BA93366FB09BD8F85A13ADE5D47388DE39C009C300

Function 00007FFDFB63ACD0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c249c1a9a9f87dfcd403f89f2b493dac5da5b1c8d5a51ba81d202083aa9d348b
Instruction ID: 2ee0244948e59cfe96c9278b75af2961210089d090be4ab4200108fd55eb5743
Opcode Fuzzy Hash: c249c1a9a9f87dfcd403f89f2b493dac5da5b1c8d5a51ba81d202083aa9d348b
Instruction Fuzzy Hash: C731A27231824845FA5DDA61AA7F7E6E95AA38C3C0F49F137DE964E658EE3CC141CA00

Function 00007FFDFB63A190 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509e356a70a69fee75e6004179e37b9800559dc64f4470ea1333ea12fbfa7096
Instruction ID: 711556ace58c24dd4a0dc3c95c2256d4da9100e138976bfcaa7b9570fc16e463
Opcode Fuzzy Hash: 509e356a70a69fee75e6004179e37b9800559dc64f4470ea1333ea12fbfa7096
Instruction Fuzzy Hash: AD2149A2F356B606DE12863A8894C549A429F673C072DE322FD3825A99F71BE1D18700

Function 00007FFDFB668CA0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c647679db53dfee8d6fc2b5a08d4641880eed4ffb4f8872b3d3587519baeb4ae
Instruction ID: 392737eeceb1e0a6a7e45f0329218d269bd1860e6a9d4d4dc002388fcbd932e6
Opcode Fuzzy Hash: c647679db53dfee8d6fc2b5a08d4641880eed4ffb4f8872b3d3587519baeb4ae
Instruction Fuzzy Hash: C841B3B3A11740CFD751CF34D09196AB7B1FB19B48B19CA22DB18DB228EB39E545CB50

Function 00007FFDFB669768 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6cf7086033877038e98547aab7e423bf7c8cca03c2a5b6a100fcbf2f159150
Instruction ID: 98d2319cfbfb6ec2cb622e7d0467bae271b03bff824d449c0d995b4e1141fa24
Opcode Fuzzy Hash: 9a6cf7086033877038e98547aab7e423bf7c8cca03c2a5b6a100fcbf2f159150
Instruction Fuzzy Hash: 4E312E53D16A9852E3136B3D530B3B7D3A2BBD43E9F318341DBC522A46E73C6344A210

Function 00007FFDFB67AF9C Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 381COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67B507
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67B53F
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67B579

Strings

__int64, xrefs: 00007FFDFB67B247
const, xrefs: 00007FFDFB67B371
this , xrefs: 00007FFDFB67B455
double, xrefs: 00007FFDFB67B0C9
__int32, xrefs: 00007FFDFB67B256
signed , xrefs: 00007FFDFB67B4D7
decltype(auto), xrefs: 00007FFDFB67B3EA
short, xrefs: 00007FFDFB67B061
char32_t, xrefs: 00007FFDFB67B48D
__int8, xrefs: 00007FFDFB67B1B9
float, xrefs: 00007FFDFB67B0F5
UNKNOWN, xrefs: 00007FFDFB67B416
__int16, xrefs: 00007FFDFB67B1A7
int, xrefs: 00007FFDFB67B04F
wchar_t, xrefs: 00007FFDFB67B431
char8_t, xrefs: 00007FFDFB67B2C1
long , xrefs: 00007FFDFB67B0B2
<unknown>, xrefs: 00007FFDFB67B2B2
bool, xrefs: 00007FFDFB67B268
long, xrefs: 00007FFDFB67B03D
char16_t, xrefs: 00007FFDFB67B2A0
__w64 , xrefs: 00007FFDFB67B1E0
auto, xrefs: 00007FFDFB67B2D3
char, xrefs: 00007FFDFB67B073
volatile, xrefs: 00007FFDFB67B3B9
unsigned , xrefs: 00007FFDFB67B4C7
volatile, xrefs: 00007FFDFB67B38C
__int128, xrefs: 00007FFDFB67B238
void, xrefs: 00007FFDFB67B107

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1482988683
Opcode ID: c100a6b82ab370481fdf32e0d56ca31663057020fa756cab3f6d667cb0f5af21
Instruction ID: d2288938e8ccad0dbde26f40129b20c695a2cf308f5fd15c35821ec9bec0f709
Opcode Fuzzy Hash: c100a6b82ab370481fdf32e0d56ca31663057020fa756cab3f6d667cb0f5af21
Instruction Fuzzy Hash: 81024D76F1A61394FB149B64E9B4ABC27A0FB09348F684135CA2D5AAFCDF3CA545C340

Function 00007FFDFB6134B0 Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 163COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB613854
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB613861
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB61386E
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB61387B
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB613888
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB613895
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB6138A2
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB6138AF

Strings

Precision not allowed for this argument type., xrefs: 00007FFDFB61330C, 00007FFDFB613881
invalid fill character '{', xrefs: 00007FFDFB61385A
Invalid format string., xrefs: 00007FFDFB613183, 00007FFDFB613333, 00007FFDFB613499, 00007FFDFB61384D
Number is too big, xrefs: 00007FFDFB613176, 00007FFDFB613326, 00007FFDFB61348C, 00007FFDFB61388E
Format specifier requires numeric or pointer argument., xrefs: 00007FFDFB613874
Format specifier requires numeric argument., xrefs: 00007FFDFB6138A8
Argument not found., xrefs: 00007FFDFB6132FF, 00007FFDFB613472, 00007FFDFB613C6C
Can not switch from manual to automatic indexing, xrefs: 00007FFDFB613190, 00007FFDFB6132F2, 00007FFDFB613465, 00007FFDFB613C5F
Invalid fill (too long)., xrefs: 00007FFDFB613867
Missing precision specifier., xrefs: 00007FFDFB61389B
Can not switch from automatic to manual indexing, xrefs: 00007FFDFB613169, 00007FFDFB613319, 00007FFDFB61347F

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Argument not found.$Can not switch from automatic to manual indexing$Can not switch from manual to automatic indexing$Format specifier requires numeric argument.$Format specifier requires numeric or pointer argument.$Invalid fill (too long).$Invalid format string.$Missing precision specifier.$Number is too big$Precision not allowed for this argument type.$invalid fill character '{'
API String ID: 909987262-3616396990
Opcode ID: da059f963979f38b5e7a61a2e3b2238f74d3c5ab9e431b0846fe473c53cbf30d
Instruction ID: e2d3db252ec4d656dcdae58a41ef27105452f9905aeb31dda199447b27efc589
Opcode Fuzzy Hash: da059f963979f38b5e7a61a2e3b2238f74d3c5ab9e431b0846fe473c53cbf30d
Instruction Fuzzy Hash: CF510666B0E29BB5EF518B15D424A782B90AF55F40F4D6031DA6E0F6F9DE2CE441C310

Function 00007FFDFB67E9E8 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EA79
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EAB2
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EB86
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EB97
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EBFA
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EC0A
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EC56
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EC68
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EDDD
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EE5D
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EE6C

Strings

`anonymous namespace', xrefs: 00007FFDFB67ED3A

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: `anonymous namespace'
API String ID: 2943138195-3062148218
Opcode ID: b9860cc78039532e296e8b31e0c3c8b887e741e96b46344d634a29b27477d32a
Instruction ID: 7f672d816f5c59f885eb3534407b8bc5c3f4a7a3dc9928fdbbb146058437e43d
Opcode Fuzzy Hash: b9860cc78039532e296e8b31e0c3c8b887e741e96b46344d634a29b27477d32a
Instruction Fuzzy Hash: 0DE17E72B0AB8395EB10CF24E4A09AC77A4FB44784F645036EA9D5BBA9DF3CE554C700

Function 00007FFDFB6130B0 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 71COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB613170
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB61317D
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB61318A
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB613197

Strings

Precision not allowed for this argument type., xrefs: 00007FFDFB61330C, 00007FFDFB613881
invalid fill character '{', xrefs: 00007FFDFB61385A
Invalid format string., xrefs: 00007FFDFB613183, 00007FFDFB613333, 00007FFDFB613499, 00007FFDFB61384D
Format specifier requires numeric argument., xrefs: 00007FFDFB6138A8
Number is too big, xrefs: 00007FFDFB613176, 00007FFDFB613326, 00007FFDFB61348C, 00007FFDFB61388E
Format specifier requires numeric or pointer argument., xrefs: 00007FFDFB613874
Argument not found., xrefs: 00007FFDFB6132FF, 00007FFDFB613472, 00007FFDFB613C6C
Can not switch from manual to automatic indexing, xrefs: 00007FFDFB613190, 00007FFDFB6132F2, 00007FFDFB613C5F
Invalid fill (too long)., xrefs: 00007FFDFB613867
Unmatched '}' in format string., xrefs: 00007FFDFB613A29
Missing precision specifier., xrefs: 00007FFDFB61389B
Can not switch from automatic to manual indexing, xrefs: 00007FFDFB613169, 00007FFDFB613319, 00007FFDFB61347F

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Argument not found.$Can not switch from automatic to manual indexing$Can not switch from manual to automatic indexing$Format specifier requires numeric argument.$Format specifier requires numeric or pointer argument.$Invalid fill (too long).$Invalid format string.$Missing precision specifier.$Number is too big$Precision not allowed for this argument type.$Unmatched '}' in format string.$invalid fill character '{'
API String ID: 909987262-704016018
Opcode ID: 1e894801ca988bf15ebd6ec6a98c1fc20c4d6064881d087de3528c85137c96d1
Instruction ID: da94acfd8ab300f369997d37ad9414d07955b02860d2ff9c69f2a90c55a8af0f
Opcode Fuzzy Hash: 1e894801ca988bf15ebd6ec6a98c1fc20c4d6064881d087de3528c85137c96d1
Instruction Fuzzy Hash: E321D825F0F94BB9EB189724C476BB837A9DF50F50F942635C23E4E2F9DE2CA5918240

Function 00007FFDFB67CED4 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67CF25
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67CFEE
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67D037
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67D048

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: a29263985357c4185646751ae08dbec72460e706a323b6316621b808d1d7bc47
Instruction ID: a1a3849928098aa974fd54fd8af93f0ad9f5be71e777120a3228d1c6110fd150
Opcode Fuzzy Hash: a29263985357c4185646751ae08dbec72460e706a323b6316621b808d1d7bc47
Instruction Fuzzy Hash: 3FF18A76B0A6839AE710DF64E4A05FC37B0EB0434CB644532DA6D6BAEDDE38D559C340

Function 00007FFDFB67F834 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFDFB67FCD8
DName::DName.LIBVCRUNTIME ref: 00007FFDFB67FD08
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67FD58

Strings

nullptr, xrefs: 00007FFDFB67FA1D
`template-type-parameter-, xrefs: 00007FFDFB67FD79
`generic-class-parameter-, xrefs: 00007FFDFB67FD69
`generic-method-parameter-, xrefs: 00007FFDFB67FD25
lambda, xrefs: 00007FFDFB67FBF8
NULL, xrefs: 00007FFDFB67F901

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 826178784-2441609178
Opcode ID: 20b2abadde5da2ae1ddde090325b674bd4c1340cab84b38ebc29aa5e8a78a6b3
Instruction ID: 67541339fb2b6f070bf740dce4c85b1420542e7d50e0723ac5216586bcd03045
Opcode Fuzzy Hash: 20b2abadde5da2ae1ddde090325b674bd4c1340cab84b38ebc29aa5e8a78a6b3
Instruction Fuzzy Hash: 2AF18D62F1A68394FB149B74A5B8DBD27A0EF04784F640136DE2E1EAFDDE3CA5458340

Function 00007FFDFB613A40 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB613C32
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB613C3F
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB613C4C
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB613C59
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB613C66
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB613C73

Strings

Invalid format string., xrefs: 00007FFDFB613183, 00007FFDFB613333, 00007FFDFB613499, 00007FFDFB61384D, 00007FFDFB613C52
Argument not found., xrefs: 00007FFDFB6132FF, 00007FFDFB613472, 00007FFDFB613C6C
Can not switch from manual to automatic indexing, xrefs: 00007FFDFB613190, 00007FFDFB6132F2, 00007FFDFB613C5F
Missing '}' in format string., xrefs: 00007FFDFB613C2B, 00007FFDFB613C45
Unknown format specifier., xrefs: 00007FFDFB613C38

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Argument not found.$Can not switch from manual to automatic indexing$Invalid format string.$Missing '}' in format string.$Unknown format specifier.
API String ID: 909987262-1402337325
Opcode ID: 852d8f30413072a41a9acb1cb4821a637de1bfc84c6500ccb21beb13cb10ce47
Instruction ID: 079426b439a76d84ec8a8076b2fde481aa08341d4507b7b88ea259e2edcbd2c8
Opcode Fuzzy Hash: 852d8f30413072a41a9acb1cb4821a637de1bfc84c6500ccb21beb13cb10ce47
Instruction Fuzzy Hash: 3251AE62B0AA47A9EB00DF64D4606FC3361AB19B98F445136DA2D1EAEDDF3CD11AC340

Function 00007FFDFB67AC48 Relevance: 16.7, APIs: 11, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67ACB0
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67ADAD
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67AE06
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67AE32
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67AE44
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67AE73

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 5f8004f4d1bd040818cf0d3538c920170fe6bc21241ac7da9fed96537ed4685f
Instruction ID: b312ac1f30d916380bf1809067d4c4f7ae9e7fc07e8f06f62f0d2a327228d5b7
Opcode Fuzzy Hash: 5f8004f4d1bd040818cf0d3538c920170fe6bc21241ac7da9fed96537ed4685f
Instruction Fuzzy Hash: 6A714C72B06A43A9EB10DF64E4A05EC33B1EB4478CB904431DA1D5BAEDEF38D655C380

Function 00007FFDFB672480 Relevance: 16.7, APIs: 11, Instructions: 156COMMON

Download Yara Rule

APIs

__std_fs_open_handle.LIBCPMT ref: 00007FFDFB6724C0

Part of subcall function 00007FFDFB672428: CreateFileW.KERNELBASE ref: 00007FFDFB67245B
Part of subcall function 00007FFDFB672428: GetLastError.KERNEL32 ref: 00007FFDFB67246A

SetFileInformationByHandle.KERNEL32 ref: 00007FFDFB6724EA
__std_fs_open_handle.LIBCPMT ref: 00007FFDFB672522
CloseHandle.KERNEL32 ref: 00007FFDFB67253C
GetLastError.KERNEL32 ref: 00007FFDFB672570
GetFileInformationByHandleEx.KERNEL32 ref: 00007FFDFB6725BC
GetLastError.KERNEL32 ref: 00007FFDFB6725CA
CloseHandle.KERNEL32 ref: 00007FFDFB6725E0
SetFileInformationByHandle.KERNEL32 ref: 00007FFDFB67260C
SetFileInformationByHandle.KERNEL32 ref: 00007FFDFB672640
GetLastError.KERNEL32 ref: 00007FFDFB672662

Part of subcall function 00007FFDFB68A7F4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FFDFB68158E,?,?,?,00007FFDFB681836), ref: 00007FFDFB68A81A

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Handle$File$ErrorInformationLast$Close__std_fs_open_handle$CreateFeaturePresentProcessor
String ID:
API String ID: 2221425841-0
Opcode ID: dfd71fbd023fae2ebb41605f234f9b2ee70f5aafe01ce3ee885fd70a0691c48c
Instruction ID: 17eff47d0c1afcde8549cc0e4ba5a82e84cdeb48e757d789aaf59d66790956e0
Opcode Fuzzy Hash: dfd71fbd023fae2ebb41605f234f9b2ee70f5aafe01ce3ee885fd70a0691c48c
Instruction Fuzzy Hash: B851B921F0954389FB209B75A834ABD2BA0EF4675CF244235CD399E6EDDE68D4418710

Function 00007FFDFB67C718 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67C772
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67C8A8

Strings

coclass , xrefs: 00007FFDFB67C861
union , xrefs: 00007FFDFB67C8D5
enum , xrefs: 00007FFDFB67C885
cointerface , xrefs: 00007FFDFB67C84F
`unknown ecsu', xrefs: 00007FFDFB67C73E
class , xrefs: 00007FFDFB67C8BD
struct , xrefs: 00007FFDFB67C8CC

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 2943138195-1464470183
Opcode ID: 50d65f81b843bc446e088cdd40ec6fe37d233a158ffb5bb49f73259f984ada69
Instruction ID: 3d5e655a597a19ada8d20ef4015b6aea366cee7eefe13b344fc1c75b04fcffa4
Opcode Fuzzy Hash: 50d65f81b843bc446e088cdd40ec6fe37d233a158ffb5bb49f73259f984ada69
Instruction Fuzzy Hash: DF512972F1A61799FB10DB64E8A09BC2B70FB04388F64013ADA5D5AEEDDF28E555C300

Function 00007FFDFB62AFBC Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 352COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB655E4B

Strings

DL_GroupParameters_EC<EC>, xrefs: 00007FFDFB655E51, 00007FFDFB655ECD, 00007FFDFB655F49
SubgroupOrder, xrefs: 00007FFDFB655C3D, 00007FFDFB655F74
: missing required parameter ', xrefs: 00007FFDFB655E65, 00007FFDFB655EE1, 00007FFDFB655F5D
Curve, xrefs: 00007FFDFB655BF6, 00007FFDFB655E7C
SubgroupGenerator, xrefs: 00007FFDFB655C19, 00007FFDFB655EF8
GroupOID, xrefs: 00007FFDFB655B33
Cofactor, xrefs: 00007FFDFB655C69

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: : missing required parameter '$Cofactor$Curve$DL_GroupParameters_EC<EC>$GroupOID$SubgroupGenerator$SubgroupOrder
API String ID: 3668304517-2280919341
Opcode ID: c6b3c6989d034716b395edafa0dc23c966fd5e5ef6e8809c5add72ff7e0bd1be
Instruction ID: 2db73b3556fea2b4d32272e81ef2dbd37aea12ce945fba78c95ae49f0202f248
Opcode Fuzzy Hash: c6b3c6989d034716b395edafa0dc23c966fd5e5ef6e8809c5add72ff7e0bd1be
Instruction Fuzzy Hash: 8DE18D72B06A8794EF10DF61D8A4AE92361FB85B98F449432EA2D4B6FDDF38D545C300

Function 00007FFDFB666F80 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFDFB666FAC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6672E1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6672ED
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6672F3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6672F9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6672FF

Part of subcall function 00007FFDFB637980: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB637AF9
Part of subcall function 00007FFDFB637980: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB637AFF

Strings

operation failed with error , xrefs: 00007FFDFB66704B, 00007FFDFB66706D
OS_Rng: , xrefs: 00007FFDFB667001

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskErrorLast
String ID: operation failed with error $OS_Rng:
API String ID: 2277578949-700108173
Opcode ID: 14eeb0fa364cd80e698f63d657d47487c2efc40f27f8e3c0aa9e58351d5ada90
Instruction ID: d05261e5e6661264c7a20d9fcc9206be392fef1ef7ee531d3b20272756d6a8d1
Opcode Fuzzy Hash: 14eeb0fa364cd80e698f63d657d47487c2efc40f27f8e3c0aa9e58351d5ada90
Instruction Fuzzy Hash: C3A18262F16B8649FB008B65D4607BD2362EB99798F505231EE7C1A7EADF3CE185C340

Function 00007FFDFB6809C8 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

Strings

generic-type-, xrefs: 00007FFDFB680ACB
template-parameter-, xrefs: 00007FFDFB680A84
`generic-type-, xrefs: 00007FFDFB680AFE
`template-parameter-, xrefs: 00007FFDFB680AB7

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 0-3207858774
Opcode ID: 9970b5ccc322f50bec69583ab25d9488b0b526dd466357cb340dbf02cb49d5c5
Instruction ID: 1a5d356e49e3c341879ea6ee287fec4e8fcc2bac3069bed214e854f632b1374d
Opcode Fuzzy Hash: 9970b5ccc322f50bec69583ab25d9488b0b526dd466357cb340dbf02cb49d5c5
Instruction Fuzzy Hash: B781AE62B1AA8795EB108F20D4A0AB837A1EF04B88F549532DA6D0B7F9DF3CE545C340

Function 00007FFDFB61C010 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB61C099
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FFDFB61C0E2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB61C22C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB61C267
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB61C26D

Strings

bad locale name, xrefs: 00007FFDFB61C25A
false, xrefs: 00007FFDFB61C154
true, xrefs: 00007FFDFB61C183

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: std::_$Concurrency::cancel_current_taskLockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 461674175-1062449267
Opcode ID: b77aaba0802fbf532033256dbc466d5a718d53abbf90940fe2b125089881c75e
Instruction ID: e17d3d09e69ec58b423d04d3473530fe76eb18860031d7360c9acdab4e87a371
Opcode Fuzzy Hash: b77aaba0802fbf532033256dbc466d5a718d53abbf90940fe2b125089881c75e
Instruction Fuzzy Hash: E2618F32B0BB428AFB11DBA4E4207BD32A5AF84B48F145434DA6D5FAEDDE38D415C354

Function 00007FFDFB67E424 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67E5D8

Part of subcall function 00007FFDFB67AF9C: DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67B507
Part of subcall function 00007FFDFB67AF9C: DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67B53F

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67E58A

Strings

cli::array<, xrefs: 00007FFDFB67E557
std::nullptr_t , xrefs: 00007FFDFB67E516
void , xrefs: 00007FFDFB67E496
cli::pin_ptr<, xrefs: 00007FFDFB67E5A1
std::nullptr_t, xrefs: 00007FFDFB67E503
void, xrefs: 00007FFDFB67E46E

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: ad69e7676641cb751fe2781d35458e0314907f8473298f368c72a36afc7ce6a4
Instruction ID: 81ee8ee4a793593afcf0b9ddfc90bcb7eb584dbb396ae6a1612d3125ef7f9da7
Opcode Fuzzy Hash: ad69e7676641cb751fe2781d35458e0314907f8473298f368c72a36afc7ce6a4
Instruction Fuzzy Hash: 6A514F62F1AB5798FB11CB60E8A06BC37B4EB08744F644136DA5D5AAEDEF3C9058C710

Function 00007FFDFB636CC0 Relevance: 13.6, APIs: 9, Instructions: 86networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FFDFB636D11
socket.WS2_32 ref: 00007FFDFB636D3D
WSAGetLastError.WS2_32 ref: 00007FFDFB636D4C
ioctlsocket.WS2_32 ref: 00007FFDFB636D67
connect.WS2_32 ref: 00007FFDFB636D7B
WSAGetLastError.WS2_32 ref: 00007FFDFB636D86
closesocket.WS2_32 ref: 00007FFDFB636D96
htons.WS2_32 ref: 00007FFDFB636DC4
_Xtime_get_ticks.LIBCPMT ref: 00007FFDFB636DD5

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorLasthtons$Xtime_get_ticksclosesocketconnectioctlsocketsocket
String ID:
API String ID: 712701749-0
Opcode ID: 7e3ad837a012701c2ff9d0a130d5f4c64b38bbc2689cd5f852cf80a53958edd9
Instruction ID: 9b76b3a6b39b5ceed344b4a1919f4d92706a2e4179009146d247952036cf2feb
Opcode Fuzzy Hash: 7e3ad837a012701c2ff9d0a130d5f4c64b38bbc2689cd5f852cf80a53958edd9
Instruction Fuzzy Hash: 0A31A122A09A4681EB108F25E8105697760EB58F78F149335EABD0B7E9DF3CD085D704

Function 00007FFDFB6765C0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFDFB67661D

Part of subcall function 00007FFDFB678980: __GetUnwindTryBlock.LIBCMT ref: 00007FFDFB6789C3
Part of subcall function 00007FFDFB678980: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFDFB6789E8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFDFB6766F5
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFDFB676943
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFDFB676A50

Strings

csm, xrefs: 00007FFDFB676637
csm, xrefs: 00007FFDFB676718
csm, xrefs: 00007FFDFB67669E

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 8214f45ecad1e28f61f107e78f3edc604edcf0266de1099433125364fa9f4567
Instruction ID: d9ce680ed8f3a6646d330953d2b20b78a1d570b00b3ab6cef3e11c7d5294fb37
Opcode Fuzzy Hash: 8214f45ecad1e28f61f107e78f3edc604edcf0266de1099433125364fa9f4567
Instruction Fuzzy Hash: C2D16032B0978386EB20DB65A850BAD77A0FB55788F204135EE6D5B7E9DF38E580C700

Function 00007FFDFB611AF0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 288COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB611B6A
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB611B77
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB611B94

Strings

Negative width., xrefs: 00007FFDFB611B70
Number is too big., xrefs: 00007FFDFB611B8D

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_invalid_parameter_noinfo_noreturn
String ID: Negative width.$Number is too big.
API String ID: 3237623162-1861685508
Opcode ID: 763bcf7a5769fc43bb4a27eb96f043e78b1c405903fb87348719515fef5ff4bd
Instruction ID: 4e480f23bde6bfb2df2a8ff8828d3c1e0083a624034dd1c50d36ec3a4a83f024
Opcode Fuzzy Hash: 763bcf7a5769fc43bb4a27eb96f043e78b1c405903fb87348719515fef5ff4bd
Instruction Fuzzy Hash: ECA14522B0A68756DB14DF25A4218B96760FF95FD4F144631EEAD0BBEADE3CE142C700

Function 00007FFDFB61E390 Relevance: 12.2, APIs: 8, Instructions: 250COMMON

Download Yara Rule

APIs

_Xtime_get_ticks.LIBCPMT ref: 00007FFDFB61E42D

Part of subcall function 00007FFDFB672C18: GetCurrentThreadId.KERNEL32 ref: 00007FFDFB672C69
Part of subcall function 00007FFDFB672C18: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,00000000,00007FFDFB672E41,?,?,?,00007FFDFB63A6BE), ref: 00007FFDFB672C88

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61E632
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB61E63D
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB61E64D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61E653
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61E659
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61E69C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61E6EB

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Cpp_errorThrow_std::_$AcquireCurrentExclusiveLockThreadXtime_get_ticks
String ID:
API String ID: 4035917859-0
Opcode ID: 5b0f592b6bad469ff9a9ac4a5298cbfee1647dd88c5fc1c53353a5131d47215d
Instruction ID: 08eaabdd03a36808da4f756f68332a4febf6c49ff718fca1ef8f42cefed49f40
Opcode Fuzzy Hash: 5b0f592b6bad469ff9a9ac4a5298cbfee1647dd88c5fc1c53353a5131d47215d
Instruction Fuzzy Hash: 7091B072F16B4286EB008B75E4547AD23A1FB49BA8F105335EE6C1BBE9DE38D091C340

Function 00007FFDFB68C88C Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB68C8CF
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB68CCBC
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB68CF58

Strings

p, xrefs: 00007FFDFB68C9F9
f, xrefs: 00007FFDFB68C9F1
p, xrefs: 00007FFDFB68C981

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 39bb40b701b96a0096dcea3733e3b8e80183c7a15ca1de3b14265d2cb685e729
Instruction ID: e4a01faf83ef6a9f2d4bbfb01584fd73ad243e1a56b8ef22fdd32248c6034279
Opcode Fuzzy Hash: 39bb40b701b96a0096dcea3733e3b8e80183c7a15ca1de3b14265d2cb685e729
Instruction Fuzzy Hash: 2612A571B0EA4386FB649A14D064A797692FF80750F94C136E6A94BEECDF3CE590DB00

Function 00007FFDFB69210C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB692539

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 355f458a4225a0281101f9e541c8bc122854980bee9205288e4825ecd3227854
Instruction ID: cc9e2b3e0295da3cd9194bb138da0728a4225bd405b680bde9fcc7d13e3bae94
Opcode Fuzzy Hash: 355f458a4225a0281101f9e541c8bc122854980bee9205288e4825ecd3227854
Instruction Fuzzy Hash: 2FC1E122B0AA8781FB21AB149460ABD7790FF80B9CF554131DA6E0B3F9CF7DE8458310

Function 00007FFDFB61B920 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61EF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61EF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61EF2B

Strings

, xrefs: 00007FFDFB61EDA9
, xrefs: 00007FFDFB61EE2F
, xrefs: 00007FFDFB61EE90

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $ $
API String ID: 3668304517-3665324030
Opcode ID: 187a581125c0c8667baee678a40912781559756569e3ad6486e1f30450dac9c7
Instruction ID: 59194a4e3e540cd7ba582d68a853ec7f643648bda4af6ccd4abf8843fadfa0b6
Opcode Fuzzy Hash: 187a581125c0c8667baee678a40912781559756569e3ad6486e1f30450dac9c7
Instruction Fuzzy Hash: 5981A362F0AB8661FB109B65D4657AD6361BF49BD8F545231EEBC0AAEDDE2CD0818300

Function 00007FFDFB633EF0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6341D7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6341DD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB634206
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB634218

Strings

, xrefs: 00007FFDFB6342B3
Failed to deserialize object, xrefs: 00007FFDFB6341E3

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: $Failed to deserialize object
API String ID: 3936042273-753972862
Opcode ID: 762814bd836b04c834a0657919f3d177fb83be48ff78085885903f2da025e09c
Instruction ID: 9b4597c2e5ffc209da544a3e823e13b9899d5cec4262071f46fcdb0e9e2a197f
Opcode Fuzzy Hash: 762814bd836b04c834a0657919f3d177fb83be48ff78085885903f2da025e09c
Instruction Fuzzy Hash: 5F91E222B1AB8282EB10CF65D4656BD6360FB59794F545235EEAD1BBE9DF38E0C1C300

Function 00007FFDFB6807BC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB680830
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB68083F

Part of subcall function 00007FFDFB67E9E8: DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EA79
Part of subcall function 00007FFDFB67E9E8: DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EAB2
Part of subcall function 00007FFDFB67E9E8: DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EDDD

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB6808DF
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB6808EF
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB68099B

Strings

{for , xrefs: 00007FFDFB680868

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: {for
API String ID: 2943138195-864106941
Opcode ID: 41704f21a11950867ea1e1fd5da5d81cfa9041306fc224019d652ae96451f81e
Instruction ID: 85d289f0d0ea5388e90abcd47d85eb6b61098f55521b4b4c31776fa967db14c7
Opcode Fuzzy Hash: 41704f21a11950867ea1e1fd5da5d81cfa9041306fc224019d652ae96451f81e
Instruction Fuzzy Hash: 3A512872B0AA87A9FB119F24D4A07E837A0EB44748F549432DA6C4BBE9DF7CD594C340

Function 00007FFDFB66F9F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FFDFB66FA15
GetLastError.KERNEL32 ref: 00007FFDFB66FA3C

Strings

Timer: QueryPerformanceFrequency failed with error , xrefs: 00007FFDFB66FB4C
Timer: QueryPerformanceCounter failed with error , xrefs: 00007FFDFB66FA58

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: CounterErrorLastPerformanceQuery
String ID: Timer: QueryPerformanceCounter failed with error $Timer: QueryPerformanceFrequency failed with error
API String ID: 1297246462-2136607233
Opcode ID: df7ff94602166289a42e225d86edb95e8729115b8e04d586c0ff8c1ef39a7456
Instruction ID: 3975bf3b669001b225b56cc74893d0b3b4eb481146a5a67e7b075d27972f6c2c
Opcode Fuzzy Hash: df7ff94602166289a42e225d86edb95e8729115b8e04d586c0ff8c1ef39a7456
Instruction Fuzzy Hash: 8D413221B0AA8785EB209B25F861B7633A1FF94784F544132D66D8B7F9DF2CE545CB00

Function 00007FFDFB68111C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FFDFB681323,?,?,?,00007FFDFB675B42,?,?,?,00007FFDFB67582D), ref: 00007FFDFB6811A1
GetLastError.KERNEL32(?,?,00000000,00007FFDFB681323,?,?,?,00007FFDFB675B42,?,?,?,00007FFDFB67582D), ref: 00007FFDFB6811AF
LoadLibraryExW.KERNEL32(?,?,00000000,00007FFDFB681323,?,?,?,00007FFDFB675B42,?,?,?,00007FFDFB67582D), ref: 00007FFDFB6811D9
FreeLibrary.KERNEL32(?,?,00000000,00007FFDFB681323,?,?,?,00007FFDFB675B42,?,?,?,00007FFDFB67582D), ref: 00007FFDFB681247
GetProcAddress.KERNEL32(?,?,00000000,00007FFDFB681323,?,?,?,00007FFDFB675B42,?,?,?,00007FFDFB67582D), ref: 00007FFDFB681253

Strings

api-ms-, xrefs: 00007FFDFB6811C1

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 07acfc434d8fba2c25cf224bca2edca38b86016518df40fca1d637bedadf550a
Instruction ID: 6c59f728e233cd748ee737a43d27637fca5d91ccf29688458cc4855b702fb447
Opcode Fuzzy Hash: 07acfc434d8fba2c25cf224bca2edca38b86016518df40fca1d637bedadf550a
Instruction Fuzzy Hash: 06319021B1BA47D5EF129B46A8609352294BF48BA0F494635DD7D4F7E8EF3CE485C700

Function 00007FFDFB67A990 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67AA42

Strings

,..., xrefs: 00007FFDFB67AA10
<ellipsis>, xrefs: 00007FFDFB67AA8F
..., xrefs: 00007FFDFB67AA7F
,<ellipsis>, xrefs: 00007FFDFB67AA20
void, xrefs: 00007FFDFB67AAB4

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 2943138195-2211150622
Opcode ID: a81fb7c0f206b3fd3ea3989759a5cb9e85c98106f35305438c8eddaaf482a0f7
Instruction ID: 418601bf481104a0bef1ff9d31f6b01b54b0235ae5e42706926eaf9f5f93fcc7
Opcode Fuzzy Hash: a81fb7c0f206b3fd3ea3989759a5cb9e85c98106f35305438c8eddaaf482a0f7
Instruction Fuzzy Hash: 5D410FB2F1AB4798F7118B64E8A05BC37A0EB08344F645536CA6C5A7F8DF7C9584C704

Function 00007FFDFB67C914 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67C9F7

Strings

short , xrefs: 00007FFDFB67C994
int , xrefs: 00007FFDFB67C985
char , xrefs: 00007FFDFB67C99D
long , xrefs: 00007FFDFB67C976
unsigned , xrefs: 00007FFDFB67C9CB

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: 10458723e1e0f583feefcb74a5f1fe46058df9c9ab332140c206a2f0c883819b
Instruction ID: dbfa296dbe3edefd13e8a5cd6688b3f77ef7c9b788d4caa5bbbc24c482ed9852
Opcode Fuzzy Hash: 10458723e1e0f583feefcb74a5f1fe46058df9c9ab332140c206a2f0c883819b
Instruction Fuzzy Hash: 9C316B72F1A65389E7418B78E8A09BC37A0EB49744F548136DA6C5ABFCDE3CD544C700

Function 00007FFDFB68D570 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFDFB68D57F
FlsGetValue.KERNEL32 ref: 00007FFDFB68D594
FlsSetValue.KERNEL32 ref: 00007FFDFB68D5B5
FlsSetValue.KERNEL32 ref: 00007FFDFB68D5E2
FlsSetValue.KERNEL32 ref: 00007FFDFB68D5F3
FlsSetValue.KERNEL32 ref: 00007FFDFB68D604
SetLastError.KERNEL32 ref: 00007FFDFB68D61F

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 142cda5b445fd9cd4b8819c48a9508090ce2e32c12d230240076127be46704ae
Instruction ID: 90006bf39bb675d1f4f2a2ce97d7d69087bfbcaf77d72e2684035e5eb91c8118
Opcode Fuzzy Hash: 142cda5b445fd9cd4b8819c48a9508090ce2e32c12d230240076127be46704ae
Instruction Fuzzy Hash: 28215B30F0FA4342FB5867619671D3962425F48BA4F148B39E93E4FAFEEE2CE4854611

Function 00007FFDFB69E12C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFDFB69E15D
GetLastError.KERNEL32 ref: 00007FFDFB69E169
CloseHandle.KERNEL32 ref: 00007FFDFB69E181
CreateFileW.KERNEL32 ref: 00007FFDFB69E1AC
WriteConsoleW.KERNEL32 ref: 00007FFDFB69E1CB

Strings

CONOUT$, xrefs: 00007FFDFB69E18D

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: b6553d28cb4e406af14dd068af80b7bbb2cedc99278983a23cf07c38739057e1
Instruction ID: dfd0438c3b4fd92f83164fc22cfad77e76e428bd85fe416fe66839eb93ec37f5
Opcode Fuzzy Hash: b6553d28cb4e406af14dd068af80b7bbb2cedc99278983a23cf07c38739057e1
Instruction Fuzzy Hash: B5115431719B4286E7508B56E96472576A4FB48FE4F044235E97D8B7F8CF7CD4448740

Function 00007FFDFB62D730 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB62D7AB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB62D7B1

Strings

, xrefs: 00007FFDFB62E6EA
, xrefs: 00007FFDFB62E184
@, xrefs: 00007FFDFB62E0B9
, xrefs: 00007FFDFB62E12A

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: $ $ $@
API String ID: 73155330-2667860089
Opcode ID: 355042243a2969ce2c645eaf548f360dec7be57eff7f6389d299ea3ace8be27d
Instruction ID: 420ef11d30a9773507be3f530385f6a9eb737f5ed08eb817dc1372606183714d
Opcode Fuzzy Hash: 355042243a2969ce2c645eaf548f360dec7be57eff7f6389d299ea3ace8be27d
Instruction Fuzzy Hash: A6014422F0B74751FF146B61A565B7C2290AF597B0F688B30DE7D0A7E9FE2CE4918210

Function 00007FFDFB672ED8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 17libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFDFB672EE5
GetProcAddress.KERNEL32 ref: 00007FFDFB672EF8
GetProcAddress.KERNEL32 ref: 00007FFDFB672F0F

Strings

kernel32.dll, xrefs: 00007FFDFB672EDE
GetSystemTimePreciseAsFileTime, xrefs: 00007FFDFB672EEE
GetTempPath2W, xrefs: 00007FFDFB672EFE

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 13902cd22a4d49b05a42bb127ae860c44e9e1ff68acdfa1180e7bfb29cf8e054
Instruction ID: 99fbe7ad8f84c98784d1911ca9a46fc154f1083d7900440a39334553ac198b7b
Opcode Fuzzy Hash: 13902cd22a4d49b05a42bb127ae860c44e9e1ff68acdfa1180e7bfb29cf8e054
Instruction Fuzzy Hash: 66E0ED20B0BB0381EF408B55ACA48643BA8AF08B41F444031C86E4A3B8EF6DA499C300

Function 00007FFDFB672F88 Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFDFB672FF8
MultiByteToWideChar.KERNEL32 ref: 00007FFDFB673096
LCMapStringEx.KERNEL32 ref: 00007FFDFB6730FF
LCMapStringEx.KERNEL32 ref: 00007FFDFB673151
LCMapStringEx.KERNEL32 ref: 00007FFDFB6731F6
WideCharToMultiByte.KERNEL32 ref: 00007FFDFB673250

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: c69d599fc502ed974573801a2f5a1aeb25cc92b8b09d0c3ccbf250c0654745a9
Instruction ID: 7d3ef5f4b4e51b0fe7c6b1beacb7e31f30542bd42fa8bd24e509a5e3952b0e43
Opcode Fuzzy Hash: c69d599fc502ed974573801a2f5a1aeb25cc92b8b09d0c3ccbf250c0654745a9
Instruction Fuzzy Hash: 82818272B0A74286EB208F15A960B7972D5FF44BA4F244235EA6D4BBE8DF7CD4468700

Function 00007FFDFB67CA3C Relevance: 9.2, APIs: 6, Instructions: 160COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFDFB67CAEE
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67CAFE
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67CB1B
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67CB92
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67CBBB

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: dd1491023aa3f01291226eee60ccf1eed5b06d5e4ff3d5b7f7fdd318a87d23d1
Instruction ID: 2c00fe8eb0ed1bfd183b0b864f181b2f82a0e5741ce4141454bbac209062bfe9
Opcode Fuzzy Hash: dd1491023aa3f01291226eee60ccf1eed5b06d5e4ff3d5b7f7fdd318a87d23d1
Instruction Fuzzy Hash: C8718D72B1AA5385E710CB65E8A0BAC37A1FB44784F648036DA6C4BAE9DF3CD481C700

Function 00007FFDFB672C18 Relevance: 9.1, APIs: 6, Instructions: 94threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FFDFB672C69
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,00000000,00007FFDFB672E41,?,?,?,00007FFDFB63A6BE), ref: 00007FFDFB672C88
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,00000000,00007FFDFB672E41,?,?,?,00007FFDFB63A6BE), ref: 00007FFDFB672CAA
sys_get_time.LIBCPMT ref: 00007FFDFB672CC5
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,00000000,00007FFDFB672E41,?,?,?,00007FFDFB63A6BE), ref: 00007FFDFB672CEB
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,00000000,00007FFDFB672E41,?,?,?,00007FFDFB63A6BE), ref: 00007FFDFB672D03

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThreadsys_get_time
String ID:
API String ID: 184115430-0
Opcode ID: 3538d72cd420df0075b96c4acfd20637aacb013f4136ac6e0bf9d43b99a0fc02
Instruction ID: 426696d6620390f86002e8b8b438dfbf2588ecb2bff97ab0d578537a611209f7
Opcode Fuzzy Hash: 3538d72cd420df0075b96c4acfd20637aacb013f4136ac6e0bf9d43b99a0fc02
Instruction Fuzzy Hash: CF414F32B1A60386EB64AF14E464A797360FB15B48F604431DA6D4A6FDDF3CE895CB00

Function 00007FFDFB68D6E8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0000FBDB617AEA9A,00007FFDFB687021,?,?,?,?,00007FFDFB695AFA,?,?,00000000,00007FFDFB697537,?,?,?), ref: 00007FFDFB68D6F7
FlsSetValue.KERNEL32(?,?,0000FBDB617AEA9A,00007FFDFB687021,?,?,?,?,00007FFDFB695AFA,?,?,00000000,00007FFDFB697537,?,?,?), ref: 00007FFDFB68D72D
FlsSetValue.KERNEL32(?,?,0000FBDB617AEA9A,00007FFDFB687021,?,?,?,?,00007FFDFB695AFA,?,?,00000000,00007FFDFB697537,?,?,?), ref: 00007FFDFB68D75A
FlsSetValue.KERNEL32(?,?,0000FBDB617AEA9A,00007FFDFB687021,?,?,?,?,00007FFDFB695AFA,?,?,00000000,00007FFDFB697537,?,?,?), ref: 00007FFDFB68D76B
FlsSetValue.KERNEL32(?,?,0000FBDB617AEA9A,00007FFDFB687021,?,?,?,?,00007FFDFB695AFA,?,?,00000000,00007FFDFB697537,?,?,?), ref: 00007FFDFB68D77C
SetLastError.KERNEL32(?,?,0000FBDB617AEA9A,00007FFDFB687021,?,?,?,?,00007FFDFB695AFA,?,?,00000000,00007FFDFB697537,?,?,?), ref: 00007FFDFB68D797

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1502874ff45f76d6c21981aded53722def914637955730e95e8c36915b443b15
Instruction ID: 49be4a07e32bc1c23f5da7fe87bf172d161ef33f1f6eecff0ad9ea25c2d66b91
Opcode Fuzzy Hash: 1502874ff45f76d6c21981aded53722def914637955730e95e8c36915b443b15
Instruction Fuzzy Hash: A9114D34B0BA8342FB5467619671D3962425F49BB0F548B38E93E4F7FEEE2CE4454210

Function 00007FFDFB6058A0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 250COMMON

Download Yara Rule

Strings

ios_base::failbit set, xrefs: 00007FFDFB6059F5
ios_base::eofbit set, xrefs: 00007FFDFB6059FC
ios_base::badbit set, xrefs: 00007FFDFB6059E9, 00007FFDFB605A40

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-1866435925
Opcode ID: 80f342c240423b6d439152f815833a2122f4de5321d2102b59a4447c8f842826
Instruction ID: 56aedb3fbbcf017acedad3af473e01645d4ded514d4c04566c5c1e590148452d
Opcode Fuzzy Hash: 80f342c240423b6d439152f815833a2122f4de5321d2102b59a4447c8f842826
Instruction Fuzzy Hash: 97A1A22270AA8685EB108F1AD4A077977A0FB85FD4F188436DE5D4B7A9DF3DD846C700

Function 00007FFDFB637D40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB637FD1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB637FDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB637FE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB637FE9

Strings

is not a valid key length, xrefs: 00007FFDFB637E1E, 00007FFDFB637E40

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: is not a valid key length
API String ID: 3668304517-2125742942
Opcode ID: a44de9033452221f4bd46209454bd3b707c15caffd560188833769e5ef704fd8
Instruction ID: ecd4ef6ed0a9012214c2fe1b0416ebef0d7d9539974547c849ed5175034c6822
Opcode Fuzzy Hash: a44de9033452221f4bd46209454bd3b707c15caffd560188833769e5ef704fd8
Instruction Fuzzy Hash: C271A062B1AB4685FB009B65E460BFC2361EB497A8F545235DA7C1BBEEDE3CD181C340

Function 00007FFDFB628360 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

Strings

er ", xrefs: 00007FFDFB6283D1
" not used, xrefs: 00007FFDFB62845E, 00007FFDFB628480

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: " not used$er "
API String ID: 0-1755945580
Opcode ID: 29fa0ffc7e4caed9bf46794d5c3b7cd480e7ea70539fa8ede82fa101d327d427
Instruction ID: 39564dc029e633f6570dfe4126a67410744dc0ed5213a6a39a3490d627d2e25e
Opcode Fuzzy Hash: 29fa0ffc7e4caed9bf46794d5c3b7cd480e7ea70539fa8ede82fa101d327d427
Instruction Fuzzy Hash: DD717462F15B8689FB00CB74D8617BC2361EB59798F549331DE6C1A6EAEF78E190C340

Function 00007FFDFB67E16C Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67E40C

Strings

std::nullptr_t , xrefs: 00007FFDFB67E39C
volatile, xrefs: 00007FFDFB67E1E2, 00007FFDFB67E313
volatile , xrefs: 00007FFDFB67E1D3, 00007FFDFB67E304
std::nullptr_t, xrefs: 00007FFDFB67E3C5

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: ca8ed66d334534281d261613d577ab165b8490c58799e91a0b749e31a8b8903d
Instruction ID: c98577fbd90d44c012f8b2e0c1632856dfaf2461f4ad9f01e28f39a63c056e1c
Opcode Fuzzy Hash: ca8ed66d334534281d261613d577ab165b8490c58799e91a0b749e31a8b8903d
Instruction Fuzzy Hash: 59714072B1A75384EB148F64E8A087C76A9FB09784F644536D96D4ABFCDF3CE1648700

Function 00007FFDFB603830 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB6038B1
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FFDFB6038F9
_Getctype.LIBCPMT ref: 00007FFDFB603916
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB6039B1

Strings

bad locale name, xrefs: 00007FFDFB6039D9

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: 66edb30a6dfeee2680ee6c89157b69503e4bf244230b7eb6e4f5d53ee7052f28
Instruction ID: 65948ec20b839ca1dcdcca602a8096dda44e75b91a74f32fe829b9ebef6790e5
Opcode Fuzzy Hash: 66edb30a6dfeee2680ee6c89157b69503e4bf244230b7eb6e4f5d53ee7052f28
Instruction Fuzzy Hash: 33518F22B0AB4289FB11CBA1D4607BD33A4EF84B88F184435DE9D2BAE9DF38D515C354

Function 00007FFDFB611960 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6119DA
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB6119E7
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB611A04

Strings

Number is too big., xrefs: 00007FFDFB6119FD
Negative precision., xrefs: 00007FFDFB6119E0

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_invalid_parameter_noinfo_noreturn
String ID: Negative precision.$Number is too big.
API String ID: 3237623162-3993994484
Opcode ID: 37132bcf24ecc0e7e2323566394ab3b0f24b108b6752cd909be6af9d9ac3697a
Instruction ID: 5407f417c3b2aa9750005566f28a54a2bddeb4964b923d617265a3c3f898d229
Opcode Fuzzy Hash: 37132bcf24ecc0e7e2323566394ab3b0f24b108b6752cd909be6af9d9ac3697a
Instruction Fuzzy Hash: FB41C522A1D5C796D70ADB38D0318F86F20EFA6758F188A21E3D9058ABDE5DD195CB00

Function 00007FFDFB67CD6C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFDFB67CDC6

Strings

%lf, xrefs: 00007FFDFB67CE01, 00007FFDFB67CE35, 00007FFDFB67CE65

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: 5f1d5fc30767cd1cb93d372c74b28e38d6c85c6f7125ac1e31084da6f02c8b25
Instruction ID: 93eebc8b8fcae3e25c49160589e21d0b5016e60ac0738d2dd06a72238b382c12
Opcode Fuzzy Hash: 5f1d5fc30767cd1cb93d372c74b28e38d6c85c6f7125ac1e31084da6f02c8b25
Instruction Fuzzy Hash: 62319261B1EB8781E710DB21B8A08B97750FF55780F648132D9AE4BAF9DF2CE5418340

Function 00007FFDFB67FD84 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFDFB67FE66

Strings

`template-parameter, xrefs: 00007FFDFB67FE74
void, xrefs: 00007FFDFB67FDCA

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: NameName::
String ID: `template-parameter$void
API String ID: 1333004437-4057429177
Opcode ID: 5fa1d82887da1f90417ad8370551d763b546491fd96c281dd15cb1d32fb51d71
Instruction ID: 63690a4888e8aa27902dc330bb4569e84851c316f227d67c2c97b00023fe9508
Opcode Fuzzy Hash: 5fa1d82887da1f90417ad8370551d763b546491fd96c281dd15cb1d32fb51d71
Instruction Fuzzy Hash: 03416D22B19B5798FB008B64E8A1AFC23B1FB08788F645136DE5D1BAADDF3C9545C340

Function 00007FFDFB666E70 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFB666ED4
__std_exception_copy.LIBVCRUNTIME ref: 00007FFDFB666F3D

Strings

RNG, xrefs: 00007FFDFB666E9F
BCryptOpenAlgorithmProvider, xrefs: 00007FFDFB666EDA
Microsoft Primitive Provider, xrefs: 00007FFDFB666E98

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorLast__std_exception_copy
String ID: BCryptOpenAlgorithmProvider$Microsoft Primitive Provider$RNG
API String ID: 1471562160-2191745741
Opcode ID: 40cf588d403c7587a3ea496d36200c32b721983c3f7a31492d57b60878080a41
Instruction ID: 00814ff7175d66ac13ee28210adc3a9b2b4934ea5cc7fd933b5e30aaf1226bb6
Opcode Fuzzy Hash: 40cf588d403c7587a3ea496d36200c32b721983c3f7a31492d57b60878080a41
Instruction Fuzzy Hash: EB217C62B0AB4795EB109F24E8607A92371FB98784F548032D66C4B6B9EF3CE559CB40

Function 00007FFDFB675E90 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FFDFB675FB3
__AdjustPointer.LIBCMT ref: 00007FFDFB675FFE

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e4495c097494c00d02c59e9485302c0d914f74382517764e806d5db3fca400f8
Instruction ID: 57feccfdd985c83716ff3ada07e6989ab08fd3a1679e30c82ba2a53b9efb7fe1
Opcode Fuzzy Hash: e4495c097494c00d02c59e9485302c0d914f74382517764e806d5db3fca400f8
Instruction Fuzzy Hash: 15B1B222B0B64381EF659B15A9A4D3963A0EF44B84F398435DE6D0F7EDDE3CE4918740

Function 00007FFDFB65CFF0 Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB65D27B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB65D281
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB65D287
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB65D28D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB65D293

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 1932a0e649effde48a060eaf698a1baa9c863acae708b68475c5274fe8837a8c
Instruction ID: e8ffc1eecb5a70cc0aa2b4d1366bde1053d577200083cb533645c23f3de8fe4b
Opcode Fuzzy Hash: 1932a0e649effde48a060eaf698a1baa9c863acae708b68475c5274fe8837a8c
Instruction Fuzzy Hash: 62619062B2674B54EF00DBB9D065BAD2361AF857A4F105731EA3C1ABEDDE28E181C300

Function 00007FFDFB606BF0 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB606C27
GetForegroundWindow.USER32 ref: 00007FFDFB606C86
GetWindowTextA.USER32 ref: 00007FFDFB606CB5

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Window$ForegroundText_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4018886193-0
Opcode ID: 9006d8dc82fbec5b89c071509fd411ae7e4f27a5b73f2cd900d7c8c2c9cb992f
Instruction ID: d5293d198af52846575a7270d4378d974533055986c4bad2c567436695ec397e
Opcode Fuzzy Hash: 9006d8dc82fbec5b89c071509fd411ae7e4f27a5b73f2cd900d7c8c2c9cb992f
Instruction Fuzzy Hash: E851D622B1AB8285EB118B15E8507B97390FF89794F041335EAEE4ABE9DF3CD185C700

Function 00007FFDFB634220 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1bbd6a9d7cf0cc4cae3a24be0a327fc45526a94b018f38557e009b1f26400f0
Instruction ID: 83ddb1e5481d298b4573428274f1fe79c8ad703d4511aab928c8f1b7ccc35c55
Opcode Fuzzy Hash: c1bbd6a9d7cf0cc4cae3a24be0a327fc45526a94b018f38557e009b1f26400f0
Instruction Fuzzy Hash: BE31F722B15A8741EB119F21D464AFA6361FF49B98F495231EE7C1B7EADE3CD482C340

Function 00007FFDFB69C368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFDFB69C390
_set_statfp.LIBCMT ref: 00007FFDFB69C3AB
_set_statfp.LIBCMT ref: 00007FFDFB69C3C7
_set_statfp.LIBCMT ref: 00007FFDFB69C403

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 22890494fd7f04ecd1fedbe389889413259f55ccdbea4532dfbdae7fffce05e4
Instruction ID: 6dd710664da73ba05e00cad5bd1eba1c55b418b692238f6586d3be7e5ee3a3c6
Opcode Fuzzy Hash: 22890494fd7f04ecd1fedbe389889413259f55ccdbea4532dfbdae7fffce05e4
Instruction Fuzzy Hash: 3011A362F5FA0345F7641129E576B792060AF5437CF050A75FB7E5EAFE8F1CA8419200

Function 00007FFDFB68D7B0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFDFB6815D7,?,?,00000000,00007FFDFB681872,?,?,?,?,?,00007FFDFB6817FE), ref: 00007FFDFB68D7CF
FlsSetValue.KERNEL32(?,?,?,00007FFDFB6815D7,?,?,00000000,00007FFDFB681872,?,?,?,?,?,00007FFDFB6817FE), ref: 00007FFDFB68D7EE
FlsSetValue.KERNEL32(?,?,?,00007FFDFB6815D7,?,?,00000000,00007FFDFB681872,?,?,?,?,?,00007FFDFB6817FE), ref: 00007FFDFB68D816
FlsSetValue.KERNEL32(?,?,?,00007FFDFB6815D7,?,?,00000000,00007FFDFB681872,?,?,?,?,?,00007FFDFB6817FE), ref: 00007FFDFB68D827
FlsSetValue.KERNEL32(?,?,?,00007FFDFB6815D7,?,?,00000000,00007FFDFB681872,?,?,?,?,?,00007FFDFB6817FE), ref: 00007FFDFB68D838

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6ffa0fd223cdc60a1d5044abe53d23b57a5cf769f7cc5fb47aa2b229ec3b0a52
Instruction ID: 524e67b4c3d7800e9d71c60225e02b64fcc584abdf6234bb7edc1be61e6bbb6d
Opcode Fuzzy Hash: 6ffa0fd223cdc60a1d5044abe53d23b57a5cf769f7cc5fb47aa2b229ec3b0a52
Instruction Fuzzy Hash: CF11AC30F0BA4341FB585729A6B1E7922415F597A0F04CB38E83E0E6FEEE2CF4458210

Function 00007FFDFB68D644 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FFDFB68D655
FlsSetValue.KERNEL32 ref: 00007FFDFB68D674
FlsSetValue.KERNEL32 ref: 00007FFDFB68D69C
FlsSetValue.KERNEL32 ref: 00007FFDFB68D6AD
FlsSetValue.KERNEL32 ref: 00007FFDFB68D6BE

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: fd84dcb0da9b828b0143b848d5527da3232d566cac3672556988691972004ba1
Instruction ID: b5fc76d9586322cdfc9fe0540db5a40981409cb80f4c8f83bca6a90fdc69ca38
Opcode Fuzzy Hash: fd84dcb0da9b828b0143b848d5527da3232d566cac3672556988691972004ba1
Instruction Fuzzy Hash: 9811F730F0BA0B41FB686A615871D7912414F59770F188B38E93E4E2FEEE2DF4854220

Function 00007FFDFB615930 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414COMMON

Download Yara Rule

APIs

__std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FFDFB615B64

Part of subcall function 00007FFDFB671D58: MultiByteToWideChar.KERNEL32 ref: 00007FFDFB671D74
Part of subcall function 00007FFDFB671D58: GetLastError.KERNEL32 ref: 00007FFDFB671D82

Strings

\x{, xrefs: 00007FFDFB615D90
0123456789abcdefghijklmnopqrstuvwxyzfalse, xrefs: 00007FFDFB615CC6, 00007FFDFB615DDA
\u{, xrefs: 00007FFDFB615C7C

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__std_fs_convert_narrow_to_wide
String ID: 0123456789abcdefghijklmnopqrstuvwxyzfalse$\u{$\x{
API String ID: 1033888727-417450547
Opcode ID: 600f8c5e38a3a227dfb0753e05f02865ff0f66ba66c0d3f516bc62da4632c6a1
Instruction ID: 6030ff8e515688d5ab5fd58e375d6c3a31e38979b76e5384d8ced9c595b957a0
Opcode Fuzzy Hash: 600f8c5e38a3a227dfb0753e05f02865ff0f66ba66c0d3f516bc62da4632c6a1
Instruction Fuzzy Hash: 1B024A66B09B8696DB148F25D5A067DB761F745F88F84A122CA6E0B3ACCF38D456C310

Function 00007FFDFB617250 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 303COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB617699

Strings

integral cannot be stored in char, xrefs: 00007FFDFB616992, 00007FFDFB616DE2, 00007FFDFB617242, 00007FFDFB617692

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: integral cannot be stored in char
API String ID: 909987262-960316848
Opcode ID: e6867bc29b0662b3660bd55507ca080d8d08974d18d90527c54bc957c70c5480
Instruction ID: 8bc9a1b598700ffff4a60bacced79f7ad01f5f70e67c1e7985588c3c2d5fe27c
Opcode Fuzzy Hash: e6867bc29b0662b3660bd55507ca080d8d08974d18d90527c54bc957c70c5480
Instruction Fuzzy Hash: C4D1C262B0A78695EB10CB68D4606BC77A0FB85B88F545135DAAD0BBEEDF3CD581C700

Function 00007FFDFB6160F0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 302COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB61653A

Strings

integral cannot be stored in char, xrefs: 00007FFDFB616533

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: integral cannot be stored in char
API String ID: 909987262-960316848
Opcode ID: 5f2082fbda001ebb86046b0df268792e6807ef49ed9e73cdc653ef22ef38ae49
Instruction ID: af8fab48b8b649f101d1c39192c12a221f83ae317265f2cbdb5461951963d2e9
Opcode Fuzzy Hash: 5f2082fbda001ebb86046b0df268792e6807ef49ed9e73cdc653ef22ef38ae49
Instruction Fuzzy Hash: 0CD1C426B1979295EB10CB68E860BBC77A0FB85B84F545135DAAD0BAEDDF3CD481C700

Function 00007FFDFB616DF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

integral cannot be stored in char, xrefs: 00007FFDFB616992, 00007FFDFB616DE2, 00007FFDFB617242

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: integral cannot be stored in char
API String ID: 0-960316848
Opcode ID: c2a677df50b05010e2b4a0c9841cd777a318f41e0983222368247cc314e8153b
Instruction ID: c950e06d4d656992b3c3728c2cae6417ac5b9ee23eede4296bc6a5731659ac7c
Opcode Fuzzy Hash: c2a677df50b05010e2b4a0c9841cd777a318f41e0983222368247cc314e8153b
Instruction Fuzzy Hash: 8DC1D462B1A78299EF10CB64D8606BC67B1FB45B88F545235DAAD0BAEDDF3CD481C700

Function 00007FFDFB6169A0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

integral cannot be stored in char, xrefs: 00007FFDFB616992, 00007FFDFB616DE2, 00007FFDFB617242

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: integral cannot be stored in char
API String ID: 0-960316848
Opcode ID: d7174415323e914e7131937490a045c368a2fa3e7c91cfb0305bbd05efb87a38
Instruction ID: 65433a0af4fc59673b6dcb8331ae6574f0b5a7c76b28e826f3e387fc17a522e5
Opcode Fuzzy Hash: d7174415323e914e7131937490a045c368a2fa3e7c91cfb0305bbd05efb87a38
Instruction Fuzzy Hash: 5CC1E226B1A78695EB10CB64D8607BC37A0FB45B88F54A135DAAD0BAEDDF3CD481C700

Function 00007FFDFB695688 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB695967

Part of subcall function 00007FFDFB69C5B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB69C5D1

Strings

UTF-8, xrefs: 00007FFDFB6958E6
ccs, xrefs: 00007FFDFB6958A2
UTF-16LEUNICODE, xrefs: 00007FFDFB695905

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 1f3a326e150c2fd37ebec3bc520d08cb817ac0eabbdf0fb483047ddc6671a4cc
Instruction ID: 9dd6ff6872c868493e161e604951617181c2ae0a30c2acfe17f8db966de08498
Opcode Fuzzy Hash: 1f3a326e150c2fd37ebec3bc520d08cb817ac0eabbdf0fb483047ddc6671a4cc
Instruction Fuzzy Hash: 9381A132F0A36385FB644F258274A7C36A4AB10B5CF558035CA2E9F2FDDB2DE9429701

Function 00007FFDFB677204 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFDFB677274
_CallSETranslator.LIBVCRUNTIME ref: 00007FFDFB6772BF

Strings

RCC, xrefs: 00007FFDFB677290
MOC, xrefs: 00007FFDFB677288

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 36a8a76259774f742d89539f35d409902f11133b11db47f5bcfeedc7d99b474b
Instruction ID: 6958682f888ee0377c467293e940149295292a9873a2d97754b7b059e892edee
Opcode Fuzzy Hash: 36a8a76259774f742d89539f35d409902f11133b11db47f5bcfeedc7d99b474b
Instruction Fuzzy Hash: D291A573B097828AE710CB65E8506BD7BA0FB44788F24413AEE5D5B7A9DF38D195C700

Function 00007FFDFB611B4B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB611B77
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB611B94

Strings

Negative width., xrefs: 00007FFDFB611B70
Number is too big., xrefs: 00007FFDFB611B8D

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Negative width.$Number is too big.
API String ID: 909987262-1861685508
Opcode ID: 41ad5416036b68073ae6babc04dc5a0dd8555295887f4aa40b9356f9367038e1
Instruction ID: b22709977c1a950843e666688a2cafb0e5e95288b89f932a5b08bb06c1702cac
Opcode Fuzzy Hash: 41ad5416036b68073ae6babc04dc5a0dd8555295887f4aa40b9356f9367038e1
Instruction Fuzzy Hash: 61615922B0968756DB11CB25E4208B9BB60FB95FD4F144631EAAC07BEADF3DE155CB00

Function 00007FFDFB6629D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB662C46

Strings

gfffffff, xrefs: 00007FFDFB662A0C
gfffffff, xrefs: 00007FFDFB662BBA

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: gfffffff$gfffffff
API String ID: 3668304517-161084747
Opcode ID: 4ecc399b3934313f419e667ff764bf776fc97defff71ed675bfd88371db76f41
Instruction ID: 4dd2c3c2a147a628ca034ce2a84dd5eeb10a0d135960fa5cb22e16bea4d2c407
Opcode Fuzzy Hash: 4ecc399b3934313f419e667ff764bf776fc97defff71ed675bfd88371db76f41
Instruction Fuzzy Hash: A151BD62706B8786DB10DB16F454AA96365FB84BC4F548636DEAD8F7E9EE38D041C300

Function 00007FFDFB61DFD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

_Xtime_get_ticks.LIBCPMT ref: 00007FFDFB61E134
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61E221
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61E227

Strings

, xrefs: 00007FFDFB61E19C

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xtime_get_ticks
String ID:
API String ID: 451911210-3916222277
Opcode ID: c21b7ff9d9a7e1174c00422539d89c8ccb050d8bf1aac37dd004a3f788143e39
Instruction ID: 9037d7cdfcbe48c64915cfcc7271904b0ad37f08f5d604823e62f5d462d530bd
Opcode Fuzzy Hash: c21b7ff9d9a7e1174c00422539d89c8ccb050d8bf1aac37dd004a3f788143e39
Instruction Fuzzy Hash: F061EB12B19A8691EB115F68D4117ED6370FF98798F14A321EF9C1AAA9EF3CE181C700

Function 00007FFDFB676F94 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFDFB676FF3
_CallSETranslator.LIBVCRUNTIME ref: 00007FFDFB67703F

Strings

RCC, xrefs: 00007FFDFB67700F
MOC, xrefs: 00007FFDFB677007

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 23bef3fb5353da4fad35acc8dbed6ba2c9d1d842debb67157b9f511b3bd45864
Instruction ID: 937f078e055e314b05f04757972ac07ac145121c139ffff6f96e668dbd31d08a
Opcode Fuzzy Hash: 23bef3fb5353da4fad35acc8dbed6ba2c9d1d842debb67157b9f511b3bd45864
Instruction Fuzzy Hash: FB617232A19BC681D7609F15F4507AAB7A0FB85794F144225EFAC0BBA9DF7CE190CB00

Function 00007FFDFB677784 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDFB6777AC
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFDFB677894

Strings

csm, xrefs: 00007FFDFB6778E6
csm, xrefs: 00007FFDFB6777CE

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: c747af2a0075ee68bd3537ed31092605a38708b56eeca8f88ed36e10b8a976c1
Instruction ID: 35133f2a695ec724706d0312fffab2b8adaee7e0f3e71c0f70391693fd0ba5f5
Opcode Fuzzy Hash: c747af2a0075ee68bd3537ed31092605a38708b56eeca8f88ed36e10b8a976c1
Instruction Fuzzy Hash: 05518132B0A2438AEB648B21E464B7877A0EB55B94F244135DFAD4B7E9CF3CE450C701

Function 00007FFDFB618CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FFDFB618CE6

Part of subcall function 00007FFDFB61DFD0: _Xtime_get_ticks.LIBCPMT ref: 00007FFDFB61E134

std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB618E62
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB618E6D

Strings

@, xrefs: 00007FFDFB618DE9

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThreadXtime_get_ticks
String ID: @
API String ID: 2795077170-2766056989
Opcode ID: 195a1873deb29b87ee9136e35f71d2032e2cb5501949aa9a92f87f415d62e663
Instruction ID: 894f4c36b65c1051f1c93e88652da9a5db90512e3f47d28b2cc92e84ef659f8c
Opcode Fuzzy Hash: 195a1873deb29b87ee9136e35f71d2032e2cb5501949aa9a92f87f415d62e663
Instruction Fuzzy Hash: A6517D32705B5686E760DF21E894AAD33A8FB48F84F115136EE9D4B7A8DF38D451C740

Function 00007FFDFB603690 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB603710
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FFDFB603758
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB6037F7

Strings

bad locale name, xrefs: 00007FFDFB60381F

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 8d30b1df8b94b12dc024a5a0ac60f14addbb8524a45646297aecf5b3b8afaa37
Instruction ID: 870ea12b39d33f904c64b63505958023f6d295008aec2febc2b689e26e8d8865
Opcode Fuzzy Hash: 8d30b1df8b94b12dc024a5a0ac60f14addbb8524a45646297aecf5b3b8afaa37
Instruction Fuzzy Hash: 6E413E22B1BB4289EB14DF61D460BAD33B4EF48788F084835DA9D1BAE9DE38D515C358

Function 00007FFDFB6119BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB6119E7
std::_Xinvalid_argument.LIBCPMT ref: 00007FFDFB611A04

Strings

Number is too big., xrefs: 00007FFDFB6119FD
Negative precision., xrefs: 00007FFDFB6119E0

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Negative precision.$Number is too big.
API String ID: 909987262-3993994484
Opcode ID: 54c34f4669703bcaefd856588aa82b56210f0b7ace2bca84256ac07204bcaff1
Instruction ID: b8f79279069b7040527711e733854fd793cfab93d5c8f21d98c0908e33f06b8b
Opcode Fuzzy Hash: 54c34f4669703bcaefd856588aa82b56210f0b7ace2bca84256ac07204bcaff1
Instruction Fuzzy Hash: A541E722A0D5C756D70B9B3890318BC6F20EF92B58F188A32E3EC054EBDE5DE155CB00

Function 00007FFDFB6041F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

Strings

ios_base::failbit set, xrefs: 00007FFDFB60421A
ios_base::eofbit set, xrefs: 00007FFDFB604221
ios_base::badbit set, xrefs: 00007FFDFB60420E

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID:
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-1866435925
Opcode ID: 7d7e8ad66599315971daec2c00bb057c3fe767c8753ffd9703484130ad15e33c
Instruction ID: d12b6507cfff88e786281d35825180a389c318c5caa9a6575ce44f63c631dfe9
Opcode Fuzzy Hash: 7d7e8ad66599315971daec2c00bb057c3fe767c8753ffd9703484130ad15e33c
Instruction Fuzzy Hash: BD11E9A1B1A78381EF109B06E8617A92360FF417D0F984231D6BD0B6F9DE2CE451C700

Function 00007FFDFB69055C Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFDFB6905DB
WriteFile.KERNEL32 ref: 00007FFDFB6908A3
WriteFile.KERNEL32 ref: 00007FFDFB6908E9
GetLastError.KERNEL32 ref: 00007FFDFB69099F

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 871e8e0e734bd24f9801e2c8e753ca76dd52d711e65741cfa1abfb4eb8c936ed
Instruction ID: 6c5da883b8ebcfd5892fde4ee5de7633ba7e90d4a2a94119ab2677ec2f90b191
Opcode Fuzzy Hash: 871e8e0e734bd24f9801e2c8e753ca76dd52d711e65741cfa1abfb4eb8c936ed
Instruction Fuzzy Hash: E7D1D332B19A8289EB10CF69D4506AC77B1FB4479CB144235DEAE9BBEDDE38D456C300

Function 00007FFDFB623CC0 Relevance: 6.2, APIs: 4, Instructions: 220COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB623E2F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB623EEB
shutdown.WS2_32 ref: 00007FFDFB6369AA
closesocket.WS2_32 ref: 00007FFDFB6369B6

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$closesocketshutdown
String ID:
API String ID: 3017505983-0
Opcode ID: 10f222b22e7fdd1e8eea42a9b70bfeaf676b0102919b9b0aaa0ce0d9157a2cd3
Instruction ID: 51534d0082b5f7b3ff8c188f8bd909381a5c08a7a1718401342ef3e4c6b9ba5a
Opcode Fuzzy Hash: 10f222b22e7fdd1e8eea42a9b70bfeaf676b0102919b9b0aaa0ce0d9157a2cd3
Instruction Fuzzy Hash: FA813932716B4696EF04CF25D5A466C63A5FB44F94F584236DB6D0BBE8CF28D8A5C300

Function 00007FFDFB613CF0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB613E8C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB613E92
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB613FB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB613FBC

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 5ba8a64dbd2fc9a8eb25e518c573148cf832c66a70eb16aa0357319caa12a144
Instruction ID: 1b6d3630618d679a5f0a66c6b885f1e6de7e7ac0792eff64b8ee43bce5f23cfb
Opcode Fuzzy Hash: 5ba8a64dbd2fc9a8eb25e518c573148cf832c66a70eb16aa0357319caa12a144
Instruction Fuzzy Hash: 0A71C362B0AB82A1EB10DF52A4146A9A361EB44FD0F545635EFBD0BBEDDE7CE041C300

Function 00007FFDFB653FA0 Relevance: 6.2, APIs: 4, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB6540F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB654102
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB65424C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB654258

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: cc5d8abde5245907724bb1010d0145cfa1f0e9695b44a2940da75b7b10b81883
Instruction ID: b257acfc758857b41588c342521f7afa301fee2e7db809f8e42b8ec370c909b1
Opcode Fuzzy Hash: cc5d8abde5245907724bb1010d0145cfa1f0e9695b44a2940da75b7b10b81883
Instruction Fuzzy Hash: 41611662B0A61742EE18CB56B46597DA664BB49FD0F204531EEAD4FBEDDE3CE0528300

Function 00007FFDFB67C288 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDFB67E9E8: DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EA79
Part of subcall function 00007FFDFB67E9E8: DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EAB2
Part of subcall function 00007FFDFB67E9E8: DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EDDD

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67C3E3
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67C442
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67C474
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67C484

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 6e9f3a07831671e1aea90c838fb8728c73ca1fb0816a0b0053923022409c3161
Instruction ID: b528d2948c280218fbdf14ce3783ab2963c6f6a7b6c21cb522531c7cc49f15f0
Opcode Fuzzy Hash: 6e9f3a07831671e1aea90c838fb8728c73ca1fb0816a0b0053923022409c3161
Instruction Fuzzy Hash: 33914D62F1975389FB118B64E8A0BBC37A1FB04758F644036CA6D6AAEDDF7C9845C340

Function 00007FFDFB635B00 Relevance: 6.2, APIs: 4, Instructions: 192COMMON

Download Yara Rule

APIs

_Xtime_get_ticks.LIBCPMT ref: 00007FFDFB635B1D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB635CAF
_Xtime_get_ticks.LIBCPMT ref: 00007FFDFB635CEA
_Xtime_get_ticks.LIBCPMT ref: 00007FFDFB635D1C

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Xtime_get_ticks$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3527862911-0
Opcode ID: 16576136cc2c9894c8836054e0beacd96a2776bbb70d8277da7ca53b87d78e6e
Instruction ID: 5bcf8f7aad9b9ccb25a49a24c75a54fc0cd9b9abcf73ebe3b8c472e38fb43c66
Opcode Fuzzy Hash: 16576136cc2c9894c8836054e0beacd96a2776bbb70d8277da7ca53b87d78e6e
Instruction Fuzzy Hash: F971E162F0AB8685EB509B25E0247A86791EB45BC8F4C5136DEAD0B7EEDF2CD4C0C740

Function 00007FFDFB624150 Relevance: 6.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6241C5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB624241
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB624325
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB62432B

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c25d0af81b6592d5a00343be3ed5601dd8b919c601cb9b02499ad255e8620942
Instruction ID: 8c3fc1aed1745939a6a0608765308de0f19a442d6eccd50842c6ab440336f0c9
Opcode Fuzzy Hash: c25d0af81b6592d5a00343be3ed5601dd8b919c601cb9b02499ad255e8620942
Instruction Fuzzy Hash: DA51D162B1BA8741FF509B25E46577D2261EF84B98F604231EB7D0E7EEDE2CD4818340

Function 00007FFDFB65CA70 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB65CB3F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB65CB45
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB65CB8C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB65CBD8

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 6bb4de0c883f7c80c70e5d8559131f3eeb775df318d196c6c02f4955b1ad73d7
Instruction ID: 336ddd71964f1bbe3ce857a94b004117da9fe7cbbcfa190be19929e36a11cb22
Opcode Fuzzy Hash: 6bb4de0c883f7c80c70e5d8559131f3eeb775df318d196c6c02f4955b1ad73d7
Instruction Fuzzy Hash: FD31D062B2B64741EE1497A9D065B7D52519F86BF0F605731EABC0BBEDCD2CE0C28604

Function 00007FFDFB619F80 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB61A120
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB61A131
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB61A13C
std::_Throw_Cpp_error.LIBCPMT ref: 00007FFDFB61A147

Part of subcall function 00007FFDFB672BB0: WaitForSingleObjectEx.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FFDFB604888), ref: 00007FFDFB672BC9
Part of subcall function 00007FFDFB672BB0: GetExitCodeThread.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FFDFB604888), ref: 00007FFDFB672BE1
Part of subcall function 00007FFDFB672BB0: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FFDFB604888), ref: 00007FFDFB672BF4

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CloseCodeExitHandleObjectSingleThreadWait_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3093482091-0
Opcode ID: c9c18fc61d57ce2cda7b2cd9fe7d560f6ce8a36f7f261c456a7dc2e4d3beed03
Instruction ID: abe25acb5da510039a1494860214777b7916aea4990a1b056ac942d4b89f58e0
Opcode Fuzzy Hash: c9c18fc61d57ce2cda7b2cd9fe7d560f6ce8a36f7f261c456a7dc2e4d3beed03
Instruction Fuzzy Hash: EC418022B05687A1E7089B60D5616FD6321FF85B84F644537D77C0BAEADF38E4A18350

Function 00007FFDFB67EEA0 Relevance: 6.1, APIs: 4, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDFB67E9E8: DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EA79
Part of subcall function 00007FFDFB67E9E8: DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EAB2
Part of subcall function 00007FFDFB67E9E8: DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EDDD

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EF20
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EF2F
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EFAB
DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67EFBA

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 52e34d07d1d64f6b918862b2a4fea473303bed1bf64aee88a2adafc472effd6a
Instruction ID: e3bae499890de79e71cf42035f56202bc5a2b2ece020009c6bfeec17e129e414
Opcode Fuzzy Hash: 52e34d07d1d64f6b918862b2a4fea473303bed1bf64aee88a2adafc472effd6a
Instruction Fuzzy Hash: F7415972B05B8299FB01CF64E4907AC37A4FB48B48F688436DA5C5BBA9DF7C9485C350

Function 00007FFDFB601C30 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB601C45
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB601C6A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB601C94
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB601D25

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 1a086962bd192dee9b14e2abb29d4f75b9ea7c65e3e23d5e2a924a41609a28de
Instruction ID: 86c2f2636705f87523a3ac284eadccfec99f4da64b5d37e33edc7230ec2b917d
Opcode Fuzzy Hash: 1a086962bd192dee9b14e2abb29d4f75b9ea7c65e3e23d5e2a924a41609a28de
Instruction Fuzzy Hash: 75316326B0AA4395EB159B17E8609796361EB55BE0F1C0132EABD4B2FDDE3CE4418300

Function 00007FFDFB618F70 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB618F85
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB618FAA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB618FD4
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB619065

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 3baf67bcb006a791685544cc6105ede1521384eac61bbc52dffd4743f706dec8
Instruction ID: 97b2e714b1a9427baa24bd8ab05536e0b220f83650c1953119945891637d5c78
Opcode Fuzzy Hash: 3baf67bcb006a791685544cc6105ede1521384eac61bbc52dffd4743f706dec8
Instruction Fuzzy Hash: B7316026B0AA43A4FB159B16E8609796365EB44BE4F1C1136DA6D4B2FDDF7CE482C300

Function 00007FFDFB601D40 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB601D55
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB601D7A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB601DA4
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB601E35

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: ce68af185c8b7a6973a6c4f1c711b23fcd277bd79e053946be4c9d7da4b2bcf2
Instruction ID: e01e4fbb4eeeb99661835800797c6e8b8b21316e07c4cc16fe4dd37a8d82874d
Opcode Fuzzy Hash: ce68af185c8b7a6973a6c4f1c711b23fcd277bd79e053946be4c9d7da4b2bcf2
Instruction Fuzzy Hash: F0314026B0BA4395EB159B56E8609796361EB55BE0F1C0232EAAD4B2FDDF3CE4418300

Function 00007FFDFB671EC4 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FFDFB671F0D
GetLastError.KERNEL32 ref: 00007FFDFB671F1B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FFDFB608A99), ref: 00007FFDFB671F50
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FFDFB608A99), ref: 00007FFDFB671F5E

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 411036746c51ba7d793bb4093a9a88fdddd8d4a9e53d5b8c8ca7a3a35368e9d4
Instruction ID: a82e9da17d608e8e145d423bf704b6fc5f88acb6d8cc13aeaffc9a8b11ae4ce3
Opcode Fuzzy Hash: 411036746c51ba7d793bb4093a9a88fdddd8d4a9e53d5b8c8ca7a3a35368e9d4
Instruction Fuzzy Hash: 6B216F72A19B8687E7108F15E81472E7AB4F799FC4F240135DB995BBA8DF3CD8118B40

Function 00007FFDFB6744A0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFB6744CC
GetCurrentThreadId.KERNEL32 ref: 00007FFDFB6744DA
GetCurrentProcessId.KERNEL32 ref: 00007FFDFB6744E6
QueryPerformanceCounter.KERNEL32 ref: 00007FFDFB6744F6

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f9ab75aa38afcf0928a59117dd58452adf1d26a1421da5aed2cc2134a8349f8
Instruction ID: 2e0e71e1d972eccb14ba32a22226dbcda69202e8b51ed27b22c6e24eac95a676
Opcode Fuzzy Hash: 0f9ab75aa38afcf0928a59117dd58452adf1d26a1421da5aed2cc2134a8349f8
Instruction Fuzzy Hash: AA112A26B16F068AEB00CF64E8646B933A4FB19B58F441E31DA7D4A7A8EF78D5548340

Function 00007FFDFB671CB8 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

SetFileInformationByHandle.KERNEL32 ref: 00007FFDFB671CD8
GetLastError.KERNEL32 ref: 00007FFDFB671CE2
SetFileInformationByHandle.KERNEL32 ref: 00007FFDFB671D15
GetLastError.KERNEL32 ref: 00007FFDFB671D1F

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorFileHandleInformationLast
String ID:
API String ID: 275135790-0
Opcode ID: f97466e94353536a6acd8b06175c5b240771bb43d0827803c05d56c41f5a32cb
Instruction ID: 9e05a4e4d96977a885185e286823783da39f76cce769bfaa35fdb216c8874a1f
Opcode Fuzzy Hash: f97466e94353536a6acd8b06175c5b240771bb43d0827803c05d56c41f5a32cb
Instruction Fuzzy Hash: 2EF0A931B0A14786FB688B65F878E742A94EF55745F200036C5365E6FCDF2DE984CB01

Function 00007FFDFB675874 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDFB67589F
RtlUnwindEx.KERNEL32 ref: 00007FFDFB675990

Strings

csm, xrefs: 00007FFDFB67591D

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Unwind__except_validate_context_record
String ID: csm
API String ID: 2208346422-1018135373
Opcode ID: 277ff307536f53072492cced06606450f332c44b4caae9588e36d5f45ef30728
Instruction ID: df0f407917daa8025ca7206bee4abd505c52ee91d329d33b36aa9ed8d43f9cb5
Opcode Fuzzy Hash: 277ff307536f53072492cced06606450f332c44b4caae9588e36d5f45ef30728
Instruction Fuzzy Hash: 4E519132B1A6438AEB548B15E464E7C7395EB44B94F248171DA6A4B7ECEF7CE841C700

Function 00007FFDFB653390 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB65359A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB6535A6

Strings

gfffffff, xrefs: 00007FFDFB6533B6

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: gfffffff
API String ID: 73155330-1523873471
Opcode ID: f2734bea1ca1bb53f34bd4cc9b6d5adbb261892d50dbf8ee713ad70a092c50c4
Instruction ID: dca372bcc557d5974a963c5a92e57fabf143f3223d0ea7695ec63e8cce9e3eeb
Opcode Fuzzy Hash: f2734bea1ca1bb53f34bd4cc9b6d5adbb261892d50dbf8ee713ad70a092c50c4
Instruction Fuzzy Hash: 355145A2B06B8B52DF109B16F4649AA6351FB44BD0F008131DEAD0B7ECEE3CE061C300

Function 00007FFDFB678054 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDFB6780FE
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFDFB678127

Strings

csm, xrefs: 00007FFDFB678227

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 35f2f6631f661e25bf168d1e06bd1ddfb4c2764b66f5d9b7923734af33c3a1a7
Instruction ID: 846e9db24fd7954645232559be714c57b4e935507f3c18441c6e562ff46783fe
Opcode Fuzzy Hash: 35f2f6631f661e25bf168d1e06bd1ddfb4c2764b66f5d9b7923734af33c3a1a7
Instruction Fuzzy Hash: 5351443671AB8286D720DB16F49066D77A4FB88791F240535DB9D4BBA9CF3CE450CB00

Function 00007FFDFB690BF4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFDFB690D0B
GetLastError.KERNEL32 ref: 00007FFDFB690D2D

Strings

U, xrefs: 00007FFDFB690CB7

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 0f7cbb41df57a49f32bccc3daded4653a6443461b2f368db5ffe67049796f5c2
Instruction ID: af2931f92269558b456891640e81fb646468df37916edbeb0a8ea787a89876d7
Opcode Fuzzy Hash: 0f7cbb41df57a49f32bccc3daded4653a6443461b2f368db5ffe67049796f5c2
Instruction Fuzzy Hash: 4541D672B1AA4685DB208F25E4647B977A4FB98B88F504031EE5D8B7ACDF3CE441C740

Function 00007FFDFB65DC50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB65DD52

Strings

IteratedHashBase: input data exceeds maximum allowed by hash function , xrefs: 00007FFDFB65DCAB
F, xrefs: 00007FFDFB65DCA2

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: F$IteratedHashBase: input data exceeds maximum allowed by hash function
API String ID: 3668304517-3216730400
Opcode ID: 32c33d260c37e64dc73d9b5ab5a376c517084c3358e7ccd0d11bf70ce5bec24e
Instruction ID: b8065283ff316d95664ef71fa0d7d494c353406113c16f2cb88a6555ae929b65
Opcode Fuzzy Hash: 32c33d260c37e64dc73d9b5ab5a376c517084c3358e7ccd0d11bf70ce5bec24e
Instruction Fuzzy Hash: AC316072B1AB4682DB048B65E4907696360FB89BA4F508235E6BC477F9DF3CD495C700

Function 00007FFDFB6027B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB60287C
__std_exception_copy.LIBVCRUNTIME ref: 00007FFDFB6028B4

Strings

ios_base::failbit set, xrefs: 00007FFDFB6027B0

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID: ios_base::failbit set
API String ID: 1109970293-3924258884
Opcode ID: 30dff207384f2997515af8d6b7496ddcf980a88d1570d86910d1a00fbabe703c
Instruction ID: f6f25646a4e8af22798b4a0943213c22047406b38ead63a8b006e8efe014346d
Opcode Fuzzy Hash: 30dff207384f2997515af8d6b7496ddcf980a88d1570d86910d1a00fbabe703c
Instruction Fuzzy Hash: F5210A52F19B8681EB009B25E4515BA6360FF997A4F149331EAFC067E9DF3CE081C700

Function 00007FFDFB638020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB638122

Strings

/, xrefs: 00007FFDFB638068
: this object doesn't support multiple channels, xrefs: 00007FFDFB638071

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: /$: this object doesn't support multiple channels
API String ID: 3668304517-537585387
Opcode ID: a1e7349bea60cfab25958c017f2b87710fe5c282bd1c4abafc0bd82fdfbd44cb
Instruction ID: 854d9be1bb833cdaf5b09c61222ab8daa719bd00e15ca7c57348a69da243fe03
Opcode Fuzzy Hash: a1e7349bea60cfab25958c017f2b87710fe5c282bd1c4abafc0bd82fdfbd44cb
Instruction Fuzzy Hash: FA319472B1AB8681DF049B25E4647A963A1FB49B94F548231EABC4B7F9DE7CD081C700

Function 00007FFDFB67C174 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDFB67C272

Strings

void , xrefs: 00007FFDFB67C1FC
void, xrefs: 00007FFDFB67C1D4

Memory Dump Source

Source File: 00000003.00000002.4201892957.00007FFDFB601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB600000, based on PE: true

Associated: 00000003.00000002.4201856979.00007FFDFB600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4201994534.00007FFDFB6A6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202059861.00007FFDFB6FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202079121.00007FFDFB700000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202105678.00007FFDFB703000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB707000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4202137562.00007FFDFB710000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfb600000_rundll32.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: 9362244e077270b9b6bf6d449bd281f5126a948d53faee9069d263a9839acad9
Instruction ID: cb8ab7de74ef9b8b43406f726fdfe243d8fd18a2bb2b1bc4b5347e5d2254642b
Opcode Fuzzy Hash: 9362244e077270b9b6bf6d449bd281f5126a948d53faee9069d263a9839acad9
Instruction Fuzzy Hash: 13314772F29B5698FB00DBA4E8A04EC37B0FB48748B640136DE6D5ABA9DF3C9154C750

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pH6L2VWRbU.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\.id

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
pH6L2VWRbU.dll

Function 00007FFDFB6720F8 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 00007FFDFB69D0C0 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FFDFB61B910 Relevance: 12.5, APIs: 8, Instructions: 502
COMMON

Function 00007FFDFB60803B Relevance: 13.7, APIs: 9, Instructions: 212
COMMON

Function 00007FFDFB608100 Relevance: 13.7, APIs: 9, Instructions: 156
windowkeyboardCOMMON

Function 00007FFDFB609390 Relevance: 12.5, APIs: 8, Instructions: 493
COMMON

Function 00007FFDFB68F2B8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
COMMONLIBRARYCODE

Function 00007FFDFB67380C Relevance: 12.2, APIs: 8, Instructions: 227
COMMON

Function 00007FFDFB636760 Relevance: 12.1, APIs: 8, Instructions: 68
networkCOMMON

Function 00007FFDFB676A90 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320
COMMONLIBRARYCODE

Function 00007FFDFB604620 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 259
COMMON

Function 00007FFDFB60B450 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 177
COMMON

Function 00007FFDFB637040 Relevance: 7.6, APIs: 5, Instructions: 104
COMMON

Function 00007FFDFB683B50 Relevance: 7.6, APIs: 5, Instructions: 60
threadCOMMON

Function 00007FFDFB690F1C Relevance: 6.2, APIs: 4, Instructions: 219
COMMON