Edit tour

Windows Analysis Report
X7qGiXszrq.dll

Overview

General Information

Sample name:	X7qGiXszrq.dll renamed because original name is a hash value
Original sample name:	8F60B2218139D38978B4263244BFA4C9.dll
Analysis ID:	1581116
MD5:	8f60b2218139d38978b4263244bfa4c9
SHA1:	80324b76dc1f4688c775e47d8b9d1c313d212319
SHA256:	9e4eb613a93a8b79faca6ed56bd73f3f04ef6fcf52473cd0ffd6724a656cf46b
Tags:	dllGh0stRATuser-abuse_ch
Infos:

Detection

GhostRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected GhostRat

AI detected suspicious sample

Checks if browser processes are running

Contains functionality to detect sleep reduction / modifications

Contains functionality to inject threads in other processes

Machine Learning detection for sample

Tries to delay execution (extensive OutputDebugStringW loop)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6460 cmdline: loaddll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 6476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6596 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 6700 cmdline: rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6788 cmdline: rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6652 cmdline: rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,FirstRun MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6764 cmdline: rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7012 cmdline: rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 732 cmdline: rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,ServiceMain MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 5016 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 656 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 1780 cmdline: rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",FirstRun MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4444 cmdline: rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2032 cmdline: rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",MainRun MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5316 cmdline: rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",ServiceMain MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 7024 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 660 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 1052 cmdline: rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",TestFun MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 7004 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 656 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
X7qGiXszrq.dll	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author
15.2.rundll32.exe.6cc70000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
5.2.rundll32.exe.6cc70000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
13.2.rundll32.exe.6cc70000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
6.2.rundll32.exe.6cc70000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
16.2.rundll32.exe.6cc70000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
8.2.rundll32.exe.6cc70000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
14.2.rundll32.exe.6cc70000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
7.2.rundll32.exe.6cc70000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Click to see the 3 entries

Suricata Signatures

ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T01:26:55.011885+0100	2016922	1	Malware Command and Control Activity Detected	192.168.2.4	49730	82.157.76.20	9907	TCP
2024-12-27T01:26:55.013356+0100	2016922	1	Malware Command and Control Activity Detected	192.168.2.4	49731	82.157.76.20	9907	TCP
2024-12-27T01:26:57.854874+0100	2016922	1	Malware Command and Control Activity Detected	192.168.2.4	49732	82.157.76.20	9907	TCP
2024-12-27T01:27:04.312547+0100	2016922	1	Malware Command and Control Activity Detected	192.168.2.4	49736	82.157.76.20	9907	TCP
2024-12-27T01:27:04.325180+0100	2016922	1	Malware Command and Control Activity Detected	192.168.2.4	49735	82.157.76.20	9907	TCP

ET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T01:26:56.699773+0100	2048478	1	A Network Trojan was detected	82.157.76.20	9907	192.168.2.4	49731	TCP
2024-12-27T01:26:56.702900+0100	2048478	1	A Network Trojan was detected	82.157.76.20	9907	192.168.2.4	49730	TCP
2024-12-27T01:26:59.543244+0100	2048478	1	A Network Trojan was detected	82.157.76.20	9907	192.168.2.4	49732	TCP
2024-12-27T01:27:05.954186+0100	2048478	1	A Network Trojan was detected	82.157.76.20	9907	192.168.2.4	49736	TCP
2024-12-27T01:27:05.959491+0100	2048478	1	A Network Trojan was detected	82.157.76.20	9907	192.168.2.4	49735	TCP

ETPRO MALWARE Backdoor family PCRat/Gh0st CnC Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T01:26:56.699773+0100	2808814	1	Malware Command and Control Activity Detected	82.157.76.20	9907	192.168.2.4	49731	TCP
2024-12-27T01:26:56.702900+0100	2808814	1	Malware Command and Control Activity Detected	82.157.76.20	9907	192.168.2.4	49730	TCP
2024-12-27T01:26:59.543244+0100	2808814	1	Malware Command and Control Activity Detected	82.157.76.20	9907	192.168.2.4	49732	TCP
2024-12-27T01:27:05.954186+0100	2808814	1	Malware Command and Control Activity Detected	82.157.76.20	9907	192.168.2.4	49736	TCP
2024-12-27T01:27:05.959491+0100	2808814	1	Malware Command and Control Activity Detected	82.157.76.20	9907	192.168.2.4	49735	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: X7qGiXszrq.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: X7qGiXszrq.dll	ReversingLabs: Detection: 78%
Source: X7qGiXszrq.dll	Virustotal: Detection: 75%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: X7qGiXszrq.dll

Joe Sandbox ML: detected

Source: X7qGiXszrq.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: X7qGiXszrq.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: F:\myapp\CcRemote\bin\server\CcMainDll.pdb source: rundll32.exe, 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2909573448.000000006CC95000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.2909536982.000000006CC95000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.2044674418.000000006CC95000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.2909497585.000000006CC95000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.2097357363.000000006CC95000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2909496526.000000006CC95000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.2070170997.000000006CC95000.00000002.00000001.01000000.00000003.sdmp, X7qGiXszrq.dll

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC73640 wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	5_2_6CC73640
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC72E66 FindFirstFileA,FindClose,FindClose,	5_2_6CC72E66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC738E0 lstrlenA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,std::_Xinvalid_argument,	5_2_6CC738E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC8C2C5 FindFirstFileExW,_free,FindNextFileW,_free,FindClose,_free,	5_2_6CC8C2C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC73B10 FindFirstFileA,FindClose,CreateFileA,CloseHandle,	5_2_6CC73B10

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC73460 GetLogicalDriveStringsA,lstrlenA,GetVolumeInformationA,SHGetFileInfoA,lstrlenA,lstrlenA,GetDiskFreeSpaceExA,GetDriveTypeA,lstrlenA,lstrlenA,

5_2_6CC73460

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2016922 - Severity 1 - ET MALWARE Backdoor family PCRat/Gh0st CnC traffic : 192.168.2.4:49732 -> 82.157.76.20:9907
Source: Network traffic	Suricata IDS: 2016922 - Severity 1 - ET MALWARE Backdoor family PCRat/Gh0st CnC traffic : 192.168.2.4:49735 -> 82.157.76.20:9907
Source: Network traffic	Suricata IDS: 2048478 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive : 82.157.76.20:9907 -> 192.168.2.4:49732
Source: Network traffic	Suricata IDS: 2808814 - Severity 1 - ETPRO MALWARE Backdoor family PCRat/Gh0st CnC Response : 82.157.76.20:9907 -> 192.168.2.4:49732
Source: Network traffic	Suricata IDS: 2016922 - Severity 1 - ET MALWARE Backdoor family PCRat/Gh0st CnC traffic : 192.168.2.4:49730 -> 82.157.76.20:9907
Source: Network traffic	Suricata IDS: 2048478 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive : 82.157.76.20:9907 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2808814 - Severity 1 - ETPRO MALWARE Backdoor family PCRat/Gh0st CnC Response : 82.157.76.20:9907 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2016922 - Severity 1 - ET MALWARE Backdoor family PCRat/Gh0st CnC traffic : 192.168.2.4:49731 -> 82.157.76.20:9907
Source: Network traffic	Suricata IDS: 2048478 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive : 82.157.76.20:9907 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2048478 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive : 82.157.76.20:9907 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2808814 - Severity 1 - ETPRO MALWARE Backdoor family PCRat/Gh0st CnC Response : 82.157.76.20:9907 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2016922 - Severity 1 - ET MALWARE Backdoor family PCRat/Gh0st CnC traffic : 192.168.2.4:49736 -> 82.157.76.20:9907
Source: Network traffic	Suricata IDS: 2808814 - Severity 1 - ETPRO MALWARE Backdoor family PCRat/Gh0st CnC Response : 82.157.76.20:9907 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2048478 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive : 82.157.76.20:9907 -> 192.168.2.4:49736
Source: Network traffic	Suricata IDS: 2808814 - Severity 1 - ETPRO MALWARE Backdoor family PCRat/Gh0st CnC Response : 82.157.76.20:9907 -> 192.168.2.4:49736

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 82.157.76.20 9907

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 82.157.76.20:9907

Source: Joe Sandbox View

ASN Name: ECLIPSEGB ECLIPSEGB

Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20
Source: unknown	TCP traffic detected without corresponding DNS query: 82.157.76.20

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC71990 select,recv,setsockopt,CancelIo,closesocket,Sleep,SetEvent,

5_2_6CC71990

Source: Amcache.hve.11.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC77590 SetEvent,GetCurrentThreadId,GetThreadDesktop,OpenDesktopA,CloseDesktop,PostMessageA,BlockInput,BlockInput,BlockInput,OpenClipboard,GetClipboardData,GlobalSize,GlobalLock,GlobalUnlock,CloseClipboard,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,

5_2_6CC77590

Source: C:\Windows\SysWOW64\rundll32.exe

5_2_6CC77590

Source: C:\Windows\SysWOW64\rundll32.exe

5_2_6CC77590

E-Banking Fraud

Checks if browser processes are running

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: RegOpenKeyExA,RegQueryValueA,RegCloseKey,lstrlenA,_strstr,lstrcpyA,CreateProcessA, Applications\iexplore.exe\shell\open\command

5_2_6CC74DA0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC73EF0 OpenSCManagerA,OpenServiceA,QueryServiceStatus,ControlService,Sleep,DeleteService,wsprintfA,SHDeleteKeyA,

5_2_6CC73EF0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC75760 Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,

5_2_6CC75760

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC80450	5_2_6CC80450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC7FD50	5_2_6CC7FD50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC81D10	5_2_6CC81D10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC936E5	5_2_6CC936E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC8E6F0	5_2_6CC8E6F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC7BF50	5_2_6CC7BF50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC91F34	5_2_6CC91F34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC92058	5_2_6CC92058
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC879A4	5_2_6CC879A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC7C9B0	5_2_6CC7C9B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC8EB88	5_2_6CC8EB88
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_02D0B7C7	14_2_02D0B7C7

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 6CC83300 appears 35 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 656

Source: X7qGiXszrq.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal100.bank.troj.evad.winDLL@29/13@0/1

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC75450 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,OpenProcess,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,FreeLibrary,LoadLibraryA,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,lstrcpyA,lstrcpyA,lstrcpyA,lstrcatA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,	5_2_6CC75450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC795D0 GetCurrentProcess,OpenProcessToken,CloseHandle,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CreateToolhelp32Snapshot,LocalAlloc,Process32First,OpenProcess,lstrlenA,lstrcmpiA,OpenProcess,OpenProcess,K32GetProcessImageFileNameA,GetLogicalDriveStringsA,lstrcmpiA,lstrcmpiA,QueryDosDeviceA,lstrlenA,__fassign,lstrlenA,lstrcpyA,CloseHandle,lstrlenA,lstrlenA,lstrlenA,LocalSize,LocalReAlloc,lstrcpyA,lstrcatA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,OpenProcess,Process32Next,CloseHandle,LocalReAlloc,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	5_2_6CC795D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC75760 Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,	5_2_6CC75760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC79310 LocalSize,LocalFree,GetCurrentProcess,OpenProcessToken,CloseHandle,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,Sleep,LocalSize,LocalFree,EnumWindows,LocalSize,LocalFree,PostMessageA,ShowWindow,	5_2_6CC79310

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC73460 GetLogicalDriveStringsA,lstrlenA,GetVolumeInformationA,SHGetFileInfoA,lstrlenA,lstrlenA,GetDiskFreeSpaceExA,GetDriveTypeA,lstrlenA,lstrlenA,

5_2_6CC73460

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC79C70 CreateToolhelp32Snapshot,Process32First,Process32Next,lstrcmpiA,Process32Next,

5_2_6CC79C70

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC78B30 OpenSCManagerA,OpenServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,Sleep,LocalSize,OpenSCManagerA,CloseServiceHandle,OpenServiceA,CloseServiceHandle,ControlService,CloseServiceHandle,CloseServiceHandle,Sleep,LocalSize,OpenSCManagerA,CloseServiceHandle,OpenServiceA,LockServiceDatabase,OpenSCManagerA,OpenServiceA,LockServiceDatabase,ChangeServiceConfigA,UnlockServiceDatabase,CloseServiceHandle,CloseServiceHandle,Sleep,LocalSize,LocalFree,

5_2_6CC78B30

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\82.157.76.20
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1052
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6476:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess732
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5316

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4d5aa800-b808-4e25-b679-9aa0baf24311

Jump to behavior

Source: X7qGiXszrq.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,FirstRun

Source: X7qGiXszrq.dll	ReversingLabs: Detection: 78%
Source: X7qGiXszrq.dll	Virustotal: Detection: 75%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,FirstRun
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,ServiceMain
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 656
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",FirstRun
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",MainRun
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",ServiceMain
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",TestFun
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 660
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 656
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,FirstRun	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,ServiceMain	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",FirstRun	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",MainRun	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",ServiceMain	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",TestFun	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: X7qGiXszrq.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: X7qGiXszrq.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: X7qGiXszrq.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: X7qGiXszrq.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: X7qGiXszrq.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: X7qGiXszrq.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: X7qGiXszrq.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: X7qGiXszrq.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: X7qGiXszrq.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: X7qGiXszrq.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: X7qGiXszrq.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: X7qGiXszrq.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: X7qGiXszrq.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC75450 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,OpenProcess,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,FreeLibrary,LoadLibraryA,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,lstrcpyA,lstrcpyA,lstrcpyA,lstrcatA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,

5_2_6CC75450

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC7D6DC push edx; retf	5_2_6CC7D6DD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC93E28 push ecx; ret	5_2_6CC93E26
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC83346 push ecx; ret	5_2_6CC83359
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_028ECB3E pushad ; iretd	8_2_028ECB45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_028F6833 push edi; retn 0013h	8_2_028F683A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_028F5471 push eax; retf 0013h	8_2_028F5472
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_02CFDAE7 push esi; iretd	14_2_02CFDB02
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_02CFDA8F push esi; iretd	14_2_02CFDA92
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_02D07690 push ecx; iretd	14_2_02D079CA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_02CFDA57 push esi; iretd	14_2_02CFDA5A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_02CFCB1C push 4002CFCAh; iretd	14_2_02CFCB21
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_02D074B8 push ecx; iretd	14_2_02D079CA

Source: C:\Windows\SysWOW64\rundll32.exe

5_2_6CC78B30

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC74FF0 OpenEventLogA,ClearEventLogA,CloseEventLog,

5_2_6CC74FF0

Source: C:\Windows\SysWOW64\rundll32.exe

5_2_6CC75450

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC7A7A0		5_2_6CC7A7A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC78090		5_2_6CC78090

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 9701

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: OpenSCManagerA,OutputDebugStringA,LocalAlloc,LocalAlloc,EnumServicesStatusA,LocalAlloc,lstrlenA,OpenServiceA,LocalAlloc,QueryServiceConfigA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,LocalSize,LocalReAlloc,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,CloseServiceHandle,LocalReAlloc,

5_2_6CC78680

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 1720	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 672	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 2468	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 2247
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 423
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 3338
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 5159
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 3339	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 377	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 2924
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 414

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_5-15416

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC78090

5_2_6CC78090

Source: C:\Windows\SysWOW64\rundll32.exe TID: 6860	Thread sleep count: 1720 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6860	Thread sleep time: -51600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6960	Thread sleep count: 672 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6960	Thread sleep time: -67200s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6860	Thread sleep count: 2468 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6860	Thread sleep time: -74040000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6864	Thread sleep count: 2247 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6864	Thread sleep time: -67410000s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2004	Thread sleep count: 423 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2004	Thread sleep time: -42300s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6864	Thread sleep count: 3338 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6864	Thread sleep time: -100140000s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7052	Thread sleep count: 5159 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7052	Thread sleep time: -154770000s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 4180	Thread sleep count: 326 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 4180	Thread sleep time: -32600s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6940	Thread sleep count: 3339 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6940	Thread sleep time: -100170000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6720	Thread sleep count: 377 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6720	Thread sleep time: -37700s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6188	Thread sleep count: 2924 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6188	Thread sleep time: -87720000s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5100	Thread sleep count: 414 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5100	Thread sleep time: -41400s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC73640 wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	5_2_6CC73640
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC72E66 FindFirstFileA,FindClose,FindClose,	5_2_6CC72E66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC738E0 lstrlenA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,std::_Xinvalid_argument,	5_2_6CC738E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC8C2C5 FindFirstFileExW,_free,FindNextFileW,_free,FindClose,_free,	5_2_6CC8C2C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC73B10 FindFirstFileA,FindClose,CreateFileA,CloseHandle,	5_2_6CC73B10

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC73460 GetLogicalDriveStringsA,lstrlenA,GetVolumeInformationA,SHGetFileInfoA,lstrlenA,lstrlenA,GetDiskFreeSpaceExA,GetDriveTypeA,lstrlenA,lstrlenA,

5_2_6CC73460

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000

Source: rundll32.exe, 00000007.00000002.2908079006.0000000002422000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: Amcache.hve.11.dr	Binary or memory string: VMware
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1hbin@
Source: rundll32.exe, 00000005.00000002.2908230175.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllP
Source: Amcache.hve.11.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.11.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.11.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: rundll32.exe, 0000000D.00000002.2908050641.0000000002FA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.2908170586.0000000002C6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.11.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.11.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: rundll32.exe, 00000006.00000002.2908169621.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll/
Source: Amcache.hve.11.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.11.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.11.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.11.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.11.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.11.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.11.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.11.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

5_2_6CC77590

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC86466 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_6CC86466

Source: C:\Windows\SysWOW64\rundll32.exe

5_2_6CC75450

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC8A4DE mov eax, dword ptr fs:[00000030h]	5_2_6CC8A4DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC8A524 mov eax, dword ptr fs:[00000030h]	5_2_6CC8A524
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC8894D mov eax, dword ptr fs:[00000030h]	5_2_6CC8894D

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC76510 CreateFileMappingA,MapViewOfFile,GetProcessHeap,HeapFree,

5_2_6CC76510

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC7B0C0 GetProcessWindowStation,OpenWindowStationA,SetProcessWindowStation,SetUnhandledExceptionFilter,lstrcpyA,GetTickCount,wsprintfA,CreateMutexA,SetErrorMode,CloseHandle,Sleep,OpenEventA,Sleep,setsockopt,CancelIo,closesocket,Sleep,SetEvent,CloseHandle,GetTickCount,GetTickCount,CreateEventA,lstrcpyA,lstrcpyA,lstrcpyA,CreateEventA,WaitForSingleObject,CloseHandle,Sleep,TerminateThread,CloseHandle,CloseHandle,GetTickCount,OpenEventA,WaitForSingleObject,Sleep,TerminateThread,CloseHandle,CloseHandle,setsockopt,CancelIo,closesocket,Sleep,SetEvent,CloseHandle,TerminateThread,CloseHandle,CloseHandle,SetErrorMode,ReleaseMutex,CloseHandle,	5_2_6CC7B0C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC824A5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_6CC824A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC86466 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6CC86466
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CC830AC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6CC830AC

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 82.157.76.20 9907

Contains functionality to inject threads in other processes

Source: C:\Windows\SysWOW64\rundll32.exe

5_2_6CC75450

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC77B50 BlockInput,MapVirtualKeyA,mouse_event,SetCursorPos,WindowFromPoint,SetCapture,mouse_event,MapVirtualKeyA,keybd_event,mouse_event,mouse_event,mouse_event,MapVirtualKeyA,

5_2_6CC77B50

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC77B50 BlockInput,MapVirtualKeyA,mouse_event,SetCursorPos,WindowFromPoint,SetCapture,mouse_event,MapVirtualKeyA,keybd_event,mouse_event,mouse_event,mouse_event,MapVirtualKeyA,

5_2_6CC77B50

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC75E60 InitializeSecurityDescriptor,AllocateAndInitializeSid,GetLengthSid,GetProcessHeap,HeapAlloc,InitializeAcl,AddAccessAllowedAce,SetSecurityDescriptorDacl,GetProcessHeap,HeapFree,

5_2_6CC75E60

Source: C:\Windows\SysWOW64\rundll32.exe

5_2_6CC75E60

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC8335B cpuid

5_2_6CC8335B

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC76010 GetActiveWindow,GetWindowTextA,GetLocalTime,wsprintfA,CreateFileA,GetFileSize,SetFilePointer,lstrlenA,WriteFile,CloseHandle,lstrcatA,

5_2_6CC76010

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_6CC7ACA0 GetVersionExA,wsprintfA,lstrlenA,lstrlenA,gethostname,lstrlenA,getsockname,RegOpenKeyA,RegQueryValueExA,RegCloseKey,capGetDriverDescriptionA,capGetDriverDescriptionA,

5_2_6CC7ACA0

Source: Amcache.hve.11.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match	File source: X7qGiXszrq.dll, type: SAMPLE
Source: Yara match	File source: 15.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE

Remote Access Functionality

Yara detected GhostRat

Source: Yara match	File source: X7qGiXszrq.dll, type: SAMPLE
Source: Yara match	File source: 15.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.6cc70000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Service Execution	11 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Service Discovery	Remote Desktop Protocol	3 Clipboard Data	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Windows Service	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	212 Process Injection	1 DLL Side-Loading	NTDS	14 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	121 Virtualization/Sandbox Evasion	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	212 Process Injection	DCSync	11 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Indicator Removal	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
X7qGiXszrq.dll	79%	ReversingLabs	Win32.Backdoor.Farfli
X7qGiXszrq.dll	75%	Virustotal		Browse
X7qGiXszrq.dll	100%	Avira	BDS/Backdoor.Gen
X7qGiXszrq.dll	100%	Joe Sandbox ML

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.11.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
82.157.76.20	unknown	China		12513	ECLIPSEGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581116
Start date and time:	2024-12-27 01:26:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	X7qGiXszrq.dll renamed because original name is a hash value
Original Sample Name:	8F60B2218139D38978B4263244BFA4C9.dll
Detection:	MAL
Classification:	mal100.bank.troj.evad.winDLL@29/13@0/1
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 28 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12, 20.190.181.5, 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 5316 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 732 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
19:26:53	API Interceptor	1418580x Sleep call for process: rundll32.exe modified
19:27:02	API Interceptor	1x Sleep call for process: loaddll32.exe modified
19:27:32	API Interceptor	3x Sleep call for process: WerFault.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ECLIPSEGB	nsharm7.elf	Get hash	malicious	Mirai	Browse	82.156.253.85
	Browser.Daemon.exe	Get hash	malicious	Unknown	Browse	82.156.94.45
	Browser.Daemon.exe	Get hash	malicious	Unknown	Browse	82.156.94.45
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	91.84.160.165
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	81.168.94.59
	https://cc.naver.com/cc?a=pst.link&m=1&nsc=Mblog.post&u=https://prestamosgarantizados.com/wvr/#svk8Lh6vLh6njx3lLh6vg4Pnq07qug4Plvk8Lh6rjx3z9BR15WPy	Get hash	malicious	HTMLPhisher	Browse	109.176.30.14
	https://cc.naver.com/cc?a=pst.link&m=1&nsc=Mblog.post&u=https://prestamosgarantizados.com/wvr/#svk8Lh6vLh6njx3lLh6vg4Pnq07qug4Plvk8Lh6rjx3z9BR15WPy	Get hash	malicious	HTMLPhisher	Browse	109.176.30.14
	ppc.elf	Get hash	malicious	Unknown	Browse	82.153.67.118
	armv5l.elf	Get hash	malicious	Unknown	Browse	91.84.182.242
	TRC.mips.elf	Get hash	malicious	Mirai	Browse	82.153.67.135

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_26a67898946df8cd7879fcf65642466ed07e12_7522e4b5_70e4fd71-13fe-4d60-9d7f-63a045af65b8\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8914991867990453
Encrypted:	false
SSDEEP:	192:NP8iROxH0BU/wjeTLLzuiFkZ24IO8dci:V8ioxUBU/wjeTzuiFkY4IO8dci
MD5:	7621965E5E754FB499A14F3DE5A1A94D
SHA1:	E2F45FF1D8F2DD9D8542DA394A669E5F413FA76B
SHA-256:	6EE001E113A619488A3C5142296ED29B3183484E2ACE22D2179DF5CD194FE7E8
SHA-512:	7790FE5AD0D9E84DB21EB89180468E7D529CE00C1FDD2EB430DEE4467AC31AF1F35E5930C0A8E512BE34A3BE6D7E53FB63B82C214488AD459534FE9AFB74A91E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.7.3.2.8.2.3.1.7.1.2.3.0.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.7.3.2.8.2.3.8.8.9.9.6.9.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.0.e.4.f.d.7.1.-.1.3.f.e.-.4.d.6.0.-.9.d.7.f.-.6.3.a.0.4.5.a.f.6.5.b.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.9.f.5.1.c.0.f.-.e.a.7.0.-.4.e.4.6.-.a.b.c.5.-.2.6.6.5.f.d.2.1.8.5.f.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.c.4.-.0.0.0.1.-.0.0.1.4.-.2.2.9.0.-.e.b.0.c.f.6.5.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_26a67898946df8cd7879fcf65642466ed07e12_7522e4b5_9202bffe-b83e-455e-a4a2-48e27a682c9d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8914520697323963
Encrypted:	false
SSDEEP:	96:WPFBZ6i9nhVynjsj94sR7ifmQXIDcQvc6QcEVcw3cE/O/a/z+HbHg/BQAS/YyNlG:EUiVOjH0BU/wjeTmezuiFkZ24IO8dci
MD5:	99B6150118433636C42E6FB55D7B912A
SHA1:	23761D2DD3AF056E40965A704489615F298790F2
SHA-256:	F242147BE693F546A8D4080593D7796E0282A6E670DDA65B07EB318DFB538095
SHA-512:	25EEDD299196546B955D8ECDD9034F094631277BF614AC34A6D2072AD7E544F440E1F73BB304EC3D9116B6353291F0D9F17AC23B041C6A9D8825EE16C71A3613
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.7.3.2.8.2.0.1.2.1.9.0.0.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.7.3.2.8.2.0.4.5.0.0.1.6.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.2.0.2.b.f.f.e.-.b.8.3.e.-.4.5.5.e.-.a.4.a.2.-.4.8.e.2.7.a.6.8.2.c.9.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.b.7.d.e.d.2.b.-.0.b.2.0.-.4.b.8.8.-.a.4.2.f.-.3.d.7.6.4.2.9.9.d.4.4.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.d.c.-.0.0.0.1.-.0.0.1.4.-.6.1.9.a.-.1.b.0.b.f.6.5.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_6e27b41365c35c573789b1cc3865f957bf2a54_7522e4b5_3d1832b8-3231-4d87-a53d-dff582db6ccb\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8914345474437483
Encrypted:	false
SSDEEP:	192:bejiDOGh0BU/wjeTLLzuiFkZ24IO8dcim:KjiKGiBU/wjeTzuiFkY4IO8dci
MD5:	7D7774A58F32F85BDD09B078CC45AC20
SHA1:	A48E5313D0F5ACFF9301F1E89B367AE68E9B7EB1
SHA-256:	C9F6469BD9431F9A7C414F2B10C6DD1782231E588071A4CCAF2D27C1560649D3
SHA-512:	DD30B886C58F3603B8281330BAB29942A827B95D517055A6ED5AC73B71F666FCA02B32C712D96EA7119825BD572A2B72BD79EB30A85D78E4101511F579B4F373
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.7.3.2.8.2.3.1.9.9.8.7.5.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.7.3.2.8.2.3.9.0.2.9.8.7.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.d.1.8.3.2.b.8.-.3.2.3.1.-.4.d.8.7.-.a.5.3.d.-.d.f.f.5.8.2.d.b.6.c.c.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.e.9.0.9.0.e.1.-.0.a.2.7.-.4.7.a.0.-.9.9.6.5.-.0.c.a.9.a.7.f.e.e.0.6.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.1.c.-.0.0.0.1.-.0.0.1.4.-.0.4.4.e.-.f.3.0.c.f.6.5.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8252.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 27 00:27:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43338
Entropy (8bit):	2.006086483761336
Encrypted:	false
SSDEEP:	192:21cr21302vFd3rO5H4d3U6UyX86wFN96lugKu:Ku2JjvFdi5HjYM6wF8uBu
MD5:	F4704375A3685962BBDD7A41625DBBE7
SHA1:	34CA81EAFE71B91A0253128A55F2BFD0B795F297
SHA-256:	8DF1C72015B154B68B22A175D3E3924082F69EEE5FB1F36DA0477C61207C388C
SHA-512:	E16E243DA93D0EA4E0C200BE35C59501A291C822C4C97E172B63C86554445D301E0A57C4B09BEFE84E43D6A18681758E5105742142E9285C58230595B0F45452
Malicious:	false
Preview:	MDMP..a..... .......T.mg.........................................*..........T.......8...........T...........(...".......................l...............................................................................eJ..............GenuineIntel............T...........S.mg.............................0..=...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER82DF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8258
Entropy (8bit):	3.6938210104178593
Encrypted:	false
SSDEEP:	192:R6l7wVeJ7S6IWN6Y+f6EPgmfT5++prO89b5LEsfBTzm:R6lXJe6IWN6Y26EPgmfT5+M5L3fVq
MD5:	E948B1BF5BC2140D3E0C5BDE7DBE3C87
SHA1:	994E45F7F3A5F61BF65E216629746FD80439B5A8
SHA-256:	BFFFCE5CB34AA31CC76E533FC65C7208BE3A99DC7E4EFA2165763DCA8CE66DCA
SHA-512:	CA5F95154DEF459DA42633A07C57FFF8297A1DF0390948F2026399723B9EFEF2C1A738E8176E8A27A79953614AC4717A2BCFD2DAD031C744DAF8A37DA42D7581
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.2.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER82FF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4650
Entropy (8bit):	4.468401853708542
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI96lWpW8VYvcYm8M4JCdPmvFh+q8/8nDHGScSNd:uIjf8I7wU7Vm5Jb5J3Nd
MD5:	779B84E31AABF26F06A4841FCEE40DEC
SHA1:	5AA5E21A02764EECA8B7871381F307D77F3E7AC9
SHA-256:	0DEE8FEA12F18902D30EB9EBAD1A236627CA332637E70397A62FC2733F476A49
SHA-512:	99F0E008CD6A43FD6E361837B532E5B645AB8CCE55EE40CBD03D50418354643708B33D6563194E279115553F51AB019EF3F1199A3239FB8121AE3A2E0458031B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="648929" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E48.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 27 00:27:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	45694
Entropy (8bit):	1.9280257141294073
Encrypted:	false
SSDEEP:	96:5o8B+M6cUTUqwfw12P3Y32pSLg4BHu1LAoi75I4v44haL9nNV3R5B2IbezxNnWIf:x4cr213yug4dWO5H4RXrYVwBtMXf3
MD5:	647A16E7FD7D3935608F6CFA2A501A7F
SHA1:	3E29974BF18DE3CEB6F36734BC1C262834DCBF7D
SHA-256:	83CEBD0F57FD5DBD7F1783C796F00782C3E59FC326AABEC278AC179F768C1220
SHA-512:	FD76677922A066AD2B2680D137F4062C576B38E9548FA8AEE26346F6EEB821C9F3E3C78F77E6C319B579BB56374ED4FFB0DC4F78BDCB0823092813F30383F994
Malicious:	false
Preview:	MDMP..a..... .......W.mg.........................................*..........T.......8...........T...........(...V.......................l...............................................................................eJ..............GenuineIntel............T...........V.mg.............................0..=...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E58.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 27 00:27:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43714
Entropy (8bit):	1.9876926717638022
Encrypted:	false
SSDEEP:	192:xccr213Lug4dDOO5H4ptMHUojLFcfrwMdHT6epNsLTdf:Su2JSg4dV5HZXyfrwMRWrTd
MD5:	FC0B73D88310D3077BB1F639FFEA77A6
SHA1:	7D41D2C96F8A419B5CA1F3B6035DCE00525A169B
SHA-256:	132D622943524B32EDE94232BD873B0A0223CDACA9DD04FCC9A8EDBA52092696
SHA-512:	54640A11B02A41DE4688DA54961E0AEA0D8C50BD7D00F1FA37F2AD6A4C67D65814E8368F28B69FC08770949FDFD6E3B04E40E00E2B87F17CD1F49C78D3AF667E
Malicious:	false
Preview:	MDMP..a..... .......W.mg.........................................*..........T.......8...........T...........(...........................l...............................................................................eJ..............GenuineIntel............T...........V.mg.............................0..=...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F14.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8252
Entropy (8bit):	3.6962309848566153
Encrypted:	false
SSDEEP:	192:R6l7wVeJMKe6IWyh6Yux6KKgmfTP++prM89b5Qesf+TWm:R6lXJMb6IWc6YI6KKgmfTP+S5Qdf6f
MD5:	EE62CF80DE4E2749BB25B1F31B9C230F
SHA1:	76C94F7497D17794C0928020A54DD028ED63EAFC
SHA-256:	47551C5D76E0CFE7A0F482D1334FFDB5F4D82FD418FA94BEDAA04B02CCC10F93
SHA-512:	0F17CC2A306B6714F089FD7A6EE5A7A9C70F18FCEED989155BC0F430295DC8465B35FED69625892ABBCA77830B0B55464D5A1789F854B929034B5A6A8C79329F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F43.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8256
Entropy (8bit):	3.6946700262701664
Encrypted:	false
SSDEEP:	192:R6l7wVeJ0I6IWW6Yu76KKgmfT5++pry89b5QTsf82TWm:R6lXJD6IWW6YC6KKgmfT5+Q5Q4f8if
MD5:	C38EB8BCC671EFDCF9607FE4457AD28E
SHA1:	DE51B1FB25F2DE5111D4B12CB315C1CF4F4C23DF
SHA-256:	0BF5DDFD1F0440D2773C08E683489D46E9F2BEEE24F8D680F2B90AB03289687B
SHA-512:	7D31D593E55D1D300C0396B90C417F16F1F1D293175FCD7653C2586D17F02DD44FE08CEC06925E929D6DF1C01239EC8BF27EF5F8C309BEA8680CC2D608EB84EB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.3.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F44.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4650
Entropy (8bit):	4.4647521548064955
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI96lWpW8VYCYm8M4JCdPmTFu+q8/8nHGScS1d:uIjf8I7wU7VKJ49J31d
MD5:	8AA2D154EDB24CD174CF2DE880E9B825
SHA1:	37511B926E46B652FD756B7E5AAE9F0DAE2A52EE
SHA-256:	E6B998C788906DF8C44D234A8469B207714215E6ECF15F8F90238234237F7BE8
SHA-512:	3F14DDEBAA3D984CBC556813915A19B7C69C98BB399FB91CEEDAC254009D833E5EDB8FEE2CB53788414116356E05A2745457A8EFB98B4EEAD84C7743921F479D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="648929" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FB1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4650
Entropy (8bit):	4.467713778402247
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI96lWpW8VYKYm8M4JCdPmvFUU+q8/8nbGScSvd:uIjf8I7wU7VmJCURJ3vd
MD5:	B8105E225508F0C2ED8D0CE3CE2364F5
SHA1:	07DD8EAC24B2EFC4ED516F093715AD1E41128DFD
SHA-256:	F5E7760BAC3E321CC63884226AF8987CD2ED30E7715F1D355CB5E02A1F2A278B
SHA-512:	411CEDDACFB4DCC3B0161B362199EEDDD042DC22A7E03387A734AF16BBB2A41CC13EA7423E467AA5EB65F4AD887F8572D8CC6495CA8B8D581EF91842186115A1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="648929" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4662349128717835
Encrypted:	false
SSDEEP:	6144:UIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNxdwBCswSbG:pXD94+WlLZMM6YFHT+G
MD5:	3F25C7CFA959B1B02F73E10ADAE64C97
SHA1:	E97889101D79B2970AEBAABDD8E0442780C13D7A
SHA-256:	13F3B970C897F501C17F5CD36F9FC5CAA4EDCCD124970C141A391C910206595D
SHA-512:	891813E6AD5161DEFE2761EC436EE73E29B5D3273A4DB37AF493B1B4582904DC3B3D2FCCE7EE462E2666E69FEB38D3C4295CCE9C990B5CC471ECBCF95530CE10
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..D..W..............................................................................................................................................................................................................................................................................................................................................V.S?........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.65982581309569
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	X7qGiXszrq.dll
File size:	213'504 bytes
MD5:	8f60b2218139d38978b4263244bfa4c9
SHA1:	80324b76dc1f4688c775e47d8b9d1c313d212319
SHA256:	9e4eb613a93a8b79faca6ed56bd73f3f04ef6fcf52473cd0ffd6724a656cf46b
SHA512:	249baac74806f4a07e73cc11a9dfe6bbf73a8c50ba99aec1ed31625f5dfc76b366a50aaed4d1bd6bbbc7ed073031e861a049e72eff3ec773f5cbc7364bffff88
SSDEEP:	6144:b1TyRICfzZQVG5zLD45eEhIv5KTBIUXuTyEGVa:bQRvfzZQVCHD4kEW5KTC0u2E1
TLSH:	BA249E117580D833D6FE013044E7DB6A663D79340BA8E8DBE3DCAF790D745C26A34A9A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..b3..13..13..1V..0?..1V..0...1V..0!..1..611..1a..0...1a..0<..1a..0&..1V..0(..13..1p..1...09..1...02..1...0+..1...02..1...12..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10012b73
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5F2E4920 [Sat Aug 8 06:41:36 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ecea502ae8d6b6cf637b892f3a6b808d

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FAC6081A387h
call 00007FAC6081AA20h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FAC6081A238h
add esp, 0Ch
pop ebp
retn 000Ch
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
push ebx
xor edi, edi
mov eax, dword ptr [esp+14h]
or eax, eax
jnl 00007FAC6081A396h
inc edi
mov edx, dword ptr [esp+10h]
neg eax
neg edx
sbb eax, 00000000h
mov dword ptr [esp+14h], eax
mov dword ptr [esp+10h], edx
mov eax, dword ptr [esp+1Ch]
or eax, eax
jnl 00007FAC6081A396h
inc edi
mov edx, dword ptr [esp+18h]
neg eax
neg edx
sbb eax, 00000000h
mov dword ptr [esp+1Ch], eax
mov dword ptr [esp+18h], edx
or eax, eax
jne 00007FAC6081A39Ah
mov ecx, dword ptr [esp+18h]
mov eax, dword ptr [esp+14h]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword ptr [esp+10h]
div ecx
mov edx, ebx
jmp 00007FAC6081A3C3h
mov ebx, eax
mov ecx, dword ptr [esp+18h]
mov edx, dword ptr [esp+14h]
mov eax, dword ptr [esp+10h]
shr ebx, 1
rcr ecx, 1
shr edx, 1
rcr eax, 1
or ebx, ebx
jne 00007FAC6081A376h
div ecx
mov esi, eax
mul dword ptr [esp+1Ch]
mov ecx, eax
mov eax, dword ptr [esp+18h]
mul esi
add edx, ecx
jc 00007FAC6081A390h
cmp edx, dword ptr [esp+14h]
jnbe 00007FAC6081A38Ah
jc 00007FAC6081A389h
cmp eax, dword ptr [esp+10h]
jbe 00007FAC6081A383h
dec esi
xor edx, edx
mov eax, esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x302a0	0x84	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30324	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0xf8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x35000	0x2064	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2e900	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2ea10	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2e970	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x25000	0x4ac	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x23c0b	0x23e00	22f9d3ff98348b3c88a1f907c5e48343	False	0.5676856489547039	data	6.636804258074074	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x25000	0xccb8	0xce00	48e054a29558fa7b381b4f48b7450167	False	0.550439927184466	data	5.985634918572682	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x32000	0x1f88	0xe00	cbb9f4531dbf7b8f2c84bd6fe5d023b0	False	0.19670758928571427	data	2.8965536616297585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x34000	0xf8	0x200	d6c64ce0f44f661d13f0af67e8b4d484	False	0.3359375	data	2.5312981004807127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x35000	0x2064	0x2200	942a5ec83872d12e971eada6913059dd	False	0.7635569852941176	data	6.546808814766869	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x34060	0x91	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.8689655172413793

Imports

DLL	Import
WININET.dll	InternetCloseHandle, InternetOpenA, InternetReadFile, InternetOpenUrlA
SHLWAPI.dll	SHDeleteKeyA
KERNEL32.dll	HeapAlloc, GetLocalTime, CreateFileMappingA, GetProcessHeap, MapViewOfFile, LocalSize, GlobalAlloc, GlobalLock, GlobalUnlock, GlobalFree, GlobalSize, OutputDebugStringA, CreatePipe, GetStartupInfoA, TerminateProcess, DisconnectNamedPipe, PeekNamedPipe, WaitForMultipleObjects, lstrcmpiA, QueryDosDeviceA, K32GetProcessImageFileNameA, CreateToolhelp32Snapshot, Process32First, Process32Next, GetCurrentProcessId, GetCurrentThreadId, SetUnhandledExceptionFilter, CreateMutexA, SetErrorMode, OpenEventA, ReleaseMutex, FreeConsole, FlushFileBuffers, HeapSize, SetStdHandle, SetFilePointerEx, GetStringTypeW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, HeapFree, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, GetFileType, GetStdHandle, HeapReAlloc, LCMapStringW, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, LoadLibraryExW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, EncodePointer, InterlockedFlushSList, RaiseException, RtlUnwind, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, GetStartupInfoW, IsDebuggerPresent, GetModuleHandleW, CreateEventW, WaitForSingleObjectEx, InitializeCriticalSectionAndSpinCount, MoveFileExA, GetTickCount, GetSystemDirectoryA, CreateRemoteThread, WriteProcessMemory, VirtualAllocEx, OpenProcess, GetCurrentProcess, SetLastError, GetModuleFileNameA, CreateDirectoryA, GetDiskFreeSpaceExA, WriteConsoleW, CreateProcessA, LocalReAlloc, RemoveDirectoryA, GetFileSize, LocalFree, GetLogicalDriveStringsA, DeleteFileA, CreateFileA, GetFileAttributesA, GetLastError, LocalAlloc, GetVolumeInformationA, FindClose, SetFilePointer, FindNextFileA, GetDriveTypeA, WriteFile, FindFirstFileA, MoveFileA, ReadFile, GetVersionExA, WideCharToMultiByte, MultiByteToWideChar, FreeLibrary, GetProcAddress, LoadLibraryA, lstrlenA, lstrcatA, DeleteCriticalSection, InitializeCriticalSection, LeaveCriticalSection, VirtualAlloc, VirtualFree, EnterCriticalSection, ResetEvent, lstrcpyA, Sleep, CancelIo, ResumeThread, CreateThread, WaitForSingleObject, SetEvent, CloseHandle, TerminateThread, CreateEventA, GetConsoleCP, IsProcessorFeaturePresent, UnhandledExceptionFilter, GetConsoleMode, DecodePointer, UnmapViewOfFile, CreateFileW, GetCPInfo
USER32.dll	SetWindowsHookExA, GetKeyNameTextA, GetActiveWindow, CallNextHookEx, LoadCursorA, DestroyCursor, BlockInput, SystemParametersInfoA, SendMessageA, wsprintfA, SetCapture, WindowFromPoint, UnhookWindowsHookEx, keybd_event, MapVirtualKeyA, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, GetClipboardData, GetSystemMetrics, GetCursorInfo, DispatchMessageA, TranslateMessage, GetMessageA, GetWindowTextA, mouse_event, ReleaseDC, SetRect, CharNextA, GetDC, SetCursorPos, GetThreadDesktop, GetCursorPos, SetProcessWindowStation, OpenWindowStationA, GetProcessWindowStation, CreateWindowExA, GetUserObjectInformationA, SetThreadDesktop, ExitWindowsEx, CloseDesktop, OpenDesktopA, OpenInputDesktop, InternalGetWindowText, IsWindow, ShowWindow, PostMessageA, EnumWindows, GetWindowThreadProcessId, IsWindowVisible, GetDesktopWindow
GDI32.dll	CreateDIBSection, SelectObject, DeleteDC, GetDIBits, CreateCompatibleBitmap, BitBlt, DeleteObject, CreateCompatibleDC
ADVAPI32.dll	RegOpenKeyExA, RegisterServiceCtrlHandlerA, SetServiceStatus, UnlockServiceDatabase, ChangeServiceConfigA, LockServiceDatabase, StartServiceA, QueryServiceConfigA, EnumServicesStatusA, RegQueryInfoKeyA, RegDeleteKeyA, RegCreateKeyExA, RegEnumValueA, RegEnumKeyExA, SetSecurityDescriptorDacl, AllocateAndInitializeSid, FreeSid, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, AddAccessAllowedAce, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, CloseEventLog, ClearEventLogA, OpenEventLogA, RegQueryValueExA, RegOpenKeyA, RegSetValueExA, CloseServiceHandle, DeleteService, ControlService, QueryServiceStatus, OpenServiceA, OpenSCManagerA, RegCloseKey, RegQueryValueA
SHELL32.dll	SHGetFileInfoA
WINMM.dll	waveInReset, waveOutWrite, waveInGetNumDevs, waveInOpen, waveInUnprepareHeader, waveInClose, waveOutReset, waveOutUnprepareHeader, waveInStop, waveInPrepareHeader, waveInAddBuffer, waveInStart, waveOutGetNumDevs, waveOutOpen, waveOutPrepareHeader, waveOutClose
WS2_32.dll	select, socket, ntohs, connect, recv, htons, setsockopt, WSAStartup, gethostbyname, closesocket, WSAIoctl, WSACleanup, gethostname, getsockname, send
IMM32.dll	ImmGetContext, ImmReleaseContext, ImmGetCompositionStringA
AVICAP32.dll	capGetDriverDescriptionA, capCreateCaptureWindowA
MSVFW32.dll	ICClose, ICCompressorFree, ICSeqCompressFrameEnd, ICSendMessage, ICOpen, ICSeqCompressFrame, ICSeqCompressFrameStart

Exports

Name	Ordinal	Address
FirstRun	1	0x1000bae0
MainRun	2	0x1000b9e0
ServiceMain	3	0x1000b7b0
TestFun	4	0x1000b950

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T01:26:55.011885+0100	2016922	ET MALWARE Backdoor family PCRat/Gh0st CnC traffic	1	192.168.2.4	49730	82.157.76.20	9907	TCP
2024-12-27T01:26:55.013356+0100	2016922	ET MALWARE Backdoor family PCRat/Gh0st CnC traffic	1	192.168.2.4	49731	82.157.76.20	9907	TCP
2024-12-27T01:26:56.699773+0100	2048478	ET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive	1	82.157.76.20	9907	192.168.2.4	49731	TCP
2024-12-27T01:26:56.699773+0100	2808814	ETPRO MALWARE Backdoor family PCRat/Gh0st CnC Response	1	82.157.76.20	9907	192.168.2.4	49731	TCP
2024-12-27T01:26:56.702900+0100	2048478	ET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive	1	82.157.76.20	9907	192.168.2.4	49730	TCP
2024-12-27T01:26:56.702900+0100	2808814	ETPRO MALWARE Backdoor family PCRat/Gh0st CnC Response	1	82.157.76.20	9907	192.168.2.4	49730	TCP
2024-12-27T01:26:57.854874+0100	2016922	ET MALWARE Backdoor family PCRat/Gh0st CnC traffic	1	192.168.2.4	49732	82.157.76.20	9907	TCP
2024-12-27T01:26:59.543244+0100	2048478	ET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive	1	82.157.76.20	9907	192.168.2.4	49732	TCP
2024-12-27T01:26:59.543244+0100	2808814	ETPRO MALWARE Backdoor family PCRat/Gh0st CnC Response	1	82.157.76.20	9907	192.168.2.4	49732	TCP
2024-12-27T01:27:04.312547+0100	2016922	ET MALWARE Backdoor family PCRat/Gh0st CnC traffic	1	192.168.2.4	49736	82.157.76.20	9907	TCP
2024-12-27T01:27:04.325180+0100	2016922	ET MALWARE Backdoor family PCRat/Gh0st CnC traffic	1	192.168.2.4	49735	82.157.76.20	9907	TCP
2024-12-27T01:27:05.954186+0100	2048478	ET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive	1	82.157.76.20	9907	192.168.2.4	49736	TCP
2024-12-27T01:27:05.954186+0100	2808814	ETPRO MALWARE Backdoor family PCRat/Gh0st CnC Response	1	82.157.76.20	9907	192.168.2.4	49736	TCP
2024-12-27T01:27:05.959491+0100	2048478	ET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive	1	82.157.76.20	9907	192.168.2.4	49735	TCP
2024-12-27T01:27:05.959491+0100	2808814	ETPRO MALWARE Backdoor family PCRat/Gh0st CnC Response	1	82.157.76.20	9907	192.168.2.4	49735	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 01:26:54.852246046 CET	49731	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:26:54.852261066 CET	49730	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:26:54.972049952 CET	9907	49731	82.157.76.20	192.168.2.4
Dec 27, 2024 01:26:54.972069979 CET	9907	49730	82.157.76.20	192.168.2.4
Dec 27, 2024 01:26:54.972141027 CET	49731	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:26:54.972179890 CET	49730	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:26:55.011884928 CET	49730	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:26:55.013355970 CET	49731	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:26:55.131519079 CET	9907	49730	82.157.76.20	192.168.2.4
Dec 27, 2024 01:26:55.132904053 CET	9907	49731	82.157.76.20	192.168.2.4
Dec 27, 2024 01:26:56.699773073 CET	9907	49731	82.157.76.20	192.168.2.4
Dec 27, 2024 01:26:56.702899933 CET	9907	49730	82.157.76.20	192.168.2.4
Dec 27, 2024 01:26:56.743994951 CET	49730	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:26:56.744153976 CET	49731	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:26:57.721566916 CET	49732	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:26:57.841660023 CET	9907	49732	82.157.76.20	192.168.2.4
Dec 27, 2024 01:26:57.841767073 CET	49732	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:26:57.854873896 CET	49732	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:26:57.974481106 CET	9907	49732	82.157.76.20	192.168.2.4
Dec 27, 2024 01:26:59.543243885 CET	9907	49732	82.157.76.20	192.168.2.4
Dec 27, 2024 01:26:59.587753057 CET	49732	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:27:03.837132931 CET	49735	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:27:03.861867905 CET	49736	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:27:04.297383070 CET	9907	49735	82.157.76.20	192.168.2.4
Dec 27, 2024 01:27:04.297480106 CET	49735	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:27:04.297485113 CET	9907	49736	82.157.76.20	192.168.2.4
Dec 27, 2024 01:27:04.297547102 CET	49736	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:27:04.312546968 CET	49736	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:27:04.325180054 CET	49735	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:27:04.432106018 CET	9907	49736	82.157.76.20	192.168.2.4
Dec 27, 2024 01:27:04.444789886 CET	9907	49735	82.157.76.20	192.168.2.4
Dec 27, 2024 01:27:05.954185963 CET	9907	49736	82.157.76.20	192.168.2.4
Dec 27, 2024 01:27:05.959491014 CET	9907	49735	82.157.76.20	192.168.2.4
Dec 27, 2024 01:27:06.009648085 CET	49736	9907	192.168.2.4	82.157.76.20
Dec 27, 2024 01:27:06.009650946 CET	49735	9907	192.168.2.4	82.157.76.20

Target ID:	0
Start time:	19:26:53
Start date:	26/12/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll"
Imagebase:	0x290000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:26:53
Start date:	26/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:26:53
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:26:53
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,FirstRun
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:26:53
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",#1
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:26:53
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:26:53
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: rundll32.exePID: 7012, Parent PID: 6460

General

Target ID:	7
Start time:	19:26:56
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: rundll32.exePID: 732, Parent PID: 6460

General

Target ID:	8
Start time:	19:26:59
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,ServiceMain
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:26:59
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 656
Imagebase:	0x3f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:27:02
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",FirstRun
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:27:02
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",MainRun
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	19:27:02
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",ServiceMain
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:27:02
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\X7qGiXszrq.dll,MainRun
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: rundll32.exePID: 1052, Parent PID: 6460

General

Target ID:	16
Start time:	19:27:02
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\X7qGiXszrq.dll",TestFun
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:27:03
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 660
Imagebase:	0x3f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:27:03
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 656
Imagebase:	0x3f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	1245
Total number of Limit Nodes:	30

Executed Functions

Function 6CC7B0C0 Relevance: 93.1, APIs: 49, Strings: 4, Instructions: 335
sleepstringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessWindowStation.USER32 ref: 6CC7B14A
OpenWindowStationA.USER32(winsta0,00000000,02000000), ref: 6CC7B15C
SetProcessWindowStation.USER32(00000000), ref: 6CC7B167
SetUnhandledExceptionFilter.KERNEL32(Function_0000B040), ref: 6CC7B17B
lstrcpyA.KERNEL32(?,?), ref: 6CC7B189
GetTickCount.KERNEL32 ref: 6CC7B18F
wsprintfA.USER32 ref: 6CC7B19F
CreateMutexA.KERNEL32(00000000,00000001,82.157.76.20), ref: 6CC7B1B1
SetErrorMode.KERNEL32(00000001), ref: 6CC7B1BF
OpenEventA.KERNEL32(001F0003,00000000,?), ref: 6CC7B20B
Sleep.KERNEL32(0000003C), ref: 6CC7B21D
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 6CC7B24D
CancelIo.KERNEL32(?), ref: 6CC7B259
closesocket.WS2_32(?), ref: 6CC7B26F
Sleep.KERNEL32(000001F4), ref: 6CC7B27A
SetEvent.KERNEL32(?), ref: 6CC7B282
CloseHandle.KERNEL32(?), ref: 6CC7B298
GetTickCount.KERNEL32 ref: 6CC7B2F0
GetTickCount.KERNEL32 ref: 6CC7B318

Part of subcall function 6CC7ACA0: GetVersionExA.KERNEL32 ref: 6CC7ACDE
Part of subcall function 6CC7ACA0: wsprintfA.USER32 ref: 6CC7AD85
Part of subcall function 6CC7ACA0: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC7ADB3
Part of subcall function 6CC7ACA0: gethostname.WS2_32(?,00000100), ref: 6CC7ADC6
Part of subcall function 6CC7ACA0: lstrlenA.KERNEL32(?), ref: 6CC7AE07
Part of subcall function 6CC7ACA0: getsockname.WS2_32(?,?,?), ref: 6CC7AE2D

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6CC7B369
lstrcpyA.KERNEL32(?,?), ref: 6CC7B38D
lstrcpyA.KERNEL32(?,?), ref: 6CC7B39E
lstrcpyA.KERNEL32(82.157.76.20,82.157.76.20), ref: 6CC7B3AE
CreateEventA.KERNEL32 ref: 6CC7B3F9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC7B42B
CloseHandle.KERNEL32(?), ref: 6CC7B437
Sleep.KERNEL32(000003E8), ref: 6CC7B46E
TerminateThread.KERNEL32(?,000000FF), ref: 6CC7B4A9
CloseHandle.KERNEL32(?), ref: 6CC7B4B6
CloseHandle.KERNEL32(?), ref: 6CC7B4D1
GetTickCount.KERNEL32 ref: 6CC7B4DE
OpenEventA.KERNEL32(001F0003,00000000,?), ref: 6CC7B4EF
WaitForSingleObject.KERNEL32(?,00000064), ref: 6CC7B503
Sleep.KERNEL32(000001F4), ref: 6CC7B510
TerminateThread.KERNEL32(?,000000FF), ref: 6CC7B53A
CloseHandle.KERNEL32(?), ref: 6CC7B547
CloseHandle.KERNEL32(?), ref: 6CC7B562
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 6CC7B592
CancelIo.KERNEL32(?), ref: 6CC7B59E
closesocket.WS2_32(?), ref: 6CC7B5B4
Sleep.KERNEL32(000001F4), ref: 6CC7B5BF
SetEvent.KERNEL32(?), ref: 6CC7B5C7
CloseHandle.KERNEL32(00000000), ref: 6CC7B5DD
TerminateThread.KERNEL32(?,000000FF), ref: 6CC7B609
CloseHandle.KERNEL32(?), ref: 6CC7B616
CloseHandle.KERNEL32(?), ref: 6CC7B631
SetErrorMode.KERNEL32(00000000), ref: 6CC7B635
ReleaseMutex.KERNEL32(?), ref: 6CC7B642
CloseHandle.KERNEL32(?), ref: 6CC7B649

Part of subcall function 6CC71390: WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,?,6CC74311), ref: 6CC713AA
Part of subcall function 6CC71390: CloseHandle.KERNEL32(?,?,6CC74311), ref: 6CC713CC
Part of subcall function 6CC71390: CloseHandle.KERNEL32(?,?,6CC74311), ref: 6CC713D4
Part of subcall function 6CC71390: WSACleanup.WS2_32 ref: 6CC713D6
Part of subcall function 6CC71390: VirtualFree.KERNEL32(?,00000000,00008000,?,6CC74311), ref: 6CC713FB
Part of subcall function 6CC71390: DeleteCriticalSection.KERNEL32(?,?,6CC74311), ref: 6CC7140A
Part of subcall function 6CC71390: VirtualFree.KERNEL32(?,00000000,00008000,?,6CC74311), ref: 6CC71422
Part of subcall function 6CC71390: DeleteCriticalSection.KERNEL32(?,?,6CC74311), ref: 6CC71428
Part of subcall function 6CC71390: VirtualFree.KERNEL32(?,00000000,00008000,?,6CC74311), ref: 6CC71440
Part of subcall function 6CC71390: DeleteCriticalSection.KERNEL32(?,?,6CC74311), ref: 6CC71446
Part of subcall function 6CC71390: VirtualFree.KERNEL32(?,00000000,00008000,?,6CC74311), ref: 6CC7145E
Part of subcall function 6CC71390: DeleteCriticalSection.KERNEL32(?,?,6CC74311), ref: 6CC71464

Strings

82.157.76.20, xrefs: 6CC7B1A8, 6CC7B2F7, 6CC7B3A4
winsta0, xrefs: 6CC7B157
Global\CcRem %d, xrefs: 6CC7B199
82.157.76.20, xrefs: 6CC7B3A9

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CloseHandle$Event$Sleep$CountCriticalDeleteFreeSectionTickVirtuallstrcpy$CreateObjectOpenSingleStationTerminateThreadWaitWindow$CancelErrorModeMutexProcessclosesocketlstrlensetsockoptwsprintf$CleanupExceptionFilterReleaseUnhandledVersiongethostnamegetsockname
String ID: 82.157.76.20$82.157.76.20$Global\CcRem %d$winsta0
API String ID: 3764759395-2545991086
Opcode ID: 6f7c570eee18f5118f7e6d35882b386eefffcc09af04fd52d27d964cd9464c46
Instruction ID: 42b5e150996d19355e5b0a26c5a844d619a90895833bb17f539fa45f6865c616
Opcode Fuzzy Hash: 6f7c570eee18f5118f7e6d35882b386eefffcc09af04fd52d27d964cd9464c46
Instruction Fuzzy Hash: 55E18E71A4022DAFDF219FA0DC19BDDBB74FF06309F0002E5E509A6691EB715A84CF56

Function 6CC7ACA0 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 200
registrystringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 6CC7ACDE
wsprintfA.USER32 ref: 6CC7AD85
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC7ADB3
gethostname.WS2_32(?,00000100), ref: 6CC7ADC6
lstrlenA.KERNEL32(?), ref: 6CC7AE07
getsockname.WS2_32(?,?,?), ref: 6CC7AE2D
RegOpenKeyA.ADVAPI32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,?), ref: 6CC7AF27
RegQueryValueExA.KERNEL32(?,~MHz,00000000,?,?,?), ref: 6CC7AF47
RegCloseKey.ADVAPI32(?), ref: 6CC7AF51
capGetDriverDescriptionA.AVICAP32(00000000,?,00000064,?,00000032), ref: 6CC7AF9D

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 6CC7AF1D
f, xrefs: 6CC7ACC9
~MHz, xrefs: 6CC7AF3E

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: lstrlen$CloseDescriptionDriverOpenQueryValueVersiongethostnamegetsocknamewsprintf
String ID: HARDWARE\DESCRIPTION\System\CentralProcessor\0$f$~MHz
API String ID: 1222552428-1503542698
Opcode ID: 54e387eeba1f9ba72f50a414ff6636abd57051ed80a209bedf0615a41e2c4a82
Instruction ID: 0c21a2fd551b8989398d4d9362921789dd1ba0d05b011e7f341ae7215834efe1
Opcode Fuzzy Hash: 54e387eeba1f9ba72f50a414ff6636abd57051ed80a209bedf0615a41e2c4a82
Instruction Fuzzy Hash: 2C81C6719083859BD731CF64C805BDBBBF8BFD9308F005A1DE9C896251E770A299C7A2

Function 6CC71990 Relevance: 10.6, APIs: 7, Instructions: 83
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 6CC719F2
recv.WS2_32(?,?,00002000,00000000), ref: 6CC71A2B
setsockopt.WS2_32(?,0000FFFF,00000080,?), ref: 6CC71A72
CancelIo.KERNEL32(?), ref: 6CC71A7E
closesocket.WS2_32(?), ref: 6CC71A94
Sleep.KERNEL32(000001F4), ref: 6CC71A9F
SetEvent.KERNEL32(?), ref: 6CC71AAB

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CancelEventSleepclosesocketrecvselectsetsockopt
String ID:
API String ID: 2638994943-0
Opcode ID: cb587da964f17e06892b20a0a52742a4532ca91d6d63c3d7592b3dffcc592a24
Instruction ID: 8237db2bea81347576a66e8ba22cf6a6d0b83f023e347a6a3268c98fd5aef066
Opcode Fuzzy Hash: cb587da964f17e06892b20a0a52742a4532ca91d6d63c3d7592b3dffcc592a24
Instruction Fuzzy Hash: C6318171740304AFEF208F64CC99BD97B79EB05715F0042B5EE1D9A2D1DB709A88CB62

Function 6CC76510 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CC75E60: InitializeSecurityDescriptor.ADVAPI32(?,00000001,723C8B34,00000001,00000000), ref: 6CC75EB9
Part of subcall function 6CC75E60: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6CC75ED5
Part of subcall function 6CC75E60: GetLengthSid.ADVAPI32(00000000), ref: 6CC75EE2
Part of subcall function 6CC75E60: GetProcessHeap.KERNEL32(00000008,00000010), ref: 6CC75EEE
Part of subcall function 6CC75E60: HeapAlloc.KERNEL32(00000000), ref: 6CC75EF5
Part of subcall function 6CC75E60: InitializeAcl.ADVAPI32(00000000,00000010,00000002), ref: 6CC75F08
Part of subcall function 6CC75E60: AddAccessAllowedAce.ADVAPI32(00000000,00000002,10000000,00000000), ref: 6CC75F1D
Part of subcall function 6CC75E60: SetSecurityDescriptorDacl.ADVAPI32(00000001,00000001,00000000,00000000), ref: 6CC75F2E
Part of subcall function 6CC75E60: GetProcessHeap.KERNEL32(00000000,00000000), ref: 6CC75F57
Part of subcall function 6CC75E60: HeapFree.KERNEL32(00000000), ref: 6CC75F5E

CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000594,_kaspersky), ref: 6CC76568
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,?,?,00000000,?,?,?,6CC9FC58,0000000C), ref: 6CC76580
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,00000000,?,?,?,6CC9FC58,0000000C,6CC82B8F,?,00000001), ref: 6CC765A8
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,6CC9FC58,0000000C,6CC82B8F,?,00000001,?), ref: 6CC765AF

Strings

_kaspersky, xrefs: 6CC76548

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Heap$InitializeProcess$DescriptorFileFreeSecurity$AccessAllocAllocateAllowedCreateDaclLengthMappingView
String ID: _kaspersky
API String ID: 638404719-3603165263
Opcode ID: a753e06504bfbd547eea7f3da417c830405132db8b98fcd8b4352ef4ec411904
Instruction ID: 89f3ee35d634639dc992247550373dad0a1b08dc0d42c67c3bc5e44004fc58a6
Opcode Fuzzy Hash: a753e06504bfbd547eea7f3da417c830405132db8b98fcd8b4352ef4ec411904
Instruction Fuzzy Hash: C211ACB0648301AEEB109F648C0AB5B7BF8EB49310F104A19FA56C66C0FB70D508CAA6

Function 6CC8A4DE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d855c3a3bb8640d0055fdc0a002ca5b2e680863f2444cef30d335ddb72b0e97
Instruction ID: df7cc9017b64b07723069f52e1fa7a2eebffe13daa47d6e171d1da861ad7b26a
Opcode Fuzzy Hash: 0d855c3a3bb8640d0055fdc0a002ca5b2e680863f2444cef30d335ddb72b0e97
Instruction Fuzzy Hash: 63F0E532A16224EFCB12CB8CC405B9AB7BCEB45B69F150096F804DBA80E370DD40CBD0

Function 6CC746F0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 99
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(?,C:\syslog.dat), ref: 6CC74728
GetFileAttributesA.KERNEL32(?), ref: 6CC74735
Sleep.KERNEL32(00000064), ref: 6CC74758
GetTickCount.KERNEL32 ref: 6CC7478C
lstrcatA.KERNEL32(04EF000D,C:\syslog.dat), ref: 6CC747D0
GetFileAttributesA.KERNEL32(04EEFFF3), ref: 6CC747DF
SetWindowsHookExA.USER32(00000003,6CC762E0,00000000), ref: 6CC74809
Sleep.KERNEL32(00000064), ref: 6CC74832
UnhookWindowsHookEx.USER32(?), ref: 6CC7484B
UnmapViewOfFile.KERNEL32(04EF0000), ref: 6CC7485B
CloseHandle.KERNEL32 ref: 6CC74867

Strings

C:\syslog.dat, xrefs: 6CC74722, 6CC747CA

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: File$AttributesHookSleepWindowslstrcat$CloseCountHandleTickUnhookUnmapView
String ID: C:\syslog.dat
API String ID: 569646308-1513329526
Opcode ID: b474f7294a3b48065160122e7f3f51e31f86ce0831dbe2bc35958b89852596ec
Instruction ID: 85f436c437ba45117328ccfe26929499ae1a1f25c3079c2522b2add14646e144
Opcode Fuzzy Hash: b474f7294a3b48065160122e7f3f51e31f86ce0831dbe2bc35958b89852596ec
Instruction Fuzzy Hash: BF41E274A40644AFDB10EFE0EC1CB4A7BB8BB0A318F188658E55487681EB75D489CF69

Function 6CC71470 Relevance: 18.1, APIs: 12, Instructions: 142
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000), ref: 6CC714AF
CancelIo.KERNEL32(00000000), ref: 6CC714BB
closesocket.WS2_32(00000000), ref: 6CC714D1
Sleep.KERNEL32(000001F4), ref: 6CC714DC
SetEvent.KERNEL32(00000000), ref: 6CC714E8
ResetEvent.KERNEL32(00000000), ref: 6CC714FE
socket.WS2_32(00000002,00000001,00000006), ref: 6CC71524
gethostbyname.WS2_32(723C8B34), ref: 6CC7154A
htons.WS2_32(?), ref: 6CC7157B
connect.WS2_32(00000000,?,00000010), ref: 6CC7159E
setsockopt.WS2_32(00000000,0000FFFF,00000008,?,00000001), ref: 6CC715E3
WSAIoctl.WS2_32(00000000,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 6CC71622

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Eventsetsockopt$CancelIoctlResetSleepclosesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 2501742715-0
Opcode ID: 765002336f4515a6e403fb9c6adbcf1aa90a9d0f942fd5c93e3ce08e270572a4
Instruction ID: 026610769c6e2e9a934960aa34055a6ed8404e8a52b6955429dd1c1070e91f58
Opcode Fuzzy Hash: 765002336f4515a6e403fb9c6adbcf1aa90a9d0f942fd5c93e3ce08e270572a4
Instruction Fuzzy Hash: D951D371304700AFDB608F64C859B9BBBF4FF4A719F100619F5AA97690EB71D448CB62

Function 6CC767E0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 187
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 6CC7688E

Part of subcall function 6CC76AB0: RegCloseKey.ADVAPI32(80000002,6CC76A8C), ref: 6CC76ABC
Part of subcall function 6CC76AB0: RegCloseKey.ADVAPI32(?), ref: 6CC76AC4

Strings

Host, xrefs: 6CC768D8, 6CC7695A, 6CC76A07, 6CC76A54

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Close$Open
String ID: Host
API String ID: 2976201327-1863695555
Opcode ID: 9f230d03c3da411e7ab18ef23fb860e9431b92443fe7bd8bec472da3c58351e4
Instruction ID: 6fde80ecf80e9612373cbf67444a5f7f4cd1698a809919d4ea34d6ee2b1f402b
Opcode Fuzzy Hash: 9f230d03c3da411e7ab18ef23fb860e9431b92443fe7bd8bec472da3c58351e4
Instruction Fuzzy Hash: E8719F71D44629ABDF20DF65CC48BDEBBB8FB45308F1402E9E509E3650EB715A848FA4

Function 6CC71E10 Relevance: 16.8, APIs: 11, Instructions: 259
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(000000FF,00000001,00000000,?,00000001), ref: 6CC71E25

Part of subcall function 6CC72890: __floor_pentium4.LIBCMT ref: 6CC728DD

LeaveCriticalSection.KERNEL32(000000FF,00000400,?,00000001), ref: 6CC71E45
LeaveCriticalSection.KERNEL32(000000FF,6CC7B8A1,?,00000001), ref: 6CC71FD2
EnterCriticalSection.KERNEL32(?,?,00000001), ref: 6CC71FDE
LeaveCriticalSection.KERNEL32(?,00000400,?,00000001), ref: 6CC72004
EnterCriticalSection.KERNEL32(?,?,00000001), ref: 6CC7200D
LeaveCriticalSection.KERNEL32(00000001,?,?,00000001), ref: 6CC7203D
Sleep.KERNEL32(0000000A,?,00000001), ref: 6CC720CB
send.WS2_32(?,00000000,00000005,00000000,?,00000001), ref: 6CC720FA

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Sleep__floor_pentium4send
String ID:
API String ID: 2106924450-0
Opcode ID: f9888e90617e1d127da120ce369ee31177dd34ce9aee43701110cbccf9cb0007
Instruction ID: 314026718db5489307b707918b9cfc172dc18cc9ef47ad88d6c95927e2f98cf8
Opcode Fuzzy Hash: f9888e90617e1d127da120ce369ee31177dd34ce9aee43701110cbccf9cb0007
Instruction Fuzzy Hash: 13919E71A01205EBDF15DF78C898B9A7BB8FF45318F048169ED18DB646EB30E905CBA1

Function 6CC71AE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CC71D90: setsockopt.WS2_32(?,0000FFFF,00000080,6CC74311,00000004), ref: 6CC71DB4
Part of subcall function 6CC71D90: CancelIo.KERNEL32(?,?,6CC713C0), ref: 6CC71DC0
Part of subcall function 6CC71D90: closesocket.WS2_32(?), ref: 6CC71DD6
Part of subcall function 6CC71D90: Sleep.KERNEL32(000001F4,?,6CC713C0), ref: 6CC71DE1
Part of subcall function 6CC71D90: SetEvent.KERNEL32(?,?,6CC713C0), ref: 6CC71DED

Part of subcall function 6CC71E10: EnterCriticalSection.KERNEL32(000000FF,00000001,00000000,?,00000001), ref: 6CC71E25
Part of subcall function 6CC71E10: LeaveCriticalSection.KERNEL32(000000FF,00000400,?,00000001), ref: 6CC71E45

Part of subcall function 6CC726A0: EnterCriticalSection.KERNEL32(000000FF,00000000,00000000,?,?,?,6CC71ED9,?,00000005,00000000,?,00000000,00000001,?,00000001), ref: 6CC726AD
Part of subcall function 6CC726A0: LeaveCriticalSection.KERNEL32(000000FF,6CC7B8A6,?,6CC71ED9,?,00000005,00000000,?,00000000,00000001,?,00000001), ref: 6CC726D6

EnterCriticalSection.KERNEL32(?,00000000,?,00000000,?,00000000,?,?,?), ref: 6CC71C87
LeaveCriticalSection.KERNEL32(?,00000400,?,?), ref: 6CC71CA1
EnterCriticalSection.KERNEL32(?,?,?), ref: 6CC71CAE
LeaveCriticalSection.KERNEL32(?,00000000,?,?), ref: 6CC71CED

Strings

bad Allocate, xrefs: 6CC71D67
bad buffer, xrefs: 6CC71D52, 6CC71D7C

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CancelEventSleepclosesocketsetsockopt
String ID: bad Allocate$bad buffer
API String ID: 1737891923-2913219628
Opcode ID: f0c03c8efb970958c0f86fa1f41280022fa047af6668f3d2f3036c497404c9a6
Instruction ID: 5980b92b43f1832edb5ba776d7d0a652dc3afc7296af4b1875c476c7a0f41d26
Opcode Fuzzy Hash: f0c03c8efb970958c0f86fa1f41280022fa047af6668f3d2f3036c497404c9a6
Instruction Fuzzy Hash: 037182B1A016059FCB21DFA9C9A4ADEBBF9FF48314F104519E45AE3B50FB34E9048B61

Function 6CC7B9E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 84
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6CC7BA13
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC7BA3C
CloseHandle.KERNEL32(?), ref: 6CC7BA47
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6CC7BA96
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC7BABB
CloseHandle.KERNEL32(?), ref: 6CC7BAC0
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 6CC7BAC5
CloseHandle.KERNEL32(00000000), ref: 6CC7BAC8

Strings

82.157.76.20, xrefs: 6CC7BA8C

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CloseHandleObjectSingleWait$CreateEvent
String ID: 82.157.76.20
API String ID: 3556256739-3546086885
Opcode ID: 578ba445f7742f428bd41f563034240b880916efb332613f2a683b8a0eb54b76
Instruction ID: 5eb6be158bc22e326b35d40574d7d76502efe2bd071e45974c24b1bd602d0f1b
Opcode Fuzzy Hash: 578ba445f7742f428bd41f563034240b880916efb332613f2a683b8a0eb54b76
Instruction Fuzzy Hash: 3131B131A4420CBADF10AFA48C16FAEBB70EF01714F200299E5107B2D0EB715A05CBA9

Function 6CC7BBE0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 53
registrysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegDeleteKeyA.ADVAPI32(80000001,?), ref: 6CC7BC7C
OutputDebugStringA.KERNEL32(?), ref: 6CC7BC85
RegDeleteKeyA.ADVAPI32(80000001,?), ref: 6CC7BC93
OutputDebugStringA.KERNEL32(?), ref: 6CC7BC9C
Sleep.KERNEL32(00007530), ref: 6CC7BCA3

Strings

Software\Wow6432Node\Microsoft\Active Setup\Installed Components\, xrefs: 6CC7BC3C
{0A0C703D-13D0-411b-8686-2D5797D51D86}, xrefs: 6CC7BC1C, 6CC7BC37
Software\Microsoft\Active Setup\Installed Components\, xrefs: 6CC7BC21
%s%s, xrefs: 6CC7BC2C, 6CC7BC47

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: DebugDeleteOutputString$Sleep
String ID: %s%s$Software\Microsoft\Active Setup\Installed Components\$Software\Wow6432Node\Microsoft\Active Setup\Installed Components\${0A0C703D-13D0-411b-8686-2D5797D51D86}
API String ID: 3484094991-60903826
Opcode ID: 222db7beaaf3a068884728ca93e9cfbbdd7c52df852b6b492ce8a59a9735b05b
Instruction ID: 67dd3ea7bca952c8c4ac2e00814438cb4a33bc52fe303856b312e17a58154fba
Opcode Fuzzy Hash: 222db7beaaf3a068884728ca93e9cfbbdd7c52df852b6b492ce8a59a9735b05b
Instruction Fuzzy Hash: 84115EF594021CBAEB20DBA0CD48FDA77BCEB04308F401495A708F3541FA34AA49CBE9

Function 6CC8A051 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

api-ms-, xrefs: 6CC8A0A8
ext-ms-, xrefs: 6CC8A0BC

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 2f0e24d4ab85ee75403964142a3c6e7c44f3f51828a2eca1a08e3206f5714966
Instruction ID: 8882c71efcbd922eedd0e0bc88041d6ad08814c687b1bcd2b3928bea85efcce9
Opcode Fuzzy Hash: 2f0e24d4ab85ee75403964142a3c6e7c44f3f51828a2eca1a08e3206f5714966
Instruction Fuzzy Hash: EC21A832B47615EBDB218A6A8C40A4B7F78AB8776DF250710EC16E7AD0FB31DD0195D0

Function 6CC711C0 Relevance: 9.1, APIs: 6, Instructions: 105
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(6CCA3E64,723C8B34,?,6CCA3E50), ref: 6CC71225
InitializeCriticalSection.KERNEL32(6CCA3E8C), ref: 6CC7124E
InitializeCriticalSection.KERNEL32(6CCA3EB4), ref: 6CC71270
InitializeCriticalSection.KERNEL32(6CCA3EDC), ref: 6CC7129E
WSAStartup.WS2_32(00000202,?), ref: 6CC712B0
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6CC712BE

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CriticalInitializeSection$CreateEventStartup
String ID:
API String ID: 3361264690-0
Opcode ID: c4e87103fa6778d49b96d5b89d630ce4a75f055c0e6dd7241bea32db81b860c4
Instruction ID: 611121a3570094192bdf58cbce939e8c66926c557e415bff773dc8eeec12f202
Opcode Fuzzy Hash: c4e87103fa6778d49b96d5b89d630ce4a75f055c0e6dd7241bea32db81b860c4
Instruction Fuzzy Hash: 20415BB1604B46AFE710CF64C859B8AFBF8FF06304F108259D45997B80E7B5A518CBE2

Function 6CC727B0 Relevance: 4.6, APIs: 3, Instructions: 79
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__floor_pentium4.LIBCMT ref: 6CC727FD
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004), ref: 6CC72825

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: AllocVirtual__floor_pentium4
String ID:
API String ID: 4174053956-0
Opcode ID: b837fcfb6f0b0e8b50a07148eafc9c4d3e2dde1371cb2cea7753d9b9c29bc215
Instruction ID: 7d75179accdd2b952ea594d9daed3db1f5b7b559b06af1aaf90d3e9b5edca262
Opcode Fuzzy Hash: b837fcfb6f0b0e8b50a07148eafc9c4d3e2dde1371cb2cea7753d9b9c29bc215
Instruction Fuzzy Hash: 6F21D372604B049AD320DE39EC45A57B7F8EF513A5F00472EF955D6650FB31D4508691

Function 6CC72890 Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__floor_pentium4.LIBCMT ref: 6CC728DD
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 6CC72913
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 6CC72944

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: a4d6922b2dac5b700f4aa4de606d1f522316e672d545b908df32a9c4e7ab3e26
Instruction ID: 3e31894aa0fa1819cf371c968da7a9ad109779ebc7754555f338b07ee88913e3
Opcode Fuzzy Hash: a4d6922b2dac5b700f4aa4de606d1f522316e672d545b908df32a9c4e7ab3e26
Instruction Fuzzy Hash: BB21C532704B049FE321DE39DC55A17F7F8EF85765F00862EF98A96650FB31E8508691

Function 6CC86CBF Relevance: 4.6, APIs: 3, Instructions: 51threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,6CC86B61,00000000,00000000,00000000), ref: 6CC86D08
GetLastError.KERNEL32(?,?,?,6CC79C50,00000000,00000000), ref: 6CC86D14
__dosmaperr.LIBCMT ref: 6CC86D1B

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 2cce75cfc3b32564df8f1356ad7b55e960b91502802bea14ce7e96ec1a64ad25
Instruction ID: f7cd1bb0ea8ff21397f2032c9f9d87711f73162c846713b2ffcbf8d977a13c41
Opcode Fuzzy Hash: 2cce75cfc3b32564df8f1356ad7b55e960b91502802bea14ce7e96ec1a64ad25
Instruction Fuzzy Hash: F6016D32926909ABDF058FA1C805ADF7F79EF0171DF100199E800D7650FB319910D7A0

Function 6CC79C10 Relevance: 4.5, APIs: 3, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,6CCA3E50,?,?,?,6CC7163F,6CC71990,6CCA3E50,6CCA3E50), ref: 6CC79C31
WaitForSingleObject.KERNEL32(6CC71990,000000FF,?,?,?,?,?,?,?,?,?,6CC7163F,6CC71990,6CCA3E50,6CCA3E50), ref: 6CC79C5A
CloseHandle.KERNEL32(6CC71990,?,?,?,?,?,?,?,?,?,6CC7163F,6CC71990,6CCA3E50,6CCA3E50), ref: 6CC79C63

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CloseCreateEventHandleObjectSingleWait
String ID:
API String ID: 2631291778-0
Opcode ID: 436b9ca04781ec9b5ceebb2056b1f7b11731dc7721841f1cc5d70a05208ddd08
Instruction ID: 8121605547adb113d32f18133b0be177a688c31bcbb881baf8102429b7a4194b
Opcode Fuzzy Hash: 436b9ca04781ec9b5ceebb2056b1f7b11731dc7721841f1cc5d70a05208ddd08
Instruction Fuzzy Hash: F8F01D31B44208BBDB109FA88C16FDE7FB4EB05711F500295FA14AA2D0E6715A548BD5

Function 6CC79BA0 Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 6CC79BBE
OpenInputDesktop.USER32(00000000,00000000,400001CF), ref: 6CC79BDF

Part of subcall function 6CC79DF0: GetCurrentThreadId.KERNEL32 ref: 6CC79E07
Part of subcall function 6CC79DF0: GetThreadDesktop.USER32(00000000,?,00000000), ref: 6CC79E0E
Part of subcall function 6CC79DF0: GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 6CC79E2C
Part of subcall function 6CC79DF0: SetThreadDesktop.USER32(00000000,?,00000000), ref: 6CC79E37
Part of subcall function 6CC79DF0: CloseDesktop.USER32(00000000,?,00000000), ref: 6CC79E42

CloseDesktop.USER32(00000000), ref: 6CC79BF7

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Desktop$Thread$Close$CurrentEventInformationInputObjectOpenUser
String ID:
API String ID: 1746679635-0
Opcode ID: 4890b90e7e1d83a5c219581b55f6c45f6291a9a92981b492d47450850ac308bc
Instruction ID: d7223f927003cb1c9015678f1bac22d902c6c8caf94a02c9b64238798ebccb60
Opcode Fuzzy Hash: 4890b90e7e1d83a5c219581b55f6c45f6291a9a92981b492d47450850ac308bc
Instruction Fuzzy Hash: 60F0F031E05A1CA7DF221BA8CD09BEEBB35EF5A20AF008300FD5576201FF30A5C082A1

Function 6CC72710 Relevance: 3.8, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CC71C0A,?,00000005,?,6CC71A44,723C8B34,?,00000001,?), ref: 6CC7271D
LeaveCriticalSection.KERNEL32(?,?,6CC71C0A,?,00000005,?,6CC71A44,723C8B34,?,00000001,?), ref: 6CC7272C
LeaveCriticalSection.KERNEL32(?,?,?,6CC71C0A,?,00000005,?,6CC71A44,723C8B34,?,00000001,?), ref: 6CC727A0

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 47ee9cd08e59de52ffef73b37da500bf02d7ec97ad84e34e6a36e5ed02cbb851
Instruction ID: 1159a86ba5bf3d6fc5ce13a61274b2891ffd5b25e2176633a97ba5f5927aebae
Opcode Fuzzy Hash: 47ee9cd08e59de52ffef73b37da500bf02d7ec97ad84e34e6a36e5ed02cbb851
Instruction Fuzzy Hash: BC119072605512AF97149A7ADDA886BFB6CFF01369300472AE82AD7900FB25F81087E0

Function 6CC726A0 Relevance: 3.8, APIs: 3, Instructions: 48COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000000FF,00000000,00000000,?,?,?,6CC71ED9,?,00000005,00000000,?,00000000,00000001,?,00000001), ref: 6CC726AD
LeaveCriticalSection.KERNEL32(000000FF,6CC7B8A6,?,6CC71ED9,?,00000005,00000000,?,00000000,00000001,?,00000001), ref: 6CC726D6
LeaveCriticalSection.KERNEL32(000000FF,?,00000000,00000001,?,00000001), ref: 6CC726F9

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 5ae43c56acbb0e8cfdf647f884811e8073a43dd685c6cfa6301353436bd2e182
Instruction ID: dac6c1d9f788aed433c7a65d603942bc054299fefbe11b722fb75fd0e3f1dd57
Opcode Fuzzy Hash: 5ae43c56acbb0e8cfdf647f884811e8073a43dd685c6cfa6301353436bd2e182
Instruction Fuzzy Hash: 99F0F433709601AFD7209E29EC888ABB7BCFB46339300462FF415C2600E771E8049670

Function 6CC8B8DD Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6CC8B90B
_free.LIBCMT ref: 6CC8B931

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 82528e9d5438d1a0cea0263868d3c1d5441d1d04de667d5fbf5d592db90e2480
Instruction ID: cd7b015bc6be82ec40e35a88d0db004a1f6c0d5bc29f9391c64e84c1fbac64ab
Opcode Fuzzy Hash: 82528e9d5438d1a0cea0263868d3c1d5441d1d04de667d5fbf5d592db90e2480
Instruction Fuzzy Hash: 81118171B062115FDB218F6AAC69B4B7EB8A741B3CF180625E625CBEC0F370C8864651

Function 6CC8A11A Relevance: 3.1, APIs: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc1f7a32e16dc48993d19978e7e7309bb7f1ec77dcb5e05460a34465a76e06d
Instruction ID: 46d14607c1bcf385815baef74d620139ac5ba138d056c0d05987b5b60de08390
Opcode Fuzzy Hash: adc1f7a32e16dc48993d19978e7e7309bb7f1ec77dcb5e05460a34465a76e06d
Instruction Fuzzy Hash: 4601F5333026259FAF168D6EDC5894B3BB6ABC23287244120F918CB5D8FB30D401C791

Function 6CC86B61 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(6CC9FEC0,0000000C), ref: 6CC86B74
ExitThread.KERNEL32 ref: 6CC86B7B

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: b39cef58a8ef7ea8366d23c67a21525c3f8e82796c7133ba9a31b80df360a37e
Instruction ID: 45d21f4075c9e72eaacad86aae974d2c5780555d774fb800a5c86f54ad71462f
Opcode Fuzzy Hash: b39cef58a8ef7ea8366d23c67a21525c3f8e82796c7133ba9a31b80df360a37e
Instruction Fuzzy Hash: 74F08C70A12604AFDB009FB0C409AAF3F74EF41B1AF100249F00197B91EB349905DBA1

Function 6CC89FA6 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6CC89D78,00000001,00000364,00000007,000000FF,?,?,6CC89EA6,6CC8987C,?,?,6CC89200), ref: 6CC89FE7

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b8e8eb4a68b44e7ceb6db7f50ceb91dbc8505383b331dabb7cb06025629c56a7
Instruction ID: 11ee716aec9d9902631db5c18252eac49b8e9140b0be762cc030ff89226e1ba2
Opcode Fuzzy Hash: b8e8eb4a68b44e7ceb6db7f50ceb91dbc8505383b331dabb7cb06025629c56a7
Instruction Fuzzy Hash: EBF0E93124B12566EB151F779804B8F7F68BF427ADB248121EC19E7AD0FF70D90086E0

Function 6CC89808 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6CC8CBE6,00000220,00000104,?,?,?,?,?,00000104,6CCA3E50,?,00000104), ref: 6CC8983A

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 16628abd85a9dda6c5a44a6858222c1a623ae673ae042cbc8ce383b3c9c10a66
Instruction ID: 0074570e8ba7a8018917aa44b4870ef9707b83c8f88e2a4fc8df7a7dab2e9f4b
Opcode Fuzzy Hash: 16628abd85a9dda6c5a44a6858222c1a623ae673ae042cbc8ce383b3c9c10a66
Instruction Fuzzy Hash: 19E065216472135AEB111BAB4C04B8B7E6DAF427ACF514121AC14D7EC0FB20C800C5E1

Function 6CC7B680 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6CC7B694

Part of subcall function 6CC76510: CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000594,_kaspersky), ref: 6CC76568
Part of subcall function 6CC76510: MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,?,?,00000000,?,?,?,6CC9FC58,0000000C), ref: 6CC76580
Part of subcall function 6CC76510: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,00000000,?,?,?,6CC9FC58,0000000C,6CC82B8F,?,00000001), ref: 6CC765A8
Part of subcall function 6CC76510: HeapFree.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,6CC9FC58,0000000C,6CC82B8F,?,00000001,?), ref: 6CC765AF

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: FileHeap$CountCreateFreeMappingProcessTickView
String ID:
API String ID: 3397403089-0
Opcode ID: 3fac2c5c03e0bdaeb7fdd809f66c292e40e2ec17e9e135ed149ca89e414be7f2
Instruction ID: 895c0b999c5bc5286ae2bba90c4bc917080895dc9880b65bf3b8dc74c72671ef
Opcode Fuzzy Hash: 3fac2c5c03e0bdaeb7fdd809f66c292e40e2ec17e9e135ed149ca89e414be7f2
Instruction Fuzzy Hash: D6D0C971A617489BCF10EFB8D59894DB7B8FB19765B104915F805CB700EB35E4808B60

Function 6CC86449 Relevance: 1.5, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6CC8645C

Part of subcall function 6CC89856: RtlFreeHeap.NTDLL(00000000,00000000,?,6CC89200), ref: 6CC8986C
Part of subcall function 6CC89856: GetLastError.KERNEL32(?,?,6CC89200), ref: 6CC8987E

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: 418d14a3ca0fa6ed5da8482c5d2d9145b4a764cbc06fce9bfdacf0a524838a42
Instruction ID: 20431f2f857819e418a9b3b8231f126eafb91f72ea5839ad00af5804391cd29a
Opcode Fuzzy Hash: 418d14a3ca0fa6ed5da8482c5d2d9145b4a764cbc06fce9bfdacf0a524838a42
Instruction Fuzzy Hash: EEC08C3140520CBBCB10CF86E806A9EBFA8DB80328F200198FC0C07700EB72AE1496C4

Non-executed Functions

Function 6CC75450 Relevance: 78.9, APIs: 30, Strings: 15, Instructions: 196libraryloaderstringCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 6CC75475
OpenProcessToken.ADVAPI32(00000000), ref: 6CC7547C
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 6CC75494
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 6CC754D0
CloseHandle.KERNEL32(?), ref: 6CC754DC
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 6CC754EF
LoadLibraryA.KERNEL32(advapi32.dll), ref: 6CC75524
GetProcAddress.KERNEL32(00000000,OpenSCManagerA), ref: 6CC75534
GetProcAddress.KERNEL32(00000000,OpenServiceA), ref: 6CC75542
GetProcAddress.KERNEL32(00000000,QueryServiceStatus), ref: 6CC75550
GetProcAddress.KERNEL32(00000000,ControlService), ref: 6CC7555E
GetProcAddress.KERNEL32(00000000,StartServiceA), ref: 6CC7556C
GetProcAddress.KERNEL32(00000000,DeleteService), ref: 6CC7557A
GetProcAddress.KERNEL32(00000000,CloseServiceHandle), ref: 6CC75588
FreeLibrary.KERNEL32(00000000), ref: 6CC75597
LoadLibraryA.KERNEL32(shlwapi.dll), ref: 6CC7559E
GetProcAddress.KERNEL32(00000000,SHDeleteKeyA), ref: 6CC755A8
FreeLibrary.KERNEL32(00000000), ref: 6CC755B5
LoadLibraryA.KERNEL32(kernel32.dll), ref: 6CC755BC
GetProcAddress.KERNEL32(00000000,Sleep), ref: 6CC755CC
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 6CC755DA
FreeLibrary.KERNEL32(00000000), ref: 6CC755E3
lstrcpyA.KERNEL32(?,?), ref: 6CC755F8
lstrcpyA.KERNEL32(?,SYSTEM\CurrentControlSet\Services\), ref: 6CC75603
lstrcatA.KERNEL32(?,?), ref: 6CC75610
VirtualAllocEx.KERNEL32(?,00000000,000000F4,00001000,00000004), ref: 6CC75631
WriteProcessMemory.KERNEL32(?,00000000,?,000000F4,00000000), ref: 6CC75653
VirtualAllocEx.KERNEL32(?,00000000,00002800,00001000,00000040), ref: 6CC75668
WriteProcessMemory.KERNEL32(?,00000000,Function_00005390,00002800,00000000), ref: 6CC7567E
CreateRemoteThread.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000), ref: 6CC75694

Strings

shlwapi.dll, xrefs: 6CC75599
OpenServiceA, xrefs: 6CC75536
OpenSCManagerA, xrefs: 6CC7552E
advapi32.dll, xrefs: 6CC7551F
Sleep, xrefs: 6CC755C6
CloseServiceHandle, xrefs: 6CC7557C
SeDebugPrivilege, xrefs: 6CC7548D
ControlService, xrefs: 6CC75552
kernel32.dll, xrefs: 6CC755B7
CloseHandle, xrefs: 6CC755CE
StartServiceA, xrefs: 6CC75560
DeleteService, xrefs: 6CC7556E
SHDeleteKeyA, xrefs: 6CC755A2
QueryServiceStatus, xrefs: 6CC75544
SYSTEM\CurrentControlSet\Services\, xrefs: 6CC755FA

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: AddressProc$Library$Process$FreeLoad$AllocMemoryOpenTokenVirtualWritelstrcpy$AdjustCloseCreateCurrentHandleLookupPrivilegePrivilegesRemoteThreadValuelstrcat
String ID: CloseHandle$CloseServiceHandle$ControlService$DeleteService$OpenSCManagerA$OpenServiceA$QueryServiceStatus$SHDeleteKeyA$SYSTEM\CurrentControlSet\Services\$SeDebugPrivilege$Sleep$StartServiceA$advapi32.dll$kernel32.dll$shlwapi.dll
API String ID: 4155025899-3802087837
Opcode ID: ee8445fbbc7a2dacbb8ed57c188d0aa4f7cfd508392fd02665168aa0f57223af
Instruction ID: f11b222062e04bd6f5cd08c14d7586fa8b8ae2240201c2c10ec40d76fc71fee6
Opcode Fuzzy Hash: ee8445fbbc7a2dacbb8ed57c188d0aa4f7cfd508392fd02665168aa0f57223af
Instruction Fuzzy Hash: 04516271E412197BEF20AFA58C45FEE7BB8EF49701F104595F604B7680EA7099408FE5

Function 6CC795D0 Relevance: 73.8, APIs: 39, Strings: 3, Instructions: 296stringmemoryprocessCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 6CC7961F
OpenProcessToken.ADVAPI32(00000000), ref: 6CC79626
LookupPrivilegeValueA.ADVAPI32 ref: 6CC7965B
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,00000000,SeDebugPrivilege,?), ref: 6CC79675
GetLastError.KERNEL32(?,?,?,00000000,SeDebugPrivilege,?), ref: 6CC7967B
CloseHandle.KERNEL32(?,?,?,?,00000000,SeDebugPrivilege,?), ref: 6CC79685
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 6CC7968B
LocalAlloc.KERNEL32 ref: 6CC796C2
Process32First.KERNEL32(00000000,?), ref: 6CC796DF
OpenProcess.KERNEL32(00000410,00000000,00000128), ref: 6CC7970B
OpenProcess.KERNEL32 ref: 6CC7973B
K32GetProcessImageFileNameA.KERNEL32(00000000,?,00000104), ref: 6CC79757
GetLogicalDriveStringsA.KERNEL32(000001F4,?), ref: 6CC79772
lstrcmpiA.KERNEL32(00000000,A:\), ref: 6CC7979B
lstrcmpiA.KERNEL32(00000000,B:\), ref: 6CC797A7
QueryDosDeviceA.KERNEL32(?,?,00000064), ref: 6CC797D0
lstrlenA.KERNEL32(?), ref: 6CC797E2
__fassign.LIBCMT ref: 6CC797F7
lstrcpyA.KERNEL32(?,?), ref: 6CC79825
CloseHandle.KERNEL32(?), ref: 6CC7982F
lstrlenA.KERNEL32(?), ref: 6CC79840
lstrlenA.KERNEL32(?), ref: 6CC7984C
LocalSize.KERNEL32(?), ref: 6CC7985D
LocalReAlloc.KERNEL32(?,?,00000042), ref: 6CC7986E
lstrcpyA.KERNEL32(?,?,?,00000040,00000400), ref: 6CC79889
lstrcatA.KERNEL32(?,?,?,00000040,00000400), ref: 6CC798A1
lstrlenA.KERNEL32(?), ref: 6CC798C4
lstrlenA.KERNEL32(?,?,00000040,00000400), ref: 6CC798E1
lstrlenA.KERNEL32(?,?,00000040,00000400), ref: 6CC798F2
lstrlenA.KERNEL32(?,?,?,?,?,00000040,00000400), ref: 6CC79915
Process32Next.KERNEL32(?,?), ref: 6CC7992D
LocalReAlloc.KERNEL32(00000000,?,00000042), ref: 6CC79950
GetCurrentProcess.KERNEL32(00000028,?), ref: 6CC7995F
OpenProcessToken.ADVAPI32(00000000), ref: 6CC79966
LookupPrivilegeValueA.ADVAPI32 ref: 6CC79995
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,00000000,SeDebugPrivilege,?), ref: 6CC799AF
GetLastError.KERNEL32(?,?,?,00000000,SeDebugPrivilege,?), ref: 6CC799B5
CloseHandle.KERNEL32(?,?,?,?,00000000,SeDebugPrivilege,?), ref: 6CC799BF
CloseHandle.KERNEL32(00000000), ref: 6CC799C2

Strings

B:\, xrefs: 6CC797A1
A:\, xrefs: 6CC79795
SeDebugPrivilege, xrefs: 6CC79649, 6CC79983

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Processlstrlen$CloseHandleLocalOpenToken$Alloc$AdjustCurrentErrorLastLookupPrivilegePrivilegesProcess32Valuelstrcmpilstrcpy$CreateDeviceDriveFileFirstImageLogicalNameNextQuerySizeSnapshotStringsToolhelp32__fassignlstrcat
String ID: A:\$B:\$SeDebugPrivilege
API String ID: 1339621458-3412982535
Opcode ID: d552812eb20cdfc14590198fbff86622316011d18373eec98895d63285b598e4
Instruction ID: bd8844b675dc681b07ec91fc9a1a5a65669caacf67b03efd9595d1198320aa60
Opcode Fuzzy Hash: d552812eb20cdfc14590198fbff86622316011d18373eec98895d63285b598e4
Instruction Fuzzy Hash: 74B14F71609344AFE720DF64CC49F9BBBF8EB89715F04491AFA89D6280E774D504CBA2

Function 6CC78680 Relevance: 63.3, APIs: 34, Strings: 2, Instructions: 320memorystringserviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 6CC786DA
OutputDebugStringA.KERNEL32(OpenSCManager Error), ref: 6CC786F1
LocalAlloc.KERNEL32(00000040,00010000), ref: 6CC78717
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,00010000,00000000,?,00000000), ref: 6CC7873B
LocalAlloc.KERNEL32(00000040,00000104), ref: 6CC78748
OpenServiceA.ADVAPI32(?,00000000,000F01FF), ref: 6CC78797
LocalAlloc.KERNEL32(00000040,00001000), ref: 6CC787B3
QueryServiceConfigA.ADVAPI32(00000000,00000000,00001000,00000000), ref: 6CC787CD
lstrcatA.KERNEL32(?,6CC9E5AC), ref: 6CC7880A
lstrcatA.KERNEL32(?,6CC9E5B4), ref: 6CC78840
lstrcatA.KERNEL32(?,6CC9E5BC), ref: 6CC78870

Strings

OpenSCManager Error, xrefs: 6CC786EC
No Access, xrefs: 6CC788C8, 6CC789FA, 6CC78A03, 6CC78A16

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: AllocLocallstrcat$OpenService$ConfigDebugEnumManagerOutputQueryServicesStatusString
String ID: No Access$OpenSCManager Error
API String ID: 2183027503-3614586894
Opcode ID: 572977b16b6a53969ab44a64dbb0b2dde3fb3617db866dcf53999fb5830000a3
Instruction ID: 7d02e9e61abeb56c8f74fc4c21bc05b33b33991945e2a65b0b3705417922709d
Opcode Fuzzy Hash: 572977b16b6a53969ab44a64dbb0b2dde3fb3617db866dcf53999fb5830000a3
Instruction Fuzzy Hash: FCC15EB5D40228ABDB20EF60DC89FDA7BB8EF14314F0441D5E609E7241EB749A84CF91

Function 6CC79310 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 190sleepwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC79D00: GetCurrentThreadId.KERNEL32 ref: 6CC79D18
Part of subcall function 6CC79D00: GetThreadDesktop.USER32(00000000), ref: 6CC79D1F
Part of subcall function 6CC79D00: GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 6CC79D5E
Part of subcall function 6CC79D00: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 6CC79D67
Part of subcall function 6CC79D00: GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 6CC79D9A
Part of subcall function 6CC79D00: lstrcmpiA.KERNEL32(?,?), ref: 6CC79DAA
Part of subcall function 6CC79D00: SetThreadDesktop.USER32(00000000), ref: 6CC79DB5
Part of subcall function 6CC79D00: CloseDesktop.USER32(?), ref: 6CC79DCC
Part of subcall function 6CC79D00: CloseDesktop.USER32(00000000), ref: 6CC79DCF

LocalSize.KERNEL32(00000000), ref: 6CC7935F
LocalFree.KERNEL32(00000000,00000000,00000000), ref: 6CC7936F
GetCurrentProcess.KERNEL32(00000028,?), ref: 6CC793AB
OpenProcessToken.ADVAPI32(00000000), ref: 6CC793B2
LookupPrivilegeValueA.ADVAPI32 ref: 6CC793DE
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,00000000,SeDebugPrivilege,?), ref: 6CC793F5
GetLastError.KERNEL32(?,?,?,00000000,SeDebugPrivilege,?), ref: 6CC793FB
CloseHandle.KERNEL32(?,?,?,?,00000000,SeDebugPrivilege,?), ref: 6CC79405
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 6CC7942A
TerminateProcess.KERNEL32(00000000,00000000), ref: 6CC79435
CloseHandle.KERNEL32(00000000), ref: 6CC79442
GetCurrentProcess.KERNEL32(00000028,?), ref: 6CC7945A
OpenProcessToken.ADVAPI32(00000000), ref: 6CC79461
LookupPrivilegeValueA.ADVAPI32 ref: 6CC79487
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,00000000,SeDebugPrivilege,?), ref: 6CC7949E
GetLastError.KERNEL32(?,?,?,00000000,SeDebugPrivilege,?), ref: 6CC794A4
CloseHandle.KERNEL32(?,?,?,?,00000000,SeDebugPrivilege,?), ref: 6CC794AE
Sleep.KERNEL32(00000064), ref: 6CC794B2
LocalSize.KERNEL32(00000000), ref: 6CC794C4
LocalFree.KERNEL32(00000000,00000000,00000000), ref: 6CC794D8
EnumWindows.USER32(6CC799E0,?), ref: 6CC794F6
PostMessageA.USER32(?,00000010,00000000,00000000), ref: 6CC7952B
ShowWindow.USER32(?,?,?,?,?,00000000,SeDebugPrivilege,?), ref: 6CC7954B

Strings

SeDebugPrivilege, xrefs: 6CC793CF, 6CC79478

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Process$CloseDesktop$LocalOpenToken$CurrentHandleThread$AdjustErrorFreeInformationLastLookupObjectPrivilegePrivilegesSizeUserValue$EnumInputMessagePostShowSleepTerminateWindowWindowslstrcmpi
String ID: SeDebugPrivilege
API String ID: 3804950894-2896544425
Opcode ID: 15c43c180ef193afb11e50d48dcd25252a910ad4c03caa590b62b46666b12ce0
Instruction ID: a02f597a4df3cb0d4714086a35e4897154c051d840c3b5c4f1955c2fb869225a
Opcode Fuzzy Hash: 15c43c180ef193afb11e50d48dcd25252a910ad4c03caa590b62b46666b12ce0
Instruction Fuzzy Hash: 2561B032305210AFDB109F64CC49BAEBBB8FF89316F00461AF945D6690EB74D915CBA3

Function 6CC78B30 Relevance: 40.7, APIs: 27, Instructions: 171servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 6CC78B68
OpenServiceA.ADVAPI32(00000000,?,000F01FF), ref: 6CC78B7B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 6CC78B92
CloseServiceHandle.ADVAPI32(00000000), ref: 6CC78B99
CloseServiceHandle.ADVAPI32(00000000), ref: 6CC78B9C
Sleep.KERNEL32(000001F4), ref: 6CC78BA6
LocalSize.KERNEL32(00000000), ref: 6CC78BBC
OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 6CC78BCF
OpenServiceA.ADVAPI32(00000000,75A90460,000F01FF), ref: 6CC78BE2
ControlService.ADVAPI32(00000000,00000001,?), ref: 6CC78BFB
CloseServiceHandle.ADVAPI32(00000000), ref: 6CC78C02
CloseServiceHandle.ADVAPI32(00000000), ref: 6CC78C05
Sleep.KERNEL32(000001F4), ref: 6CC78C0F
LocalSize.KERNEL32(00000000), ref: 6CC78C25
OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 6CC78C38
OpenServiceA.ADVAPI32(00000000,75A90460,000F01FF), ref: 6CC78C4F
LockServiceDatabase.ADVAPI32(00000000), ref: 6CC78C5C
OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 6CC78C7C
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF), ref: 6CC78C8F
LockServiceDatabase.ADVAPI32(00000000), ref: 6CC78C9C
ChangeServiceConfigA.ADVAPI32(00000000,000000FF,00000002,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6CC78CB9
UnlockServiceDatabase.ADVAPI32(00000000), ref: 6CC78CC0
CloseServiceHandle.ADVAPI32(00000000), ref: 6CC78CC7
CloseServiceHandle.ADVAPI32(00000000), ref: 6CC78CCE
Sleep.KERNEL32(000001F4), ref: 6CC78CD9
LocalSize.KERNEL32(00000000), ref: 6CC78CEB
LocalFree.KERNEL32(00000000,00000000,00000000), ref: 6CC78CFC

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Service$Open$CloseHandle$LocalManager$DatabaseSizeSleep$Lock$ChangeConfigControlFreeStartUnlock
String ID:
API String ID: 795175118-0
Opcode ID: 489e4d7b5fca8a48ae95011dcbdee2b1d62fd2f0a8a5fe9e1ccb0f7c18dc10e0
Instruction ID: d6c5373d1dc681bb767a5eaa5daccbd089969ebe644eba0c1863a0e0d39d0800
Opcode Fuzzy Hash: 489e4d7b5fca8a48ae95011dcbdee2b1d62fd2f0a8a5fe9e1ccb0f7c18dc10e0
Instruction Fuzzy Hash: B8419731742616ABDB215F648C49F6E3674EF46B16F110255FB16BA2C0EF70CD0686B1

Function 6CC77590 Relevance: 33.2, APIs: 22, Instructions: 209clipboardkeyboardthreadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 6CC775E3
GetCurrentThreadId.KERNEL32 ref: 6CC77618
GetThreadDesktop.USER32(00000000), ref: 6CC7761F
OpenDesktopA.USER32(00000000,00000000,00000000,400001CF), ref: 6CC77672
CloseDesktop.USER32(00000000), ref: 6CC7768E
BlockInput.USER32(00000000), ref: 6CC776DE
BlockInput.USER32(?,00000001,?), ref: 6CC776F3
OpenClipboard.USER32(00000000), ref: 6CC77744
GetClipboardData.USER32(00000001), ref: 6CC77754
GlobalSize.KERNEL32(00000000), ref: 6CC77765
GlobalLock.KERNEL32(00000000), ref: 6CC77772
GlobalUnlock.KERNEL32(00000000), ref: 6CC7779E
CloseClipboard.USER32 ref: 6CC777A4
OpenClipboard.USER32(00000000), ref: 6CC777CC
EmptyClipboard.USER32 ref: 6CC777D6
GlobalAlloc.KERNEL32(00002000,?), ref: 6CC777E2
GlobalLock.KERNEL32(00000000), ref: 6CC777EF
GlobalUnlock.KERNEL32(00000000), ref: 6CC77804
SetClipboardData.USER32(00000001,00000000), ref: 6CC7780D
GlobalFree.KERNEL32(00000000), ref: 6CC77814
CloseClipboard.USER32 ref: 6CC7781A

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: ClipboardGlobal$CloseDesktopOpen$BlockDataInputLockThreadUnlock$AllocCurrentEmptyEventFreeSize
String ID:
API String ID: 3945434931-0
Opcode ID: 3621b429d7ccd47ac752aadff5f16199682d44717fef8fc5f85faf951519ea5e
Instruction ID: 87120d75ff42f85c418091ebcd121d1cdfa66c2e47dea836cf1bc2fbe616f32f
Opcode Fuzzy Hash: 3621b429d7ccd47ac752aadff5f16199682d44717fef8fc5f85faf951519ea5e
Instruction Fuzzy Hash: 16713631A04349AFDB129F74C848BAE7BB4FF46306F044259E916AB642EB759904CBF1

Function 6CC75760 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 189sleepshutdownCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 6CC758A4
GetCurrentProcess.KERNEL32(00000028,?,Function_00004330,?,?,?), ref: 6CC75982
OpenProcessToken.ADVAPI32(00000000,?,?), ref: 6CC75989
LookupPrivilegeValueA.ADVAPI32 ref: 6CC759C1
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,00000000,SeShutdownPrivilege,?), ref: 6CC759D4
GetLastError.KERNEL32(?,?,?,00000000,SeShutdownPrivilege,?), ref: 6CC759D6
CloseHandle.KERNEL32(?,?,?,?,00000000,SeShutdownPrivilege,?), ref: 6CC759DC
ExitWindowsEx.USER32(?,00000000), ref: 6CC759E8
GetCurrentProcess.KERNEL32(00000028,?,?,?), ref: 6CC759F5
OpenProcessToken.ADVAPI32(00000000,?,?), ref: 6CC759FC
LookupPrivilegeValueA.ADVAPI32 ref: 6CC75A26
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,00000000,SeShutdownPrivilege,?), ref: 6CC75A39
GetLastError.KERNEL32(?,?,?,00000000,SeShutdownPrivilege,?), ref: 6CC75A3B
CloseHandle.KERNEL32(?,?,?,?,00000000,SeShutdownPrivilege,?), ref: 6CC75A41

Strings

SeShutdownPrivilege, xrefs: 6CC759B2, 6CC75A17

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue$ExitSleepWindows
String ID: SeShutdownPrivilege
API String ID: 168911092-3733053543
Opcode ID: 12cabe0a703025a83cef927af68183d83e893a6642dab5d2f87d7d7ab17cdb74
Instruction ID: c838f4023262d7a53b10c270978bf5903eec59f70cc889196b888b4615049774
Opcode Fuzzy Hash: 12cabe0a703025a83cef927af68183d83e893a6642dab5d2f87d7d7ab17cdb74
Instruction Fuzzy Hash: A661FC72744204EFD710EF65DC49FAABBF4FB49306F000569FA488B980DB71A518CBA2

Function 6CC76010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 199filestringtimeCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 6CC76050
GetWindowTextA.USER32(?,?,00000100), ref: 6CC76075
GetLocalTime.KERNEL32(?), ref: 6CC76082
wsprintfA.USER32 ref: 6CC760E1
CreateFileA.KERNEL32(04EF000D,40000000,00000002,00000000,00000004,00000080,00000000), ref: 6CC7611B
GetFileSize.KERNEL32(00000000,00000000), ref: 6CC76136
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 6CC7614A
lstrlenA.KERNEL32 ref: 6CC76151
WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 6CC76264
CloseHandle.KERNEL32(?), ref: 6CC7626B
lstrcatA.KERNEL32(04EF0111), ref: 6CC762B6

Strings

[%02d/%02d/%d %02d:%02d:%02d] (%s), xrefs: 6CC760DB

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: File$Window$ActiveCloseCreateHandleLocalPointerSizeTextTimeWritelstrcatlstrlenwsprintf
String ID: [%02d/%02d/%d %02d:%02d:%02d] (%s)
API String ID: 1146251106-1373887856
Opcode ID: 1af58edc59e97f837d79e57d48df69886771b6dbef5de968e404dabfe8855404
Instruction ID: 68f3deae0be9e8e09e0b451a964a3e6868d008d6ecea51717ff638dcc64a22fe
Opcode Fuzzy Hash: 1af58edc59e97f837d79e57d48df69886771b6dbef5de968e404dabfe8855404
Instruction Fuzzy Hash: 3F71F771E05519ABEB20CF64CC49BE9B7B8FF89304F144299E548E7542EB70AAC5CF60

Function 6CC738E0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 144filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 6CC73930
wsprintfA.USER32 ref: 6CC7395C
FindFirstFileA.KERNEL32(?,?), ref: 6CC73973
wsprintfA.USER32 ref: 6CC739BB

Strings

list<T> too long, xrefs: 6CC73ACF
., xrefs: 6CC73990
%s%s%s, xrefs: 6CC739AD
%s%s*.*, xrefs: 6CC73950

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: wsprintf$FileFindFirstlstrlen
String ID: %s%s%s$%s%s*.*$.$list<T> too long
API String ID: 40766003-2028185040
Opcode ID: a01345a64bfd85a3ec9c8025d3ac3404c9ed492fbdd91ca4ab303b768c81e410
Instruction ID: c41f5b73e0ebd57e74897ef06898159b3fca200901898a2f967590546ccdf77d
Opcode Fuzzy Hash: a01345a64bfd85a3ec9c8025d3ac3404c9ed492fbdd91ca4ab303b768c81e410
Instruction Fuzzy Hash: 6A51C4B1900618AFDB24DF64CC89B9EB7BCFB45714F44469DE51993680EB30AA848F61

Function 6CC73640 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 80fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 6CC73672
FindFirstFileA.KERNEL32(?,?), ref: 6CC73685
wsprintfA.USER32 ref: 6CC736BC
wsprintfA.USER32 ref: 6CC736D5
DeleteFileA.KERNEL32(?), ref: 6CC736E1
FindNextFileA.KERNEL32(00000000,?), ref: 6CC736EF
FindClose.KERNEL32(00000000), ref: 6CC736FA
RemoveDirectoryA.KERNEL32(?), ref: 6CC73701

Strings

., xrefs: 6CC73696
%s\*.*, xrefs: 6CC73666
%s\%s, xrefs: 6CC736B4

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: FileFindwsprintf$CloseDeleteDirectoryFirstNextRemove
String ID: %s\%s$%s\*.*$.
API String ID: 3641128273-1471744235
Opcode ID: 0ed4d7f1a40b75137c4754cd161038af0b274dacf7ded4fce0647e5d8660aa8b
Instruction ID: a9912c6c1ba951be926b38b0a21d8e321bd7cee03db439e02a07c4c92f29143c
Opcode Fuzzy Hash: 0ed4d7f1a40b75137c4754cd161038af0b274dacf7ded4fce0647e5d8660aa8b
Instruction Fuzzy Hash: 22219171A0111C6BCF14DF659C49AEAB7BCFF45319F04019AE91593640EA319A458FB1

Function 6CC78090 Relevance: 18.3, APIs: 12, Instructions: 273sleepwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC79D00: GetCurrentThreadId.KERNEL32 ref: 6CC79D18
Part of subcall function 6CC79D00: GetThreadDesktop.USER32(00000000), ref: 6CC79D1F
Part of subcall function 6CC79D00: GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 6CC79D5E
Part of subcall function 6CC79D00: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 6CC79D67
Part of subcall function 6CC79D00: GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 6CC79D9A
Part of subcall function 6CC79D00: lstrcmpiA.KERNEL32(?,?), ref: 6CC79DAA
Part of subcall function 6CC79D00: SetThreadDesktop.USER32(00000000), ref: 6CC79DB5
Part of subcall function 6CC79D00: CloseDesktop.USER32(?), ref: 6CC79DCC
Part of subcall function 6CC79D00: CloseDesktop.USER32(00000000), ref: 6CC79DCF

ReleaseDC.USER32(?,?), ref: 6CC780C4
GetDesktopWindow.USER32 ref: 6CC780CA
GetDC.USER32(00000000), ref: 6CC780D7
GetCursorPos.USER32(?), ref: 6CC780F6
GetCursorInfo.USER32(00000014,?,?,?), ref: 6CC7811A
DestroyCursor.USER32(?), ref: 6CC78161
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 6CC781DD
Sleep.KERNEL32(00000005,?,?,?), ref: 6CC781E5
GetTickCount.KERNEL32 ref: 6CC78355
Sleep.KERNEL32(00000001,?,?,?), ref: 6CC78362
GetTickCount.KERNEL32 ref: 6CC78368
GetTickCount.KERNEL32 ref: 6CC78371

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Desktop$CountCursorThreadTick$CloseInformationObjectSleepUser$CurrentDestroyInfoInputOpenReleaseWindowlstrcmpi
String ID:
API String ID: 3269017526-0
Opcode ID: 0a3756c37ac94029ac3647d316be39e25711746fdeaee574ad764b0d143ce7f9
Instruction ID: 2c2e2a9fd9c2537bce3c953a320904f256da6e403f34ee6fa68ab297cd8d68f7
Opcode Fuzzy Hash: 0a3756c37ac94029ac3647d316be39e25711746fdeaee574ad764b0d143ce7f9
Instruction Fuzzy Hash: D4B14D71A0161ADFDB14CFA9C880AADFBB1FF49314B14826AD915B7B41E731B851CFA0

Function 6CC7A7A0 Relevance: 16.7, APIs: 11, Instructions: 210sleepsynchronizationwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC8275F: EnterCriticalSection.KERNEL32(6CCA30F4,?,?,?,6CC7A7D5,6CCA3F64), ref: 6CC8276A
Part of subcall function 6CC8275F: LeaveCriticalSection.KERNEL32(6CCA30F4,?,?,?,6CC7A7D5,6CCA3F64), ref: 6CC827A7

GetTickCount.KERNEL32 ref: 6CC7A7E1
__Init_thread_footer.LIBCMT ref: 6CC7A7ED

Part of subcall function 6CC82715: EnterCriticalSection.KERNEL32(6CCA30F4,?,?,6CC7A7F2,6CCA3F64), ref: 6CC8271F
Part of subcall function 6CC82715: LeaveCriticalSection.KERNEL32(6CCA30F4,?,?,6CC7A7F2,6CCA3F64), ref: 6CC82752

WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC7A88F
Sleep.KERNEL32(00000096), ref: 6CC7A8A0
GetTickCount.KERNEL32 ref: 6CC7A8B0
Sleep.KERNEL32(00000064), ref: 6CC7A8C1
GetTickCount.KERNEL32 ref: 6CC7A8C3
IsWindow.USER32(?), ref: 6CC7A8D0
SendMessageA.USER32(?,0000043D,00000000,00000000), ref: 6CC7A8E6
WaitForSingleObject.KERNEL32(?,00000BB8), ref: 6CC7A8F4
ICSeqCompressFrame.MSVFW32(00000001,00000000,00000000,00000001,00000001), ref: 6CC7A97F

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CriticalSection$CountTick$EnterLeaveObjectSingleSleepWait$CompressFrameInit_thread_footerMessageSendWindow
String ID:
API String ID: 2978199838-0
Opcode ID: 7245988df4a04a666169c4f61574a003cb181df0c2bbe9887e2f2aeb3f161544
Instruction ID: a296b7eb8b46f2ef550ad39c926d92ff021672042cd9637e3970d7c7623eaf3c
Opcode Fuzzy Hash: 7245988df4a04a666169c4f61574a003cb181df0c2bbe9887e2f2aeb3f161544
Instruction Fuzzy Hash: E481D0706007019FEB20DF64D988F66B7B4FF89318F144268E9558BB91E731F895CBA1

Function 6CC74DA0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 158registrystringprocessCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000000,Applications\iexplore.exe\shell\open\command,00000000,000F003F,?), ref: 6CC74E67
RegQueryValueA.ADVAPI32(?,00000000,?,00000104), ref: 6CC74EBF
RegCloseKey.ADVAPI32(?), ref: 6CC74ECB
lstrlenA.KERNEL32(?), ref: 6CC74ED8
_strstr.LIBCMT ref: 6CC74EF2
lstrcpyA.KERNEL32(00000000), ref: 6CC74F04
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 6CC74FA5

Strings

Applications\iexplore.exe\shell\open\command, xrefs: 6CC74E5D
D, xrefs: 6CC74F0D

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CloseCreateOpenProcessQueryValue_strstrlstrcpylstrlen
String ID: Applications\iexplore.exe\shell\open\command$D
API String ID: 968124780-535818822
Opcode ID: f4fcc5b83e55e322d92d1d66bdbf34e358693e9cd25ef21a1256b868bff97c2c
Instruction ID: f33b148f2a676ac5ac26e53f28b06cb7d6cc9655b2bf6de6a984a0caaa949407
Opcode Fuzzy Hash: f4fcc5b83e55e322d92d1d66bdbf34e358693e9cd25ef21a1256b868bff97c2c
Instruction Fuzzy Hash: 9D51D971D01758DBEB21CF64CD08BEEB7B8FF5A309F005299E549A6640EB705A84CFA1

Function 6CC73460 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 136stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32 ref: 6CC73496
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000104,?,6CCA3E50), ref: 6CC734FF
SHGetFileInfoA.SHELL32(00000000,00000080,?,00000160,00000410), ref: 6CC7351A
lstrlenA.KERNEL32(?), ref: 6CC73528
lstrlenA.KERNEL32(?), ref: 6CC73537
GetDiskFreeSpaceExA.KERNEL32(00000000,?,?,00000000), ref: 6CC73557
GetDriveTypeA.KERNEL32(00000000), ref: 6CC7358D
lstrlenA.KERNEL32(00000000), ref: 6CC73604

Strings

g, xrefs: 6CC7348E

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: lstrlen$Drive$DiskFileFreeInfoInformationLogicalSpaceStringsTypeVolume
String ID: g
API String ID: 2496086942-30677878
Opcode ID: 6503760ebd97ec5688618a57c33e6d647fb624d4d2436eee60548ec0e127aee3
Instruction ID: c86bc20eb097022afff7dec6eeddf9fbb98d23cdecb78384f1d73d3726dfde59
Opcode Fuzzy Hash: 6503760ebd97ec5688618a57c33e6d647fb624d4d2436eee60548ec0e127aee3
Instruction Fuzzy Hash: AC5161B16083449FD721CF64C885BDBB7ECFB89308F140A2DE588C3241E77495458BA6

Function 6CC73EF0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 86servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 6CC73F4C
OpenServiceA.ADVAPI32(00000000,?,000F01FF), ref: 6CC73F61
QueryServiceStatus.ADVAPI32(00000000,?,?,000F01FF), ref: 6CC73F7F
ControlService.ADVAPI32(00000000,00000001,?,?,000F01FF), ref: 6CC73F9C
Sleep.KERNEL32(00000320,?,000F01FF), ref: 6CC73FAB
DeleteService.ADVAPI32(00000000,?,000F01FF), ref: 6CC73FB2
wsprintfA.USER32 ref: 6CC73FD8
SHDeleteKeyA.SHLWAPI(80000002,?), ref: 6CC73FED

Strings

SYSTEM\CurrentControlSet\Services\%s, xrefs: 6CC73FCC

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Service$DeleteOpen$ControlManagerQuerySleepStatuswsprintf
String ID: SYSTEM\CurrentControlSet\Services\%s
API String ID: 2632840174-2757632955
Opcode ID: c4c7d420fa4343f559bbb9d9f738341b99d95b4954fff529b5ab72c08861bb21
Instruction ID: ca1196c7c027c085f9557aaf8407250ee56e39374c6d2263bf009c608ebf20fa
Opcode Fuzzy Hash: c4c7d420fa4343f559bbb9d9f738341b99d95b4954fff529b5ab72c08861bb21
Instruction Fuzzy Hash: 0A31A2B1A41218AFDB20CF60CC49FAEBBB8FB05705F504199FA05E7680EB315A45CFA4

Function 6CC75E60 Relevance: 15.1, APIs: 10, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001,723C8B34,00000001,00000000), ref: 6CC75EB9
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6CC75ED5
GetLengthSid.ADVAPI32(00000000), ref: 6CC75EE2
GetProcessHeap.KERNEL32(00000008,00000010), ref: 6CC75EEE
HeapAlloc.KERNEL32(00000000), ref: 6CC75EF5
InitializeAcl.ADVAPI32(00000000,00000010,00000002), ref: 6CC75F08
AddAccessAllowedAce.ADVAPI32(00000000,00000002,10000000,00000000), ref: 6CC75F1D
SetSecurityDescriptorDacl.ADVAPI32(00000001,00000001,00000000,00000000), ref: 6CC75F2E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 6CC75F57
HeapFree.KERNEL32(00000000), ref: 6CC75F5E

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Heap$Initialize$DescriptorProcessSecurity$AccessAllocAllocateAllowedDaclFreeLength
String ID:
API String ID: 1688651007-0
Opcode ID: 76c9666ea9b6656b5f88b046581ab3d2bc70e772f271b1653332b09e6703a4ed
Instruction ID: 31548621ad154f0914ffd53f280c82e171cd63fb47769cbed1deb60db0d57f63
Opcode Fuzzy Hash: 76c9666ea9b6656b5f88b046581ab3d2bc70e772f271b1653332b09e6703a4ed
Instruction Fuzzy Hash: C3314C71A01218AFDB208FA5CC49FDEBBB8EF49B55F104119F916E2680EB358805CBB4

Function 6CC77B50 Relevance: 10.6, APIs: 7, Instructions: 147keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC79D00: GetCurrentThreadId.KERNEL32 ref: 6CC79D18
Part of subcall function 6CC79D00: GetThreadDesktop.USER32(00000000), ref: 6CC79D1F
Part of subcall function 6CC79D00: GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 6CC79D5E
Part of subcall function 6CC79D00: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 6CC79D67
Part of subcall function 6CC79D00: GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 6CC79D9A
Part of subcall function 6CC79D00: lstrcmpiA.KERNEL32(?,?), ref: 6CC79DAA
Part of subcall function 6CC79D00: SetThreadDesktop.USER32(00000000), ref: 6CC79DB5
Part of subcall function 6CC79D00: CloseDesktop.USER32(?), ref: 6CC79DCC
Part of subcall function 6CC79D00: CloseDesktop.USER32(00000000), ref: 6CC79DCF

SetCursorPos.USER32(?,?,00000000,00000000,75C11040,?,6CC776EE,00000001,?), ref: 6CC77BC0
WindowFromPoint.USER32(?,?,?,6CC776EE,00000001,?), ref: 6CC77BC8
SetCapture.USER32(00000000,?,6CC776EE,00000001,?), ref: 6CC77BCF
keybd_event.USER32(00000000,00000000,?,6CC776EE), ref: 6CC77C14
mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 6CC77CC5

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Desktop$Thread$CloseInformationObjectUser$CaptureCurrentCursorFromInputOpenPointWindowkeybd_eventlstrcmpimouse_event
String ID:
API String ID: 3538182014-0
Opcode ID: 1b7e05612eb1440b9cbb3222b0cdc9f828748df6dfbe58ce5a12ed9d944ae286
Instruction ID: 13917e15c8efa5f83c10a34c0b3442173408efe587c820dafb525b762a2c5e1a
Opcode Fuzzy Hash: 1b7e05612eb1440b9cbb3222b0cdc9f828748df6dfbe58ce5a12ed9d944ae286
Instruction Fuzzy Hash: B9413D31BC4318BAF7314A699D4BF597624E74AF11F324211FB017E6C4E1E0B940976D

Function 6CC79C70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?,6CC754E7), ref: 6CC79C77
Process32First.KERNEL32(00000000,00000000), ref: 6CC79C96
Process32Next.KERNEL32(00000000,00000000), ref: 6CC79CBE
lstrcmpiA.KERNEL32(00000024,winlogon.exe), ref: 6CC79CD6
Process32Next.KERNEL32(00000000,00000000), ref: 6CC79CE2

Strings

winlogon.exe, xrefs: 6CC79CA3, 6CC79CD0

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Process32$Next$CreateFirstSnapshotToolhelp32lstrcmpi
String ID: winlogon.exe
API String ID: 663490456-961692650
Opcode ID: 80be1d69143b75f1964f36850b15033ec4f780589c4069c24aad984cb6efe9b8
Instruction ID: b238b4ede875989ec2667f67a3824cf79e2e276bfa9417e11534e23c663e933b
Opcode Fuzzy Hash: 80be1d69143b75f1964f36850b15033ec4f780589c4069c24aad984cb6efe9b8
Instruction Fuzzy Hash: DF011D72742211A7EE205B669D4DFA77BFCEB8269AF14052DF505C5940FB60D4049670

Function 6CC8EB88 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1335COMMON

Download Yara Rule

Strings

1#SNAN, xrefs: 6CC8FEAC
1#IND, xrefs: 6CC8FEA5
1#INF, xrefs: 6CC8FED0
1#QNAN, xrefs: 6CC8FEB3

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 0-2761157908
Opcode ID: efeb72cbb1e0b7c522cc217705f1c0df51b9b67817003c0053dce2401573813d
Instruction ID: 7154becde7791528187d1756f149d793865746b4b5abed450fb8759ba69bae00
Opcode Fuzzy Hash: efeb72cbb1e0b7c522cc217705f1c0df51b9b67817003c0053dce2401573813d
Instruction Fuzzy Hash: 66C25F71E0A6288FDB24CE29DD407DABBB5FB45309F1442EAD84DE7640E774AE858F40

Function 6CC8C2C5 Relevance: 9.2, APIs: 6, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 6CC8C3B5
_free.LIBCMT ref: 6CC8C485
FindNextFileW.KERNEL32(00000000,?), ref: 6CC8C493
_free.LIBCMT ref: 6CC8C4E1
FindClose.KERNEL32(00000000), ref: 6CC8C4F0
_free.LIBCMT ref: 6CC8C506

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Find_free$File$CloseFirstNext
String ID:
API String ID: 1576393127-0
Opcode ID: f5d1904a16aff8b953a53dc0a0e87eff78f1159123cf6d1425ce9abc3ccb4c1c
Instruction ID: ec089a40a501b4709e7450f58f8c8610726a36ee4e2febe3254be5abc67e09b5
Opcode Fuzzy Hash: f5d1904a16aff8b953a53dc0a0e87eff78f1159123cf6d1425ce9abc3ccb4c1c
Instruction Fuzzy Hash: 8261D1719061185FDB20AF689C88AFBBFB8AB4530CF5442DAE45993A40FB318E859F10

Function 6CC73B10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 6CC73B58
FindClose.KERNEL32(00000000), ref: 6CC73BBA
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 6CC73BD2
CloseHandle.KERNEL32(00000000), ref: 6CC73C03

Strings

p, xrefs: 6CC73B60

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CloseFileFind$CreateFirstHandle
String ID: p
API String ID: 3283578348-2181537457
Opcode ID: b8ff43d5e725b83fbcabe7a14322cee932cd364f5252a25333f44c4acec64231
Instruction ID: f57a2a839c93f8f7a01c2d5bc37afd1fd749dc4e6229b930e6743a88d446e97a
Opcode Fuzzy Hash: b8ff43d5e725b83fbcabe7a14322cee932cd364f5252a25333f44c4acec64231
Instruction Fuzzy Hash: 5631A772E01618DBDB20CE699C49BD9B774FB46325F18039AE429A7680EB346D44C7A1

Function 6CC72E66 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 6CC72EAE
FindClose.KERNEL32(00000000,?), ref: 6CC72EE5

Part of subcall function 6CC73B10: FindFirstFileA.KERNEL32(?,?), ref: 6CC73B58
Part of subcall function 6CC73B10: FindClose.KERNEL32(00000000), ref: 6CC73BBA
Part of subcall function 6CC73B10: CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 6CC73BD2

FindClose.KERNEL32(00000000), ref: 6CC72EF8

Strings

m, xrefs: 6CC72ED5

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Find$CloseFile$First$Create
String ID: m
API String ID: 2848238358-3775001192
Opcode ID: 89e48be8c117c7251c174d7665b6e5cd4c8d816fb6e09e930af48b7530bb84ce
Instruction ID: 869ead8bc8920de115f2f5bd99fd17f82ab4305f085ae79ad923db8dabdcb94a
Opcode Fuzzy Hash: 89e48be8c117c7251c174d7665b6e5cd4c8d816fb6e09e930af48b7530bb84ce
Instruction Fuzzy Hash: B411C4316061008FCB75DF24C8A8BEE77B5EF49309F1442AED8569BF81EB356509CB61

Function 6CC74FF0 Relevance: 4.6, APIs: 3, Instructions: 118COMMON

Download Yara Rule

APIs

OpenEventLogA.ADVAPI32(00000000,B9BA8A0B), ref: 6CC750E6
ClearEventLogA.ADVAPI32(00000000,00000000), ref: 6CC750F5
CloseEventLog.ADVAPI32(00000000), ref: 6CC750FC

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID:
API String ID: 1391105993-0
Opcode ID: bb891b62236aa5a6ca4edd84a1142c8de6e73831b20840c3f90c367d29907cf0
Instruction ID: ce5861a0de65c90b0ca68f2d420493f1d28c11f03847ea99da20c59ee4db6f57
Opcode Fuzzy Hash: bb891b62236aa5a6ca4edd84a1142c8de6e73831b20840c3f90c367d29907cf0
Instruction Fuzzy Hash: 7F412171D012549BDB11CF698858BDEBBB0EF46308F144358E5027B788EB356549C7A1

Function 6CC86466 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 6CC8655E
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 6CC86568
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 6CC86575

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 78fb2450ee71a3cd3ea915bb458a81ac07d54a5277aa4f6dac3ef501c71a1bcf
Instruction ID: 134c877c50225634c6b417dc25bda91d63dcb6d163d8d9da9d815b085a8f6baf
Opcode Fuzzy Hash: 78fb2450ee71a3cd3ea915bb458a81ac07d54a5277aa4f6dac3ef501c71a1bcf
Instruction Fuzzy Hash: 8B31C57491222C9BCB21DF65D9887CDBBB8BF48314F5042EAE81DA7250E7709B858F45

Function 6CC8894D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6CC8894C,00000104,?,?,00000104,?,00000104), ref: 6CC8896F
TerminateProcess.KERNEL32(00000000,?,6CC8894C,00000104,?,?,00000104,?,00000104), ref: 6CC88976
ExitProcess.KERNEL32 ref: 6CC88988

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ef6a643b2b65532c824cbf0ca45633b2cad0abb81e7c20cc69f8aeb218098401
Instruction ID: c1965f251cdb2377266018d6c1f4613322659aadb401e096afc8cb88536ad5ad
Opcode Fuzzy Hash: ef6a643b2b65532c824cbf0ca45633b2cad0abb81e7c20cc69f8aeb218098401
Instruction Fuzzy Hash: D9E08C31102508AFCF022F68C808E4A3F78FB4634EB004115F804CAA20DB39E981CB86

Function 6CC8E6F0 Relevance: 3.5, APIs: 2, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293f1674319b4cd25e282e38d7dab2dedf740f3641e09b33557abd3ccf31650e
Instruction ID: a853f275c0a0fc83b6cf0a7ac23f4d5753542fdd5c939cce3a4c1cfce380077e
Opcode Fuzzy Hash: 293f1674319b4cd25e282e38d7dab2dedf740f3641e09b33557abd3ccf31650e
Instruction Fuzzy Hash: B0027F75E012199FDF14CFA9C8806DEBBB1FF89318F25826DD819A7784E731A941CB90

Function 6CC7C9B0 Relevance: 2.2, Strings: 1, Instructions: 907COMMON

Download Yara Rule

Strings

F?, xrefs: 6CC7CB4B

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID: F?
API String ID: 0-1369233217
Opcode ID: 1a807e3875d930ef3f303654ca90ef4b9fab475e4a98f5b1bc2335c705d23348
Instruction ID: 7daef3d86eddf974f87147dc8de233fdbba3c7642b5193a4494beb23b6f1fc35
Opcode Fuzzy Hash: 1a807e3875d930ef3f303654ca90ef4b9fab475e4a98f5b1bc2335c705d23348
Instruction Fuzzy Hash: BC826D71E002199FCB18CF59C4906ADBBB1FF88318F2482AED855AB741E735D946CFA0

Function 6CC936E5 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,000000FF), ref: 6CC93912

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7cf4db6c983cc077867d63c997c7cebc17102283f8858b0611f895db329670a0
Instruction ID: 1bcb3798cd3d635253fe31027826a8ef606daa74994f97770737b3903ae3ccb8
Opcode Fuzzy Hash: 7cf4db6c983cc077867d63c997c7cebc17102283f8858b0611f895db329670a0
Instruction Fuzzy Hash: 65B16875610608DFD705CF28C486B547BE1FF45368F2A8658E8AECF6A1D335E982CB40

Function 6CC879A4 Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

0, xrefs: 6CC87B20

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 38ac0361a5aab00b54be58501b9510f83a906107ec8574ce9cda622720e99e21
Instruction ID: 94a680f5d387464237c15cfb1e1e368671d15d27bc9ab293ac16190cb829bb3a
Opcode Fuzzy Hash: 38ac0361a5aab00b54be58501b9510f83a906107ec8574ce9cda622720e99e21
Instruction Fuzzy Hash: 6E5168303476485ADB1489698890BFFBF9AAB0370CF10165EF841D7F80F7199AC9A352

Function 6CC7BF50 Relevance: .7, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d48b52bf19501aefea07fd0ebaad4744ca6ef2898384e28d685d983b2cc01c7f
Instruction ID: 67f87dcc574b734975b73aec60044a2afaa0bf5db7364f1e903d2df3f93b293a
Opcode Fuzzy Hash: d48b52bf19501aefea07fd0ebaad4744ca6ef2898384e28d685d983b2cc01c7f
Instruction Fuzzy Hash: 8B526CB1E012169FDB14DF99C5806ADBBB1FF48308F2481ADD854AB741E776DA42CBA0

Function 6CC80450 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6f1f9105b9e6f29607bb65cf614713acfd9fd2fb1db8690f01e1e0e5e4a6f4
Instruction ID: 87d2a6b3baec90a145810566e7cea6ea79fc31fa330e3146496dbcb46ccc9a4d
Opcode Fuzzy Hash: 7c6f1f9105b9e6f29607bb65cf614713acfd9fd2fb1db8690f01e1e0e5e4a6f4
Instruction Fuzzy Hash: 35F1A131A062958FCB04CF6DC5906ADBFF2EF85318F1882ADD8959B742E734DA46CB50

Function 6CC81D10 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c79c36f34df136e168e700d38949d8d06bde094da2a8f3ffe400f3b3c8d90b
Instruction ID: ae60c98b9caa3c152d8d8b5b80c63fec0ef1a37e5390335ff7d1d965f7370e83
Opcode Fuzzy Hash: 80c79c36f34df136e168e700d38949d8d06bde094da2a8f3ffe400f3b3c8d90b
Instruction Fuzzy Hash: 6DF18E756092118FC709CF18D4E88F6BBF1AF65314B1E82FDC8999B3A6E7319980CB51

Function 6CC7FD50 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70526dd0a7295c8ef5e74eb3411217770d6cdac110fffb2f87bece494acd482d
Instruction ID: 27e11e473c254361831c18fb9aad183cd3d553258fdb6583e47c7645e8ebf744
Opcode Fuzzy Hash: 70526dd0a7295c8ef5e74eb3411217770d6cdac110fffb2f87bece494acd482d
Instruction Fuzzy Hash: 49715F717105B58FDB58CE6ED8D046A37B1E78B301386862EEA81CB7C5C635E526CBE0

Function 6CC92058 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30369f11a5f617ca26ec92d4bfc60b7585a2b98b5ca473555d57da113227433
Instruction ID: 822f6e81ab476cac2592c557a5146ff16b002402ebeb52d102ba571257e5bdcf
Opcode Fuzzy Hash: d30369f11a5f617ca26ec92d4bfc60b7585a2b98b5ca473555d57da113227433
Instruction Fuzzy Hash: 8321B673F20438477B0CC47E8C562BDB6E1C78C601745427AF9A6DA3C1E968D927E2E4

Function 6CC91F34 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2b5b5096de43c3f6420546aa1e8c73ba2197715191b56ad1553ef2560452290
Instruction ID: 42a976dda1f4c239f182a4e6e3da0a4583820f449ae7c3b5c414b12ac7453ce5
Opcode Fuzzy Hash: a2b5b5096de43c3f6420546aa1e8c73ba2197715191b56ad1553ef2560452290
Instruction Fuzzy Hash: C011AB23F30C295B275C81AD8C1727AA2D6EBD825074F433AD826E72C4F954DE13C290

Function 6CC8A524 Relevance: .0, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ad348df96a30b640f49b2be19fc9011992f8593216606ae34cec858d8a8f6c
Instruction ID: 37efef85786ab7567cd7ee094b9da93094cbf4c06623815927ad47882ffd6b22
Opcode Fuzzy Hash: e1ad348df96a30b640f49b2be19fc9011992f8593216606ae34cec858d8a8f6c
Instruction Fuzzy Hash: 1BE04F32913528EB8715CAC8950099AB7ACE745A14B510197B505D3A40E2709E40C7C0

Function 6CC77D20 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,723C8B34), ref: 6CC77DA1

Part of subcall function 6CC79D00: GetCurrentThreadId.KERNEL32 ref: 6CC79D18
Part of subcall function 6CC79D00: GetThreadDesktop.USER32(00000000), ref: 6CC79D1F
Part of subcall function 6CC79D00: GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 6CC79D5E
Part of subcall function 6CC79D00: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 6CC79D67
Part of subcall function 6CC79D00: GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 6CC79D9A
Part of subcall function 6CC79D00: lstrcmpiA.KERNEL32(?,?), ref: 6CC79DAA
Part of subcall function 6CC79D00: SetThreadDesktop.USER32(00000000), ref: 6CC79DB5
Part of subcall function 6CC79D00: CloseDesktop.USER32(?), ref: 6CC79DCC
Part of subcall function 6CC79D00: CloseDesktop.USER32(00000000), ref: 6CC79DCF

ReleaseDC.USER32(?,?), ref: 6CC77DF0
GetDesktopWindow.USER32 ref: 6CC77DF6
GetDC.USER32(00000000), ref: 6CC77E03
GetTickCount.KERNEL32 ref: 6CC77E17
GetSystemMetrics.USER32(00000000), ref: 6CC77E3C
GetSystemMetrics.USER32(00000001), ref: 6CC77E43
CreateCompatibleDC.GDI32(?), ref: 6CC77E64
CreateCompatibleDC.GDI32(?), ref: 6CC77E6C
CreateCompatibleDC.GDI32(00000000), ref: 6CC77E76
CreateCompatibleDC.GDI32(00000000), ref: 6CC77E7D
CreateDIBSection.GDI32(?,?,00000000,0000005C,00000000,00000000), ref: 6CC77EDE
CreateDIBSection.GDI32(?,?,00000000,00000060,00000000,00000000), ref: 6CC77EF0
CreateDIBSection.GDI32(?,?,00000000,00000078,00000000,00000000), ref: 6CC77F05
SelectObject.GDI32(?,?), ref: 6CC77F19
SelectObject.GDI32(?,?), ref: 6CC77F21
SelectObject.GDI32(?,?), ref: 6CC77F2F
SetRect.USER32(00000034,00000000,00000000,?,?), ref: 6CC77F3F

Strings

d, xrefs: 6CC77E2B
, xrefs: 6CC77E0C

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Create$Desktop$Object$Compatible$SectionSelectThread$CloseInformationMetricsSystemUser$CountCurrentCursorInputLoadOpenRectReleaseTickWindowlstrcmpi
String ID: $d
API String ID: 2246665989-2084297493
Opcode ID: e8c98f6714007d04e89acab78223389c2275d983091fcf69b8192510f6be4810
Instruction ID: 36558402e3f67e3b997cd14bdfb524c02d74e8e016175d211d6cb3464dec5c41
Opcode Fuzzy Hash: e8c98f6714007d04e89acab78223389c2275d983091fcf69b8192510f6be4810
Instruction Fuzzy Hash: 548128B1A00244EFEF118F65C985B997FB5FF09314F1042AAEE089F29AE7719854DF90

Function 6CC7A3A0 Relevance: 34.7, APIs: 23, Instructions: 203windowCOMMON

Download Yara Rule

APIs

capGetDriverDescriptionA.AVICAP32(00000000,?,00000064,?,00000032), ref: 6CC7A3E4
IsWindow.USER32(?), ref: 6CC7A402
SendMessageA.USER32(?,00000409,00000000), ref: 6CC7A419
IsWindow.USER32(?), ref: 6CC7A41E
SendMessageA.USER32(?,00000402,00000000,6CC7A340), ref: 6CC7A433
IsWindow.USER32(?), ref: 6CC7A438
SendMessageA.USER32(?,00000405,00000000,Function_0000A350), ref: 6CC7A451
IsWindow.USER32(?), ref: 6CC7A463
SendMessageA.USER32(?,0000040A,00000000,00000000), ref: 6CC7A478
IsWindow.USER32(?), ref: 6CC7A496
SendMessageA.USER32(?,0000042C,00000000,00000000), ref: 6CC7A4A8
IsWindow.USER32(?), ref: 6CC7A4CC
SendMessageA.USER32(?,0000042C,00000000,?), ref: 6CC7A4E3
IsWindow.USER32(?), ref: 6CC7A529
SendMessageA.USER32(?,0000042D,0000002C,?), ref: 6CC7A540
IsWindow.USER32(?), ref: 6CC7A55E
SendMessageA.USER32(?,0000040E,0000002C,?), ref: 6CC7A575
IsWindow.USER32(?), ref: 6CC7A57A
SendMessageA.USER32(?,00000433,00000000,00000000), ref: 6CC7A58C
IsWindow.USER32(?), ref: 6CC7A591
SendMessageA.USER32(?,00000432,00000000,00000000), ref: 6CC7A5A3
IsWindow.USER32(?), ref: 6CC7A5A8
SendMessageA.USER32(?,00000435,00000000,00000000), ref: 6CC7A5BA

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: MessageSendWindow$DescriptionDriver
String ID:
API String ID: 2614846152-0
Opcode ID: ef932a631ab045e21220ce6b386ff88403038c476a7b72cdd66eda1ba7d0e3fb
Instruction ID: 8443ccf4b98dd93b81b6a34e3577cf068a71d2787c6f63039812cc88756aea23
Opcode Fuzzy Hash: ef932a631ab045e21220ce6b386ff88403038c476a7b72cdd66eda1ba7d0e3fb
Instruction Fuzzy Hash: 6E61F570300705AEFB309F21DC46F2ABBB5EF84B05F105528E645AA9E0EB72E815DB35

Function 6CC799E0 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 142stringthreadmemoryCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 6CC79A26
IsWindow.USER32(?), ref: 6CC79A3E
GetWindowThreadProcessId.USER32(?,?), ref: 6CC79A5E
GetCurrentProcessId.KERNEL32 ref: 6CC79A66
GetCurrentThreadId.KERNEL32 ref: 6CC79A74
InternalGetWindowText.USER32(?,00000000,00000400), ref: 6CC79A94
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 6CC79AAF
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,?,00000000,00000000,00000000), ref: 6CC79ACB
GetWindowTextA.USER32(?,?,00000400), ref: 6CC79AE9
lstrlenA.KERNEL32(?), ref: 6CC79AFC
OutputDebugStringA.KERNEL32(lstrlen), ref: 6CC79B07
LocalAlloc.KERNEL32(00000040,00000001), ref: 6CC79B17
lstrlenA.KERNEL32(?), ref: 6CC79B2C
LocalSize.KERNEL32 ref: 6CC79B32
LocalReAlloc.KERNEL32(?,?,00000042), ref: 6CC79B46
GetWindowThreadProcessId.USER32(?,00000005), ref: 6CC79B59
lstrlenA.KERNEL32(?,?,00000042), ref: 6CC79B68

Strings

lstrlen, xrefs: 6CC79B02

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Window$LocalProcessThreadlstrlen$AllocByteCharCurrentMultiTextWide$DebugInternalOutputSizeStringVisible
String ID: lstrlen
API String ID: 402671383-1659193697
Opcode ID: d3c5517f3104b95719ddbf19b065d0ca32dd48f613af2a4f0572212b169046e4
Instruction ID: 4c1e06ec86b415ee1f6caafa14de6e4b5cf47d98d4dc2f46b2cc2f83000e4748
Opcode Fuzzy Hash: d3c5517f3104b95719ddbf19b065d0ca32dd48f613af2a4f0572212b169046e4
Instruction Fuzzy Hash: 7A41A2B1A01218AFDF209F608C89F9A77BCEB45715F100265FB05F7281EB70A9458FA5

Function 6CC78D30 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 207pipesleepprocessCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,723C8B34), ref: 6CC78D99
CreatePipe.KERNEL32(?,?,?,00000000), ref: 6CC78E33
CloseHandle.KERNEL32(?), ref: 6CC78E4B
CloseHandle.KERNEL32(?), ref: 6CC78E59
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 6CC78E6E
CloseHandle.KERNEL32(?), ref: 6CC78E86
CloseHandle.KERNEL32(?), ref: 6CC78E94
GetStartupInfoA.KERNEL32(?), ref: 6CC78EB5
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6CC78EFB
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000001,00000020,00000000,00000000,00000044,?), ref: 6CC78F4C
CloseHandle.KERNEL32(?), ref: 6CC78F5F
CloseHandle.KERNEL32(?), ref: 6CC78F64
CloseHandle.KERNEL32(?), ref: 6CC78F69
CloseHandle.KERNEL32(?), ref: 6CC78F6E
WaitForSingleObject.KERNEL32(?,000000FF,?,00000001), ref: 6CC78FA0
Sleep.KERNEL32(00000096), ref: 6CC78FAB

Part of subcall function 6CC79C10: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,6CCA3E50,?,?,?,6CC7163F,6CC71990,6CCA3E50,6CCA3E50), ref: 6CC79C31
Part of subcall function 6CC79C10: WaitForSingleObject.KERNEL32(6CC71990,000000FF,?,?,?,?,?,?,?,?,?,6CC7163F,6CC71990,6CCA3E50,6CCA3E50), ref: 6CC79C5A
Part of subcall function 6CC79C10: CloseHandle.KERNEL32(6CC71990,?,?,?,?,?,?,?,?,?,6CC7163F,6CC71990,6CCA3E50,6CCA3E50), ref: 6CC79C63

Strings

\cmd.exe, xrefs: 6CC78F12

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CloseHandle$Create$EventObjectPipeSingleWait$DirectoryInfoProcessSleepStartupSystem
String ID: \cmd.exe
API String ID: 2154032471-3521254782
Opcode ID: de489182ac8870822fe6cf0456835438c9591c99047908bb5008cd638e9a335b
Instruction ID: f58aad9de0f27fc61388f70c42af311a93e641cf190e66cf244ca769a11dfbb4
Opcode Fuzzy Hash: de489182ac8870822fe6cf0456835438c9591c99047908bb5008cd638e9a335b
Instruction Fuzzy Hash: 788187B1A40615AFDB10DF65CC45FDABBB8FF09704F10429AE508E7680E770AA94CFA5

Function 6CC73190 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 193registrystringprocessCOMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6CC731C9
RegOpenKeyExA.ADVAPI32(80000000,00000000,00000000,000F003F,?), ref: 6CC731ED
RegQueryValueA.ADVAPI32(?,00000000,?,00000104), ref: 6CC73211
RegCloseKey.ADVAPI32(?), ref: 6CC7321D
wsprintfA.USER32 ref: 6CC7328B
RegOpenKeyExA.ADVAPI32(80000000,?,00000000,000F003F,?), ref: 6CC732C7
RegQueryValueA.ADVAPI32(?,00000000,?,00000104), ref: 6CC7330A
RegCloseKey.ADVAPI32(?), ref: 6CC73316
_strstr.LIBCMT ref: 6CC73328
_strstr.LIBCMT ref: 6CC73340
lstrcatA.KERNEL32(?,6CC9E2D8), ref: 6CC7335E
lstrcatA.KERNEL32(?,?), ref: 6CC73368
lstrcpyA.KERNEL32(00000000,?), ref: 6CC7336E
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 6CC7340C

Strings

"%1, xrefs: 6CC73322
D, xrefs: 6CC733E3

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CloseOpenQueryValue_strstrlstrcat$CreateProcess_strrchrlstrcpywsprintf
String ID: "%1$D
API String ID: 2509154755-1329545213
Opcode ID: fa76b91d5d1a55bf7005516c92482a976658832a2129b8c9f0926d954470510a
Instruction ID: b5bcb0af9c0fd0d4ade33f489bccbc0e248291b9dd94ac3f1d7e81d9e69b6e0b
Opcode Fuzzy Hash: fa76b91d5d1a55bf7005516c92482a976658832a2129b8c9f0926d954470510a
Instruction Fuzzy Hash: FA716F71D01318ABDB21CF60CC44BEAB7BCEF59319F445299E549A6540EB70ABD88FA0

Function 6CC79030 Relevance: 27.1, APIs: 18, Instructions: 64pipethreadsynchronizationCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(?,00000000,?,00000000,6CC743B7), ref: 6CC79045
TerminateProcess.KERNEL32(?,00000000,?,00000000,6CC743B7), ref: 6CC7904C
TerminateThread.KERNEL32(?,00000000,?,00000000,6CC743B7), ref: 6CC79057
WaitForSingleObject.KERNEL32(?,000007D0,?,00000000,6CC743B7), ref: 6CC79061
TerminateThread.KERNEL32(?,00000000,?,00000000,6CC743B7), ref: 6CC7906C
DisconnectNamedPipe.KERNEL32(?,?,00000000,6CC743B7), ref: 6CC7907C
DisconnectNamedPipe.KERNEL32(?,?,00000000,6CC743B7), ref: 6CC79086
DisconnectNamedPipe.KERNEL32(?,?,00000000,6CC743B7), ref: 6CC79090
DisconnectNamedPipe.KERNEL32(?,?,00000000,6CC743B7), ref: 6CC7909A
CloseHandle.KERNEL32(?,?,00000000,6CC743B7), ref: 6CC790A5
CloseHandle.KERNEL32(?,?,00000000,6CC743B7), ref: 6CC790AA
CloseHandle.KERNEL32(?,?,00000000,6CC743B7), ref: 6CC790AF
CloseHandle.KERNEL32(?,?,00000000,6CC743B7), ref: 6CC790B4
CloseHandle.KERNEL32(?,?,00000000,6CC743B7), ref: 6CC790B9
CloseHandle.KERNEL32(?,?,00000000,6CC743B7), ref: 6CC790BE
CloseHandle.KERNEL32(?,?,00000000,6CC743B7), ref: 6CC790C3
CloseHandle.KERNEL32(?,?,00000000,6CC743B7), ref: 6CC790C8
CloseHandle.KERNEL32(?,?,00000000,6CC743B7), ref: 6CC790D3

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CloseHandle$DisconnectNamedPipeTerminate$Thread$ObjectProcessSingleWait
String ID:
API String ID: 1450516946-0
Opcode ID: d5835ac55eb8f4d2ef2f25371b8e8a1847722154ae83cd6c138c44c4e0521382
Instruction ID: 98b9b387126b7a75f725867bcdda2d13da7d00a9a8d362aef926638e7ddae6b5
Opcode Fuzzy Hash: d5835ac55eb8f4d2ef2f25371b8e8a1847722154ae83cd6c138c44c4e0521382
Instruction Fuzzy Hash: 7611AA71A10A2ABBDB215F76DC09B06BF79FF08661B140622E50892D60DB71F871DEE0

Function 6CC7A1F0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 109windowlibraryloaderCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 6CC7A242
SendMessageA.USER32(?,00000445,00000000,00000000), ref: 6CC7A254
IsWindow.USER32(?), ref: 6CC7A259
SendMessageA.USER32(?,0000040B,00000000,00000000), ref: 6CC7A26B
IsWindow.USER32(?), ref: 6CC7A29B
SendMessageA.USER32(?,00000402,00000000,00000000), ref: 6CC7A2AD
IsWindow.USER32(?), ref: 6CC7A2B2
SendMessageA.USER32(?,00000405,00000000,00000000), ref: 6CC7A2C4
LoadLibraryA.KERNEL32(USER32.dll,?), ref: 6CC7A2E4
GetProcAddress.KERNEL32(00000000), ref: 6CC7A2EB
CloseHandle.KERNEL32(00000000), ref: 6CC7A300

Strings

USER32.dll, xrefs: 6CC7A2D1
Clos, xrefs: 6CC7A2C9
eWin, xrefs: 6CC7A2D6
dow, xrefs: 6CC7A2DD

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: MessageSendWindow$AddressCloseHandleLibraryLoadProc
String ID: Clos$USER32.dll$dow$eWin
API String ID: 2944450401-1889052165
Opcode ID: b79c6ba809c023c36df3770cf86cc8246f37bd5022b83203b7fae6cd534008e1
Instruction ID: 1d119f4a10ab3ecb3c99979ddb5d4165e64902cf89753934b5e0b1b5c5574f4e
Opcode Fuzzy Hash: b79c6ba809c023c36df3770cf86cc8246f37bd5022b83203b7fae6cd534008e1
Instruction Fuzzy Hash: 3D31B3B1A0170ABBEB119F65DC0AF5ABF74FB40705F104125F614A6AD0EB71E810CBB5

Function 6CC7B7B0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 102sleepsynchronizationregistryCOMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 6CC7B7D0
__fassign.LIBCMT ref: 6CC7B7E1
RegisterServiceCtrlHandlerA.ADVAPI32(6CCA3E50,6CC7B710), ref: 6CC7B7F3
FreeConsole.KERNEL32 ref: 6CC7B807
SetServiceStatus.ADVAPI32(?), ref: 6CC7B858
SetServiceStatus.ADVAPI32(?), ref: 6CC7B89F

Part of subcall function 6CC74050: _strncpy.LIBCMT ref: 6CC740AD
Part of subcall function 6CC74050: RegOpenKeyA.ADVAPI32(80000002,?,00000000), ref: 6CC740F9
Part of subcall function 6CC74050: RegQueryValueExA.ADVAPI32(00000000,Type,00000000,?,00000000,?,?,75A904E0), ref: 6CC74133
Part of subcall function 6CC74050: RegCloseKey.ADVAPI32(00000000,?,75A904E0), ref: 6CC74147
Part of subcall function 6CC74050: SetLastError.KERNEL32(00000000,?,75A904E0), ref: 6CC7414A
Part of subcall function 6CC74050: RegCloseKey.ADVAPI32(00000000,?,75A904E0), ref: 6CC74168

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6CC7B8C5
WaitForSingleObject.KERNEL32(000003E8,000000FF), ref: 6CC7B8EE
CloseHandle.KERNEL32(000003E8), ref: 6CC7B8F7
Sleep.KERNEL32(00000064), ref: 6CC7B905
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 6CC7B919
CloseHandle.KERNEL32(00000000), ref: 6CC7B920
Sleep.KERNEL32(00002710), ref: 6CC7B938

Strings

, xrefs: 6CC7B81D
, xrefs: 6CC7B85D

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Close$Service$HandleObjectSingleSleepStatusWait_strncpy$ConsoleCreateCtrlErrorEventFreeHandlerLastOpenQueryRegisterValue__fassign
String ID: $
API String ID: 2569180018-227171996
Opcode ID: 041132fe095710b5efd800c9b611e9bf400b60860996f5a53936942393fb143b
Instruction ID: 5dba1671b11735588db20d32a11199c6fe388d01c6fea508dea49f370789241e
Opcode Fuzzy Hash: 041132fe095710b5efd800c9b611e9bf400b60860996f5a53936942393fb143b
Instruction Fuzzy Hash: 33415EB0E40208EBEF119F90DC59B9EBBB4FB05719F140249E510BB6C0EBB59545CFA5

Function 6CC74050 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 190registryCOMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 6CC740AD
RegOpenKeyA.ADVAPI32(80000002,?,00000000), ref: 6CC740F9
RegQueryValueExA.ADVAPI32(00000000,Type,00000000,?,00000000,?,?,75A904E0), ref: 6CC74133
RegCloseKey.ADVAPI32(00000000,?,75A904E0), ref: 6CC74147
SetLastError.KERNEL32(00000000,?,75A904E0), ref: 6CC7414A
RegCloseKey.ADVAPI32(00000000,?,75A904E0), ref: 6CC74168

Strings

Type, xrefs: 6CC74128
82.157.76.20, xrefs: 6CC7421A
SYSTEM\CurrentControlSet\Services\, xrefs: 6CC74096

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Close$ErrorLastOpenQueryValue_strncpy
String ID: 82.157.76.20$SYSTEM\CurrentControlSet\Services\$Type
API String ID: 1805282133-1619924693
Opcode ID: 2be49eb866d76fc319cd1d072c177f0e6a8ca90db8c50047f216dd289e0f2c1d
Instruction ID: 2d1014946c48ae2ac5de8d410c33123e8f794624c8ff102c3b939ce54d7b1498
Opcode Fuzzy Hash: 2be49eb866d76fc319cd1d072c177f0e6a8ca90db8c50047f216dd289e0f2c1d
Instruction Fuzzy Hash: D8718F7194022C9BDB20DF64DC59BDEBBB8FB15304F1042E9E519B7A80EB305A48CFA1

Function 6CC75C98 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 145stringfileCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6CC75D0A
lstrcatA.KERNEL32(?,6CC9E2EC), ref: 6CC75D22
lstrcatA.KERNEL32(?), ref: 6CC75D2F
lstrcatA.KERNEL32(?,ex.dll), ref: 6CC75D3D
GetTickCount.KERNEL32 ref: 6CC75D3F
wsprintfA.USER32 ref: 6CC75D52
MoveFileA.KERNEL32(?,?), ref: 6CC75D69
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 6CC75D7A
lstrcatA.KERNEL32(?,C:\syslog.dat), ref: 6CC75DA2
DeleteFileA.KERNEL32(?), ref: 6CC75DAB
CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 6CC75E27

Strings

%d.bak, xrefs: 6CC75D4C
ex.dll, xrefs: 6CC75D31
C:\syslog.dat, xrefs: 6CC75D9C

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: lstrcat$File$Move$CountCreateDeleteDirectoryEventSystemTickwsprintf
String ID: %d.bak$C:\syslog.dat$ex.dll
API String ID: 1818742365-156883673
Opcode ID: 001ff44169e03005aaaf83d9f5cd381a1aec61ef4a2bbaa8a5d0353aa9368d00
Instruction ID: 64a96b7434bc35f1f04391587c6aa44672f0c4267f47c85fd2a6db763dcdcdc7
Opcode Fuzzy Hash: 001ff44169e03005aaaf83d9f5cd381a1aec61ef4a2bbaa8a5d0353aa9368d00
Instruction Fuzzy Hash: D9418C71901218EBDB10DFA4CCC8FDABB79FF4A304F044699E60597645E774AA48CFA2

Function 6CC75CE0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 109stringfileCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6CC75D0A
lstrcatA.KERNEL32(?,6CC9E2EC), ref: 6CC75D22
lstrcatA.KERNEL32(?), ref: 6CC75D2F
lstrcatA.KERNEL32(?,ex.dll), ref: 6CC75D3D
GetTickCount.KERNEL32 ref: 6CC75D3F
wsprintfA.USER32 ref: 6CC75D52
MoveFileA.KERNEL32(?,?), ref: 6CC75D69
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 6CC75D7A
lstrcatA.KERNEL32(?,C:\syslog.dat), ref: 6CC75DA2
DeleteFileA.KERNEL32(?), ref: 6CC75DAB
CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 6CC75E27

Part of subcall function 6CC73EF0: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 6CC73F4C
Part of subcall function 6CC73EF0: OpenServiceA.ADVAPI32(00000000,?,000F01FF), ref: 6CC73F61
Part of subcall function 6CC73EF0: QueryServiceStatus.ADVAPI32(00000000,?,?,000F01FF), ref: 6CC73F7F
Part of subcall function 6CC73EF0: ControlService.ADVAPI32(00000000,00000001,?,?,000F01FF), ref: 6CC73F9C
Part of subcall function 6CC73EF0: Sleep.KERNEL32(00000320,?,000F01FF), ref: 6CC73FAB
Part of subcall function 6CC73EF0: DeleteService.ADVAPI32(00000000,?,000F01FF), ref: 6CC73FB2
Part of subcall function 6CC73EF0: wsprintfA.USER32 ref: 6CC73FD8
Part of subcall function 6CC73EF0: SHDeleteKeyA.SHLWAPI(80000002,?), ref: 6CC73FED

Strings

%d.bak, xrefs: 6CC75D4C
ex.dll, xrefs: 6CC75D31
C:\syslog.dat, xrefs: 6CC75D9C

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Servicelstrcat$DeleteFile$MoveOpenwsprintf$ControlCountCreateDirectoryEventManagerQuerySleepStatusSystemTick
String ID: %d.bak$C:\syslog.dat$ex.dll
API String ID: 2569290925-156883673
Opcode ID: 1c04bcf6d1f950f50172cf8a6b56e3a4c0cfa0097fa6eb7ee9a3e7dcf7a200ec
Instruction ID: 5f775d23062af6ec985efd730955d7c6481c5bac4fc2d77dceeef929ecb83304
Opcode Fuzzy Hash: 1c04bcf6d1f950f50172cf8a6b56e3a4c0cfa0097fa6eb7ee9a3e7dcf7a200ec
Instruction Fuzzy Hash: 4F417471E01218ABDB10DFA0DC89BDABB7CEF09305F440699E60597581E774AA48CBA1

Function 6CC71680 Relevance: 21.2, APIs: 14, Instructions: 208networkstringCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,?,00000004,00000000), ref: 6CC716DC
select.WS2_32(00000000,00000001,00000000,00000000,00000003), ref: 6CC7171E
recv.WS2_32(00000000,?,00000258,00000000), ref: 6CC71746
closesocket.WS2_32(00000000), ref: 6CC71765
lstrcpyA.KERNEL32(?,6CCA3920), ref: 6CC717E5
lstrcpyA.KERNEL32(?,6CCA3A28), ref: 6CC717FC
send.WS2_32(?,00000005,6CCA3924,00000000), ref: 6CC7181F
select.WS2_32(00000000,00000001,00000000,00000000,00000003), ref: 6CC71861
recv.WS2_32(?,00000005,00000258,00000000), ref: 6CC7188A
gethostbyname.WS2_32(?), ref: 6CC718B3
htons.WS2_32(?), ref: 6CC718DB
send.WS2_32(00000000,01000105,0000000A,00000000), ref: 6CC718F9
select.WS2_32(00000000,00000001,00000000,00000000,00000003), ref: 6CC7193B
recv.WS2_32(00000000,00000005,00000258,00000000), ref: 6CC7195E

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: recvselectsend$lstrcpy$closesocketgethostbynamehtons
String ID:
API String ID: 1762340821-0
Opcode ID: a9a78a9ee20fe23ae8ee82b2a5483b9f8cf5fe9ecff76691d80f5ae83f4c88f0
Instruction ID: 1f78eaa8a796bd9c8f903a5ee642b825519b8565ea63d42203ee444e9f208505
Opcode Fuzzy Hash: a9a78a9ee20fe23ae8ee82b2a5483b9f8cf5fe9ecff76691d80f5ae83f4c88f0
Instruction Fuzzy Hash: 1F818570A44218AFDF60CF54CC89BDA7778EF45705F0401E5EA4CAB681DB719A888F64

Function 6CC8D9D5 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6CC8DA19

Part of subcall function 6CC8DCEA: _free.LIBCMT ref: 6CC8DD07
Part of subcall function 6CC8DCEA: _free.LIBCMT ref: 6CC8DD19
Part of subcall function 6CC8DCEA: _free.LIBCMT ref: 6CC8DD2B
Part of subcall function 6CC8DCEA: _free.LIBCMT ref: 6CC8DD3D
Part of subcall function 6CC8DCEA: _free.LIBCMT ref: 6CC8DD4F
Part of subcall function 6CC8DCEA: _free.LIBCMT ref: 6CC8DD61
Part of subcall function 6CC8DCEA: _free.LIBCMT ref: 6CC8DD73
Part of subcall function 6CC8DCEA: _free.LIBCMT ref: 6CC8DD85
Part of subcall function 6CC8DCEA: _free.LIBCMT ref: 6CC8DD97
Part of subcall function 6CC8DCEA: _free.LIBCMT ref: 6CC8DDA9
Part of subcall function 6CC8DCEA: _free.LIBCMT ref: 6CC8DDBB
Part of subcall function 6CC8DCEA: _free.LIBCMT ref: 6CC8DDCD
Part of subcall function 6CC8DCEA: _free.LIBCMT ref: 6CC8DDDF

_free.LIBCMT ref: 6CC8DA0E

Part of subcall function 6CC89856: RtlFreeHeap.NTDLL(00000000,00000000,?,6CC89200), ref: 6CC8986C
Part of subcall function 6CC89856: GetLastError.KERNEL32(?,?,6CC89200), ref: 6CC8987E

_free.LIBCMT ref: 6CC8DA30
_free.LIBCMT ref: 6CC8DA45
_free.LIBCMT ref: 6CC8DA50
_free.LIBCMT ref: 6CC8DA72
_free.LIBCMT ref: 6CC8DA85
_free.LIBCMT ref: 6CC8DA93
_free.LIBCMT ref: 6CC8DA9E
_free.LIBCMT ref: 6CC8DAD6
_free.LIBCMT ref: 6CC8DADD
_free.LIBCMT ref: 6CC8DAFA
_free.LIBCMT ref: 6CC8DB12

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: e885070201e9f678108fedad72ac7b947f154a900191e9b238aeda4953dbc1c2
Instruction ID: ede999eb608455bbad1b1b77ca098ae303f9b0c77f96cf624b264d563fe3260a
Opcode Fuzzy Hash: e885070201e9f678108fedad72ac7b947f154a900191e9b238aeda4953dbc1c2
Instruction Fuzzy Hash: 1C314E31A0A2079FEB219B76D844B977BE9AF0075CF60452AE059D6E50FB34E888C714

Function 6CC71390 Relevance: 18.1, APIs: 12, Instructions: 69synchronizationnetworkCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,?,6CC74311), ref: 6CC713AA
CloseHandle.KERNEL32(?,?,6CC74311), ref: 6CC713CC
CloseHandle.KERNEL32(?,?,6CC74311), ref: 6CC713D4
WSACleanup.WS2_32 ref: 6CC713D6
VirtualFree.KERNEL32(?,00000000,00008000,?,6CC74311), ref: 6CC713FB
DeleteCriticalSection.KERNEL32(?,?,6CC74311), ref: 6CC7140A
VirtualFree.KERNEL32(?,00000000,00008000,?,6CC74311), ref: 6CC71422
DeleteCriticalSection.KERNEL32(?,?,6CC74311), ref: 6CC71428
VirtualFree.KERNEL32(?,00000000,00008000,?,6CC74311), ref: 6CC71440
DeleteCriticalSection.KERNEL32(?,?,6CC74311), ref: 6CC71446
VirtualFree.KERNEL32(?,00000000,00008000,?,6CC74311), ref: 6CC7145E
DeleteCriticalSection.KERNEL32(?,?,6CC74311), ref: 6CC71464

Part of subcall function 6CC71D90: setsockopt.WS2_32(?,0000FFFF,00000080,6CC74311,00000004), ref: 6CC71DB4
Part of subcall function 6CC71D90: CancelIo.KERNEL32(?,?,6CC713C0), ref: 6CC71DC0
Part of subcall function 6CC71D90: closesocket.WS2_32(?), ref: 6CC71DD6
Part of subcall function 6CC71D90: Sleep.KERNEL32(000001F4,?,6CC713C0), ref: 6CC71DE1
Part of subcall function 6CC71D90: SetEvent.KERNEL32(?,?,6CC713C0), ref: 6CC71DED

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CriticalDeleteFreeSectionVirtual$CloseHandle$CancelCleanupEventObjectSingleSleepWaitclosesocketsetsockopt
String ID:
API String ID: 2472818714-0
Opcode ID: 374a108aac846c3a5cf126eac5d0960cbce41e711ea87ce406fc6b81064e1357
Instruction ID: 3a9f4109f565cdfc6ffa94469dd98d742f47805d4f1a9963364f05a1e095803c
Opcode Fuzzy Hash: 374a108aac846c3a5cf126eac5d0960cbce41e711ea87ce406fc6b81064e1357
Instruction Fuzzy Hash: 08214775700B06BBEA109B79CC85F46BBA8FF05355F204215A928D3AD0EB70F424CFA6

Function 6CC74890 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 125sleepsynchronizationmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E64,723C8B34,?,6CCA3E50), ref: 6CC71225
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E8C), ref: 6CC7124E
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EB4), ref: 6CC71270
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EDC), ref: 6CC7129E
Part of subcall function 6CC711C0: WSAStartup.WS2_32(00000202,?), ref: 6CC712B0
Part of subcall function 6CC711C0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6CC712BE

Part of subcall function 6CC71470: setsockopt.WS2_32(00000000), ref: 6CC714AF
Part of subcall function 6CC71470: CancelIo.KERNEL32(00000000), ref: 6CC714BB
Part of subcall function 6CC71470: closesocket.WS2_32(00000000), ref: 6CC714D1
Part of subcall function 6CC71470: Sleep.KERNEL32(000001F4), ref: 6CC714DC
Part of subcall function 6CC71470: SetEvent.KERNEL32(00000000), ref: 6CC714E8
Part of subcall function 6CC71470: ResetEvent.KERNEL32(00000000), ref: 6CC714FE
Part of subcall function 6CC71470: socket.WS2_32(00000002,00000001,00000006), ref: 6CC71524
Part of subcall function 6CC71470: gethostbyname.WS2_32(723C8B34), ref: 6CC7154A
Part of subcall function 6CC71470: htons.WS2_32(?), ref: 6CC7157B
Part of subcall function 6CC71470: connect.WS2_32(00000000,?,00000010), ref: 6CC7159E
Part of subcall function 6CC71470: setsockopt.WS2_32(00000000,0000FFFF,00000008,?,00000001), ref: 6CC715E3

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,82.157.76.20,723C8B34), ref: 6CC74919
WaitForSingleObject.KERNEL32(?,000000FF,?,00000002), ref: 6CC7496B
Sleep.KERNEL32(00000096), ref: 6CC74976
LocalAlloc.KERNEL32(00000040,?), ref: 6CC749C5
LocalFree.KERNEL32(00000000,00000000,?), ref: 6CC749F1
Sleep.KERNEL32(0000012C), ref: 6CC74A03
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC74A37
CloseHandle.KERNEL32(?), ref: 6CC74A4F

Strings

{, xrefs: 6CC74957
82.157.76.20, xrefs: 6CC748DC

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CriticalEventInitializeSection$Sleep$CreateLocalObjectSingleWaitsetsockopt$AllocCancelCloseFreeHandleResetStartupclosesocketconnectgethostbynamehtonssocket
String ID: 82.157.76.20${
API String ID: 4075362813-2548236729
Opcode ID: 9a827722b5631e5873affd1bfe3797798b92ca0ec6a056d7c55aa57754307745
Instruction ID: ec2b33b663b18ff31f728fffafa13913298eef5f57ab4464fd9c68ad1683e0e9
Opcode Fuzzy Hash: 9a827722b5631e5873affd1bfe3797798b92ca0ec6a056d7c55aa57754307745
Instruction Fuzzy Hash: 3951B431A041A89FDF11CFA4CC54BDDBBB4EB09314F1486DAE509B7690EB359988CF61

Function 6CC765C0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 119filememorystringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6CC765F0
lstrcatA.KERNEL32(?,C:\syslog.dat), ref: 6CC76602
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 6CC7661F
GetFileSize.KERNEL32(00000000,00000000), ref: 6CC76638
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 6CC7665D
LocalAlloc.KERNEL32(00000040,00000001), ref: 6CC766D3
LocalFree.KERNEL32(00000000,00000000,00000001), ref: 6CC76702
CloseHandle.KERNEL32(00000000), ref: 6CC7671A

Strings

@, xrefs: 6CC76669
C:\syslog.dat, xrefs: 6CC765F6

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: File$Local$AllocCloseCreateDirectoryFreeHandleReadSizeSystemlstrcat
String ID: @$C:\syslog.dat
API String ID: 203999876-2628213421
Opcode ID: 40ac16d460d121d4fc6aca941cdda30e9cb8dd02c2b0858d1ba51fff18fe0535
Instruction ID: 6bc25e749a31aaacdfe980335a3f1a9e174cd7e69554a16fcaa68ffcd84ddda2
Opcode Fuzzy Hash: 40ac16d460d121d4fc6aca941cdda30e9cb8dd02c2b0858d1ba51fff18fe0535
Instruction Fuzzy Hash: 9341FC71E11B1897DB319F358C45FEBBBBCEF5A308F404759EA45A2141EB30A98487A1

Function 6CC77A20 Relevance: 16.6, APIs: 11, Instructions: 90keyboardwindowsleepCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 6CC77A59
GetSystemMetrics.USER32(00000001), ref: 6CC77A66
Sleep.KERNEL32(0000000A), ref: 6CC77A7D
SystemParametersInfoA.USER32(00000056,00000001,00000000,00000000), ref: 6CC77A97
SendMessageA.USER32(0000FFFF,00000112,0000F170,00000002), ref: 6CC77AAE
SystemParametersInfoA.USER32(00000056,00000000,00000000,00000000), ref: 6CC77ACE
SendMessageA.USER32(0000FFFF,00000112,0000F170,000000FF), ref: 6CC77AE5
BlockInput.USER32(?), ref: 6CC77AFD
GetSystemMetrics.USER32(00000000), ref: 6CC77B10
GetSystemMetrics.USER32(00000001), ref: 6CC77B19
BlockInput.USER32(00000000), ref: 6CC77B42

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: System$Metrics$BlockInfoInputMessageParametersSend$Sleep
String ID:
API String ID: 3060318638-0
Opcode ID: ed455431d8b87772fd26ce8ec804384386850f60a931b4c3a0ddd5faf9cf0067
Instruction ID: 2f2c76518c8b70a053af377039fbcc35fe4a3c90ca66d56020d6cab3176d0be9
Opcode Fuzzy Hash: ed455431d8b87772fd26ce8ec804384386850f60a931b4c3a0ddd5faf9cf0067
Instruction Fuzzy Hash: AB31D070344348AAEB228B60CC85F6577B1FB06B26F184294F2199B9D2D7A0A8C0D771

Function 6CC71010 Relevance: 16.6, APIs: 11, Instructions: 78threadCOMMON

Download Yara Rule

APIs

waveInStop.WINMM(?), ref: 6CC71027
waveInReset.WINMM(?), ref: 6CC71030
waveInUnprepareHeader.WINMM(?,?,00000020), ref: 6CC71047
waveInClose.WINMM(?), ref: 6CC71058
TerminateThread.KERNEL32(?,000000FF), ref: 6CC71063
waveOutReset.WINMM(?), ref: 6CC71072
waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 6CC71087
waveOutClose.WINMM(?), ref: 6CC71098
CloseHandle.KERNEL32(?), ref: 6CC710DD
CloseHandle.KERNEL32(?), ref: 6CC710E2
CloseHandle.KERNEL32(?), ref: 6CC710E7

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: wave$Close$Handle$HeaderResetUnprepare$StopTerminateThread
String ID:
API String ID: 1104916709-0
Opcode ID: 9c7195aa7a310ce4dbb9d3b064894727065e75b42c4889448c5904a9936149c7
Instruction ID: 6fc9a7db93186ff361c6363233221f472164315b3710840b2d343db7f2a505a8
Opcode Fuzzy Hash: 9c7195aa7a310ce4dbb9d3b064894727065e75b42c4889448c5904a9936149c7
Instruction Fuzzy Hash: DA212C72601616BFDB215F25CD1CB49BF75FF0531AF004224EA4922DB1DB22B866EBD0

Function 6CC74490 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E64,723C8B34,?,6CCA3E50), ref: 6CC71225
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E8C), ref: 6CC7124E
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EB4), ref: 6CC71270
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EDC), ref: 6CC7129E
Part of subcall function 6CC711C0: WSAStartup.WS2_32(00000202,?), ref: 6CC712B0
Part of subcall function 6CC711C0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6CC712BE

Part of subcall function 6CC71470: setsockopt.WS2_32(00000000), ref: 6CC714AF
Part of subcall function 6CC71470: CancelIo.KERNEL32(00000000), ref: 6CC714BB
Part of subcall function 6CC71470: closesocket.WS2_32(00000000), ref: 6CC714D1
Part of subcall function 6CC71470: Sleep.KERNEL32(000001F4), ref: 6CC714DC
Part of subcall function 6CC71470: SetEvent.KERNEL32(00000000), ref: 6CC714E8
Part of subcall function 6CC71470: ResetEvent.KERNEL32(00000000), ref: 6CC714FE
Part of subcall function 6CC71470: socket.WS2_32(00000002,00000001,00000006), ref: 6CC71524
Part of subcall function 6CC71470: gethostbyname.WS2_32(723C8B34), ref: 6CC7154A
Part of subcall function 6CC71470: htons.WS2_32(?), ref: 6CC7157B
Part of subcall function 6CC71470: connect.WS2_32(00000000,?,00000010), ref: 6CC7159E
Part of subcall function 6CC71470: setsockopt.WS2_32(00000000,0000FFFF,00000008,?,00000001), ref: 6CC715E3

CreateEventA.KERNEL32 ref: 6CC744FF
CreateEventA.KERNEL32(?,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 6CC7455C
WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000,82.157.76.20), ref: 6CC7458A
CloseHandle.KERNEL32(?), ref: 6CC74596
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC745A5
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC745BF
CloseHandle.KERNEL32(?), ref: 6CC745C5
CloseHandle.KERNEL32(?), ref: 6CC745D3

Strings

82.157.76.20, xrefs: 6CC744C0

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Event$CriticalInitializeSection$CloseCreateHandleObjectSingleWait$setsockopt$CancelResetSleepStartupclosesocketconnectgethostbynamehtonssocket
String ID: 82.157.76.20
API String ID: 2112710846-3546086885
Opcode ID: 076b29c0e4758ef140943738dd37b35bfb607f70aa1217a88c9f8736a787a4c2
Instruction ID: 094105ff97352c77027962f43b77d9c616672c9b696a5366c98808ba091975e1
Opcode Fuzzy Hash: 076b29c0e4758ef140943738dd37b35bfb607f70aa1217a88c9f8736a787a4c2
Instruction Fuzzy Hash: 28314A71208344ABD7209F64CC55B9BBBF0FB85768F100B1DF5945A6E0EBB1D904CB96

Function 6CC76E10 Relevance: 15.2, APIs: 10, Instructions: 200registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,?), ref: 6CC76EDA
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 6CC76F29
LocalAlloc.KERNEL32(00000040,?), ref: 6CC76F66
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 6CC76FFE
RegCloseKey.ADVAPI32(?), ref: 6CC77043
LocalReAlloc.KERNEL32(00000000,?,00000042), ref: 6CC77052
LocalSize.KERNEL32(00000000), ref: 6CC77065
LocalFree.KERNEL32(00000000,00000000,00000000), ref: 6CC7707B
LocalSize.KERNEL32(00000000), ref: 6CC7709F
LocalFree.KERNEL32(00000000,00000000,00000000), ref: 6CC770AF

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Local$AllocFreeSize$CloseEnumInfoOpenQuery
String ID:
API String ID: 1366410219-0
Opcode ID: 3069037bc3915a098f68c69957d28b592039fccf305c79b6616bf17f2de1aa64
Instruction ID: 832b33f2fdc30e522598dd5e60f29e75859949f5d29a92265f80d8ba9196e54a
Opcode Fuzzy Hash: 3069037bc3915a098f68c69957d28b592039fccf305c79b6616bf17f2de1aa64
Instruction Fuzzy Hash: CE71B171A416299BDB31CF55CC54BEEB7B8FF0A304F100199E949A7640EB31AE85CFA1

Function 6CC89A90 Relevance: 15.1, APIs: 10, Instructions: 70COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6CC89AA6

Part of subcall function 6CC89856: RtlFreeHeap.NTDLL(00000000,00000000,?,6CC89200), ref: 6CC8986C
Part of subcall function 6CC89856: GetLastError.KERNEL32(?,?,6CC89200), ref: 6CC8987E

_free.LIBCMT ref: 6CC89AB2
_free.LIBCMT ref: 6CC89ABD
_free.LIBCMT ref: 6CC89AC8
_free.LIBCMT ref: 6CC89AD3
_free.LIBCMT ref: 6CC89ADE
_free.LIBCMT ref: 6CC89AE9
_free.LIBCMT ref: 6CC89AF4
_free.LIBCMT ref: 6CC89AFF
_free.LIBCMT ref: 6CC89B0D

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 10fabfce4636458a5e0aae8b98e16897c72edb8893f1ea07e99e5194984ac897
Instruction ID: 3f02529e46f9af4047afb2246d709f3ede1b5111d0f9f8099007f48b2a0a3916
Opcode Fuzzy Hash: 10fabfce4636458a5e0aae8b98e16897c72edb8893f1ea07e99e5194984ac897
Instruction Fuzzy Hash: A921A676901109AFCB41DFA5C980DDE7FB9FF08258F4141AAF5199B620FB31EA58CB84

Function 6CC7AA20 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 176windowCOMMON

Download Yara Rule

APIs

capGetDriverDescriptionA.AVICAP32(00000000,?,00000064,?,00000032,723C8B34,?,?,74DF23A0), ref: 6CC7AA7B
ICOpen.MSVFW32(63646976,M263IV32MP42cvid,00000003), ref: 6CC7ABD3
ICSendMessage.MSVFW32(00000000,00004004,?,0000004C), ref: 6CC7ABED
ICSendMessage.MSVFW32(?,000060C9,F7329ACE,ACDEAEA2), ref: 6CC7AC05
ICSeqCompressFrameStart.MSVFW32(00000004,?), ref: 6CC7AC1F
ICSendMessage.MSVFW32(?,0000400C,0000004C,?), ref: 6CC7AC5E

Strings

vidc, xrefs: 6CC7ABAD
M263IV32MP42cvid, xrefs: 6CC7AB90, 6CC7ABA0

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: MessageSend$CompressDescriptionDriverFrameOpenStart
String ID: M263IV32MP42cvid$vidc
API String ID: 1887564416-1949255664
Opcode ID: 8f094a7a385687f62098ccf6c194e3422e981c58cc664a6c8164873a331e36bb
Instruction ID: 1fc19fce440db5fdeb0f6b6f2e0e82bee197a28f86a6f53601dbaba1c994a020
Opcode Fuzzy Hash: 8f094a7a385687f62098ccf6c194e3422e981c58cc664a6c8164873a331e36bb
Instruction Fuzzy Hash: 4661C1B0A00715AFEB20CF65C944B9ABBF5FF45B04F00456CE65A9BA80E772E944CF61

Function 6CC762E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 106stringCOMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(?,?,?,?), ref: 6CC7630D
ImmGetContext.IMM32(?), ref: 6CC7636A
ImmGetCompositionStringA.IMM32(00000000,00000800,00000000,00000000), ref: 6CC7637E
ImmGetCompositionStringA.IMM32(?,00000800,04EEFAEF,00000002), ref: 6CC763AF
ImmReleaseContext.IMM32(?,?), ref: 6CC763BA
GetKeyNameTextA.USER32(?,?), ref: 6CC76420
lstrcatA.KERNEL32(?,6CC9E528), ref: 6CC76439

Strings

[, xrefs: 6CC76433

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CompositionContextString$CallHookNameNextReleaseTextlstrcat
String ID: [
API String ID: 2484311436-784033777
Opcode ID: 40fe8068639f255fef89adbfdf0d5c6b3315825df9ff20a2f183ad39c84bff3c
Instruction ID: 87449ac5b1fd3c0f340db719683504492fe944790020c7fea4d24fe0893f0548
Opcode Fuzzy Hash: 40fe8068639f255fef89adbfdf0d5c6b3315825df9ff20a2f183ad39c84bff3c
Instruction Fuzzy Hash: 4441C330604601AFC710CF25C859B5EBBF5FF8A318F14861DF555A7A80E770E915CBA2

Function 6CC74BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 77synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E64,723C8B34,?,6CCA3E50), ref: 6CC71225
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E8C), ref: 6CC7124E
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EB4), ref: 6CC71270
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EDC), ref: 6CC7129E
Part of subcall function 6CC711C0: WSAStartup.WS2_32(00000202,?), ref: 6CC712B0
Part of subcall function 6CC711C0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6CC712BE

Part of subcall function 6CC71470: setsockopt.WS2_32(00000000), ref: 6CC714AF
Part of subcall function 6CC71470: CancelIo.KERNEL32(00000000), ref: 6CC714BB
Part of subcall function 6CC71470: closesocket.WS2_32(00000000), ref: 6CC714D1
Part of subcall function 6CC71470: Sleep.KERNEL32(000001F4), ref: 6CC714DC
Part of subcall function 6CC71470: SetEvent.KERNEL32(00000000), ref: 6CC714E8
Part of subcall function 6CC71470: ResetEvent.KERNEL32(00000000), ref: 6CC714FE
Part of subcall function 6CC71470: socket.WS2_32(00000002,00000001,00000006), ref: 6CC71524
Part of subcall function 6CC71470: gethostbyname.WS2_32(723C8B34), ref: 6CC7154A
Part of subcall function 6CC71470: htons.WS2_32(?), ref: 6CC7157B
Part of subcall function 6CC71470: connect.WS2_32(00000000,?,00000010), ref: 6CC7159E
Part of subcall function 6CC71470: setsockopt.WS2_32(00000000,0000FFFF,00000008,?,00000001), ref: 6CC715E3

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,82.157.76.20), ref: 6CC74C27
EnumWindows.USER32(6CC799E0,?), ref: 6CC74C5E
LocalSize.KERNEL32(00000000), ref: 6CC74C78
LocalFree.KERNEL32(00000000,00000000,00000000), ref: 6CC74C8C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC74C97
CloseHandle.KERNEL32(?), ref: 6CC74CAF

Strings

%, xrefs: 6CC74C4D
82.157.76.20, xrefs: 6CC74BEA

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CriticalEventInitializeSection$CreateLocalsetsockopt$CancelCloseEnumFreeHandleObjectResetSingleSizeSleepStartupWaitWindowsclosesocketconnectgethostbynamehtonssocket
String ID: %$82.157.76.20
API String ID: 2059800868-1127380379
Opcode ID: ec4e5d4af9faf58cf80ddf68ddb276d64e04cf83f3e203fd84151a456c7d3966
Instruction ID: 5fc3a97aa7ce7eed8fac68a136a10997282c09657af40e3f36566876b47302e7
Opcode Fuzzy Hash: ec4e5d4af9faf58cf80ddf68ddb276d64e04cf83f3e203fd84151a456c7d3966
Instruction Fuzzy Hash: 3E317072D002689BCF20CFA4CD48BDDBBB4FB05314F00469AE51AB7690EB705A84CFA0

Function 6CC72140 Relevance: 13.6, APIs: 9, Instructions: 149synchronizationsleepCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,723C8B34,?,?,?,?,?,?,?,6CC945F7,000000FF), ref: 6CC7219A
waveInGetNumDevs.WINMM(?,?,?,?,?,?,?,6CC945F7,000000FF), ref: 6CC721B0
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,6CC945F7,000000FF), ref: 6CC721F2
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,6CC945F7,000000FF), ref: 6CC721FF

Part of subcall function 6CC8243F: __CxxThrowException@8.LIBVCRUNTIME ref: 6CC82D31
Part of subcall function 6CC8243F: __CxxThrowException@8.LIBVCRUNTIME ref: 6CC82D4E

WaitForSingleObject.KERNEL32(?,000000FF,?,00000001), ref: 6CC722CC
Sleep.KERNEL32(00000096), ref: 6CC722D3
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6CC722EF
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC72318
CloseHandle.KERNEL32(?), ref: 6CC7231D

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CreateEvent$Exception@8ObjectSingleThrowWait$CloseDevsHandleSleepwave
String ID:
API String ID: 4229624816-0
Opcode ID: 03f7d99d3d421bccdc45839a69340c7511d2dd548593b9c76b23ac8f7acc0644
Instruction ID: 06d83bb558511a09377a60af5f1c9c34fd12b20e09fac216f02bfc02d0fdd27a
Opcode Fuzzy Hash: 03f7d99d3d421bccdc45839a69340c7511d2dd548593b9c76b23ac8f7acc0644
Instruction Fuzzy Hash: 595191B1A04705AFEB20CFA5CC1AB9ABBB0FB04714F104219E5146BBD0E7B2A554CBE5

Function 6CC724C0 Relevance: 13.6, APIs: 9, Instructions: 107threadsynchronizationCOMMON

Download Yara Rule

APIs

waveInGetNumDevs.WINMM ref: 6CC724E6
CreateThread.KERNEL32(00000000,00000000,Function_00001110,?,00000004,?), ref: 6CC7250B
waveInOpen.WINMM(?,0000FFFF,?,00000000,00000000,00020000), ref: 6CC7252B
waveInPrepareHeader.WINMM(?,?,00000020), ref: 6CC7256A
waveInAddBuffer.WINMM(?,?,00000020), ref: 6CC72584
ResumeThread.KERNEL32(?), ref: 6CC7258D
waveInStart.WINMM(?), ref: 6CC72595
SetEvent.KERNEL32(?), ref: 6CC725A2
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC725AD

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: wave$Thread$BufferCreateDevsEventHeaderObjectOpenPrepareResumeSingleStartWait
String ID:
API String ID: 2120629988-0
Opcode ID: 3a0dad7432e81fa454ab2b2ccf060f031fe059884e54c786abe011e24d97099f
Instruction ID: cec283d516823065e01450ef77c1ac30281be5ae9cdd22568d0496f75329ca9d
Opcode Fuzzy Hash: 3a0dad7432e81fa454ab2b2ccf060f031fe059884e54c786abe011e24d97099f
Instruction Fuzzy Hash: 5641CB71600701EFDB30CF64C958F4ABBB4FF09309F200618E65697A90E771E918DBA0

Function 6CC77FB7 Relevance: 13.6, APIs: 9, Instructions: 83COMMON

Download Yara Rule

APIs

ReleaseDC.USER32(?,?), ref: 6CC77FE7
DeleteDC.GDI32(?), ref: 6CC77FF6
DeleteDC.GDI32(?), ref: 6CC77FFB
DeleteDC.GDI32(?), ref: 6CC78000
DeleteDC.GDI32(?), ref: 6CC78008
DeleteObject.GDI32(?), ref: 6CC78013
DeleteObject.GDI32(?), ref: 6CC78018
DeleteObject.GDI32(?), ref: 6CC78020
DestroyCursor.USER32(?), ref: 6CC78064

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Delete$Object$CursorDestroyRelease
String ID:
API String ID: 1665608007-0
Opcode ID: a012ce70164ad1c96dee760f1b9d974d9a9708e9062d16e21c69575805c935f7
Instruction ID: bab9ef9ac808a240662e9b675cfda4fd4176fe9cf1b370d7f967533b1f4bed20
Opcode Fuzzy Hash: a012ce70164ad1c96dee760f1b9d974d9a9708e9062d16e21c69575805c935f7
Instruction Fuzzy Hash: 63115B71A0051ABFDB115F32DC09A8ABF75FF41358F004125EA5862A20EB72B835DFE0

Function 6CC79D00 Relevance: 13.6, APIs: 9, Instructions: 74threadstringCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC79D18
GetThreadDesktop.USER32(00000000), ref: 6CC79D1F
GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 6CC79D5E
OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 6CC79D67
GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 6CC79D9A
lstrcmpiA.KERNEL32(?,?), ref: 6CC79DAA
SetThreadDesktop.USER32(00000000), ref: 6CC79DB5
CloseDesktop.USER32(?), ref: 6CC79DCC
CloseDesktop.USER32(00000000), ref: 6CC79DCF

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Desktop$Thread$CloseInformationObjectUser$CurrentInputOpenlstrcmpi
String ID:
API String ID: 3718465862-0
Opcode ID: 05521536c425f33854986c38dbf636f07674b901910bb43d53da4602f7780413
Instruction ID: c78d9db998f0a898cda89d9a51c0ca50218770d8976a503b2b13bd1abf83c433
Opcode Fuzzy Hash: 05521536c425f33854986c38dbf636f07674b901910bb43d53da4602f7780413
Instruction Fuzzy Hash: DE214FB6A0021C6BEB10DF60DC89FEF77BCEB09715F4001A6BA05D6141EAB09E448FA0

Function 6CC77FD0 Relevance: 13.6, APIs: 9, Instructions: 59COMMON

Download Yara Rule

APIs

ReleaseDC.USER32(?,?), ref: 6CC77FE7
DeleteDC.GDI32(?), ref: 6CC77FF6
DeleteDC.GDI32(?), ref: 6CC77FFB
DeleteDC.GDI32(?), ref: 6CC78000
DeleteDC.GDI32(?), ref: 6CC78008
DeleteObject.GDI32(?), ref: 6CC78013
DeleteObject.GDI32(?), ref: 6CC78018
DeleteObject.GDI32(?), ref: 6CC78020
DestroyCursor.USER32(?), ref: 6CC78064

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Delete$Object$CursorDestroyRelease
String ID:
API String ID: 1665608007-0
Opcode ID: 6870dadc7abd082af803eb0caab9d377632fd3b9c4e0fa79a84344e98fa8eb61
Instruction ID: e2aafc8985896cbffff969b828c5816ba54f86424e2ca5650a50a0ec4f8b56ce
Opcode Fuzzy Hash: 6870dadc7abd082af803eb0caab9d377632fd3b9c4e0fa79a84344e98fa8eb61
Instruction Fuzzy Hash: 16116D71A0051ABFDB115F32DC09A8ABF75FF41358F004121EA5862A20EB72B835DFE0

Function 6CC74A80 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E64,723C8B34,?,6CCA3E50), ref: 6CC71225
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E8C), ref: 6CC7124E
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EB4), ref: 6CC71270
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EDC), ref: 6CC7129E
Part of subcall function 6CC711C0: WSAStartup.WS2_32(00000202,?), ref: 6CC712B0
Part of subcall function 6CC711C0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6CC712BE

Part of subcall function 6CC71470: setsockopt.WS2_32(00000000), ref: 6CC714AF
Part of subcall function 6CC71470: CancelIo.KERNEL32(00000000), ref: 6CC714BB
Part of subcall function 6CC71470: closesocket.WS2_32(00000000), ref: 6CC714D1
Part of subcall function 6CC71470: Sleep.KERNEL32(000001F4), ref: 6CC714DC
Part of subcall function 6CC71470: SetEvent.KERNEL32(00000000), ref: 6CC714E8
Part of subcall function 6CC71470: ResetEvent.KERNEL32(00000000), ref: 6CC714FE
Part of subcall function 6CC71470: socket.WS2_32(00000002,00000001,00000006), ref: 6CC71524
Part of subcall function 6CC71470: gethostbyname.WS2_32(723C8B34), ref: 6CC7154A
Part of subcall function 6CC71470: htons.WS2_32(?), ref: 6CC7157B
Part of subcall function 6CC71470: connect.WS2_32(00000000,?,00000010), ref: 6CC7159E
Part of subcall function 6CC71470: setsockopt.WS2_32(00000000,0000FFFF,00000008,?,00000001), ref: 6CC715E3

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6CC74B07
LocalSize.KERNEL32(00000000), ref: 6CC74B34
LocalFree.KERNEL32(00000000,00000000,00000000), ref: 6CC74B48
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC74B53
CloseHandle.KERNEL32(?), ref: 6CC74B6B

Strings

#, xrefs: 6CC74B21
82.157.76.20, xrefs: 6CC74ACA

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CriticalEventInitializeSection$CreateLocalsetsockopt$CancelCloseFreeHandleObjectResetSingleSizeSleepStartupWaitclosesocketconnectgethostbynamehtonssocket
String ID: #$82.157.76.20
API String ID: 4286256124-3153083949
Opcode ID: 12510965dd4bd55958b30a640898afb49d934a6b33f021351f7d40c73d166ea3
Instruction ID: 69c3001f5a06edfa9b3bbc3fbbd2bf9d46d106c42af60b302f528ef314e825f5
Opcode Fuzzy Hash: 12510965dd4bd55958b30a640898afb49d934a6b33f021351f7d40c73d166ea3
Instruction Fuzzy Hash: 6C318072D006689BCF21CFA4CD19BDDBBB4FB05314F00069AE916B7690EB305A44CFA1

Function 6CC73010 Relevance: 12.1, APIs: 8, Instructions: 143stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,723C8B34), ref: 6CC7304E
lstrcpyA.KERNEL32(00000000,?), ref: 6CC7306D
CharNextA.USER32(00000002), ref: 6CC7309F
CharNextA.USER32(00000002), ref: 6CC730BB
GetFileAttributesA.KERNEL32(00000000), ref: 6CC730FE
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 6CC7310C
GetLastError.KERNEL32 ref: 6CC73116
CharNextA.USER32(00000000), ref: 6CC7312E

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CharNext$AttributesCreateDirectoryErrorFileLastlstrcpylstrlen
String ID:
API String ID: 227312388-0
Opcode ID: a56fe53918e88a2622c19cf204182e93acfb9387c5f40f5c22c277e4aaf9e6ab
Instruction ID: 52f0c9ecc704976a55dad4538698d3ebef2f67714e9bbfa2e53d6b41ec97d4c6
Opcode Fuzzy Hash: a56fe53918e88a2622c19cf204182e93acfb9387c5f40f5c22c277e4aaf9e6ab
Instruction Fuzzy Hash: EB411AB1D05A559FCB21CF2988447AEBBB4FF4A758F18425AD8A1E3680E3354503CBF5

Function 6CC79E80 Relevance: 12.1, APIs: 8, Instructions: 135networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 6CC79F12
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 6CC79F51
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 6CC79F76
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 6CC79FBA
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 6CC79FEA
CloseHandle.KERNEL32(00000000), ref: 6CC7A005
InternetCloseHandle.WININET(00000000), ref: 6CC7A012
InternetCloseHandle.WININET(?), ref: 6CC7A01A

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateReadWrite
String ID:
API String ID: 2705228764-0
Opcode ID: 11bfb88bc5c3725e424f84591d8f1990ab7f7d2142cb3d92bbb40d11f53c51c6
Instruction ID: 68effbffc3e07890f6799a656c3dc0ed7849c578ff6fc08227bf0826eef23528
Opcode Fuzzy Hash: 11bfb88bc5c3725e424f84591d8f1990ab7f7d2142cb3d92bbb40d11f53c51c6
Instruction Fuzzy Hash: BF41D8B1B01218AAEB30CF658C85BEEBBB8EF49718F500199F70566681E7705A45CF68

Function 6CC771B0 Relevance: 12.1, APIs: 8, Instructions: 135synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,723C8B34), ref: 6CC77200
LoadCursorA.USER32(00000000,?), ref: 6CC7725A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000008,00000000,00000110), ref: 6CC772C0
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC772EF
CloseHandle.KERNEL32(?), ref: 6CC772FA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6CC77318
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC77341
CloseHandle.KERNEL32(?), ref: 6CC77346

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CreateEvent$CloseHandleObjectSingleWait$CursorLoad
String ID:
API String ID: 1656938378-0
Opcode ID: 4d21396582b579ef237bb9c7f0d71019cacbc74b132d246ff29d9f80cf420833
Instruction ID: daa941c9eca64d7733f99246b710aaca3b79d4eb86ae02dd65a6acc7a767f919
Opcode Fuzzy Hash: 4d21396582b579ef237bb9c7f0d71019cacbc74b132d246ff29d9f80cf420833
Instruction Fuzzy Hash: 5C515C71E00348AEEB11CFA8CC46B9EBBB4FF15704F104259E958AF291E7B16984CB95

Function 6CC79230 Relevance: 12.0, APIs: 8, Instructions: 47sleepthreadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 6CC79250
TerminateThread.KERNEL32(?,00000000), ref: 6CC7925B
TerminateProcess.KERNEL32(?,00000001), ref: 6CC79266
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 6CC7928C
CancelIo.KERNEL32(?), ref: 6CC79298
closesocket.WS2_32(?), ref: 6CC792AE
Sleep.KERNEL32(000001F4), ref: 6CC792B9
SetEvent.KERNEL32(?), ref: 6CC792C5

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Terminate$CancelEventMultipleObjectsProcessSleepThreadWaitclosesocketsetsockopt
String ID:
API String ID: 3111787530-0
Opcode ID: e273b199a67ae034f31a297e7bb61313d1c78e64412147705c3df06b6fa25e53
Instruction ID: 4eaa26ae0f8adde0e97d541f1741c7228d6e7c0bc83f8c49642135d7bf3b0aec
Opcode Fuzzy Hash: e273b199a67ae034f31a297e7bb61313d1c78e64412147705c3df06b6fa25e53
Instruction Fuzzy Hash: 69117031200704BFDB119F60CC09BDABBB4FF0A712F004769FA9A962E0DB7065448B91

Function 6CC78390 Relevance: 10.7, APIs: 7, Instructions: 169windowCOMMON

Download Yara Rule

APIs

BitBlt.GDI32(?,00000000,00000000,?,00000001,?,00000000,?,00000000), ref: 6CC783BA
SetRect.USER32(?,000000FF,?,000000FF,?), ref: 6CC783E9
CreateDIBSection.GDI32(?,?,00000000,00000000,00000000,00000000), ref: 6CC784B8
SelectObject.GDI32(?,00000000), ref: 6CC784C7
BitBlt.GDI32(?,?,00000002,?,?,?,?,00000002,00000000), ref: 6CC784E7
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,00000002,00CC0020), ref: 6CC7850B
DeleteObject.GDI32(00000000), ref: 6CC7853F

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteRectSectionSelect
String ID:
API String ID: 3579966175-0
Opcode ID: d46d4ea8fb7857d19080d0203affabf9819ac90810118f35652a2e611f3ded6c
Instruction ID: e5708fc2c9c6da93fd4027a85a532598f6931beb0b12c5d1d8878d9ea2c3a66e
Opcode Fuzzy Hash: d46d4ea8fb7857d19080d0203affabf9819ac90810118f35652a2e611f3ded6c
Instruction Fuzzy Hash: 77614876A00205AFDB44CF58C8C4EA9BBB9FF49310F11829AED199B296D371E851CF90

Function 6CC83E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6CC83EAB
___except_validate_context_record.LIBVCRUNTIME ref: 6CC83EB3
_ValidateLocalCookies.LIBCMT ref: 6CC83F41
__IsNonwritableInCurrentImage.LIBCMT ref: 6CC83F6C
_ValidateLocalCookies.LIBCMT ref: 6CC83FC1

Strings

csm, xrefs: 6CC83F56

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: f9c10fa4645e7488080a1d291f81b01fd15852b9cc26ae12f9fe76bb60b9095b
Instruction ID: 68d7033bcee057a60f8ff39694f3f351a80e25120fdd33a7e51388f180d1e6f8
Opcode Fuzzy Hash: f9c10fa4645e7488080a1d291f81b01fd15852b9cc26ae12f9fe76bb60b9095b
Instruction Fuzzy Hash: EC41B634A022099BCF00CF69C844A9FBFB5BF4532CF189195E9199B791E771DA06CBE0

Function 6CC73740 Relevance: 10.6, APIs: 7, Instructions: 90stringfilememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 6CC73790
GetFileSize.KERNEL32(00000000,?), ref: 6CC737AD
CloseHandle.KERNEL32(00000000), ref: 6CC737B6
lstrlenA.KERNEL32(?), ref: 6CC737C3
LocalAlloc.KERNEL32(00000040,-0000000A), ref: 6CC737CE
lstrlenA.KERNEL32(?), ref: 6CC737F4
LocalFree.KERNEL32(00000000,00000000,?), ref: 6CC73814

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: FileLocallstrlen$AllocCloseCreateFreeHandleSize
String ID:
API String ID: 2793549963-0
Opcode ID: 7718537afaff4b0bfc59a07b88fc5c6892ab1db4a3256ea2bbed7d7ac75b10de
Instruction ID: 51746ae27ed0873c243c966f5da5678702675366671e4889332c4c2e6dd6cfff
Opcode Fuzzy Hash: 7718537afaff4b0bfc59a07b88fc5c6892ab1db4a3256ea2bbed7d7ac75b10de
Instruction Fuzzy Hash: C121B272A00214BBDB10DF789C85FDABBBCEF45315F0442A6FE04EB381E675991487A5

Function 6CC75160 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E64,723C8B34,?,6CCA3E50), ref: 6CC71225
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E8C), ref: 6CC7124E
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EB4), ref: 6CC71270
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EDC), ref: 6CC7129E
Part of subcall function 6CC711C0: WSAStartup.WS2_32(00000202,?), ref: 6CC712B0
Part of subcall function 6CC711C0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6CC712BE

Part of subcall function 6CC71470: setsockopt.WS2_32(00000000), ref: 6CC714AF
Part of subcall function 6CC71470: CancelIo.KERNEL32(00000000), ref: 6CC714BB
Part of subcall function 6CC71470: closesocket.WS2_32(00000000), ref: 6CC714D1
Part of subcall function 6CC71470: Sleep.KERNEL32(000001F4), ref: 6CC714DC
Part of subcall function 6CC71470: SetEvent.KERNEL32(00000000), ref: 6CC714E8
Part of subcall function 6CC71470: ResetEvent.KERNEL32(00000000), ref: 6CC714FE
Part of subcall function 6CC71470: socket.WS2_32(00000002,00000001,00000006), ref: 6CC71524
Part of subcall function 6CC71470: gethostbyname.WS2_32(723C8B34), ref: 6CC7154A
Part of subcall function 6CC71470: htons.WS2_32(?), ref: 6CC7157B
Part of subcall function 6CC71470: connect.WS2_32(00000000,?,00000010), ref: 6CC7159E
Part of subcall function 6CC71470: setsockopt.WS2_32(00000000,0000FFFF,00000008,?,00000001), ref: 6CC715E3

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6CC751E7
LocalSize.KERNEL32(00000000), ref: 6CC7520D
LocalFree.KERNEL32(00000000,00000000,00000000), ref: 6CC75221
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC7522C
CloseHandle.KERNEL32(?), ref: 6CC75244

Strings

82.157.76.20, xrefs: 6CC751AA

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CriticalEventInitializeSection$CreateLocalsetsockopt$CancelCloseFreeHandleObjectResetSingleSizeSleepStartupWaitclosesocketconnectgethostbynamehtonssocket
String ID: 82.157.76.20
API String ID: 4286256124-3546086885
Opcode ID: 538d3c887a064e529ec750d282e09c6207f50a89fd237a06481b41d6f3b9bdf7
Instruction ID: ae442be43e06405a8dd68e84ab512b81961fa59f5a6b939632470dcbc09a34ef
Opcode Fuzzy Hash: 538d3c887a064e529ec750d282e09c6207f50a89fd237a06481b41d6f3b9bdf7
Instruction Fuzzy Hash: 6E21A172D012689BCF20DFA4CD05BDDBBB4FB05314F00469AE916B7690EB305A44CFA1

Function 6CC72D2F Relevance: 10.6, APIs: 7, Instructions: 69filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 6CC72D56
SetFilePointer.KERNEL32(00000000,?,?,00000000), ref: 6CC72D72
LocalAlloc.KERNEL32 ref: 6CC72D89
ReadFile.KERNEL32(?,00000009,00001FF7,00000000,00000000), ref: 6CC72DB8
CloseHandle.KERNEL32(?), ref: 6CC72DBF
LocalFree.KERNEL32(00000000,00000000,-00000009), ref: 6CC72DDC

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandlePointerRead
String ID:
API String ID: 1384296819-0
Opcode ID: 5678bf7811ca60579795cd5b59016d8acbe71a1cc80a5bf00bb1883c2c0c7262
Instruction ID: 4c5f77d02da77173eb1c8a9fc3977743f6b9b0fb9de51c0a082ec96c329847e6
Opcode Fuzzy Hash: 5678bf7811ca60579795cd5b59016d8acbe71a1cc80a5bf00bb1883c2c0c7262
Instruction Fuzzy Hash: 8D21DE71605614AFDB249F60CC59F9ABBB8FF09301F10425AF616E66C0EB30A904CB66

Function 6CC71110 Relevance: 10.6, APIs: 7, Instructions: 66windowsynchronizationCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 6CC71129
SetEvent.KERNEL32(?), ref: 6CC7114D
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC71158
waveInAddBuffer.WINMM(?,?,00000020), ref: 6CC71172
TranslateMessage.USER32(?), ref: 6CC7118A
DispatchMessageA.USER32(?), ref: 6CC71190
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 6CC711A0

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Message$BufferDispatchEventObjectSingleTranslateWaitwave
String ID:
API String ID: 3294988761-0
Opcode ID: b02e33dae6a5dfe2d389d0c43a544886599ba64764d3f4333b8cf20148d1e793
Instruction ID: 9dc233e7b4a03b8e290a7ad73a454ba5f39d1963a9d7aa33ddbc6049a3ad433f
Opcode Fuzzy Hash: b02e33dae6a5dfe2d389d0c43a544886599ba64764d3f4333b8cf20148d1e793
Instruction Fuzzy Hash: A7119472A00309AFEB209EA9DC45F9BB7B8FB05721F500725F618D65D0E771E4518BA0

Function 6CC8DE89 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CC8DE51: _free.LIBCMT ref: 6CC8DE76

_free.LIBCMT ref: 6CC8DED7

Part of subcall function 6CC89856: RtlFreeHeap.NTDLL(00000000,00000000,?,6CC89200), ref: 6CC8986C
Part of subcall function 6CC89856: GetLastError.KERNEL32(?,?,6CC89200), ref: 6CC8987E

_free.LIBCMT ref: 6CC8DEE2
_free.LIBCMT ref: 6CC8DEED
_free.LIBCMT ref: 6CC8DF41
_free.LIBCMT ref: 6CC8DF4C
_free.LIBCMT ref: 6CC8DF57
_free.LIBCMT ref: 6CC8DF62

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d745b72ce7edab4ace5f866a6d29517cd2f23176aaaf4de6ca2cac2f8ce4a4b1
Instruction ID: a1a81fd1bb82ac9cc659f2e91817ae5a8592d3e63c30f9c4b6050359a3a1ff7c
Opcode Fuzzy Hash: d745b72ce7edab4ace5f866a6d29517cd2f23176aaaf4de6ca2cac2f8ce4a4b1
Instruction Fuzzy Hash: 8C11F471952B05AAD630AB71CC45FCB7FAC9F14B4CF80482AB29966E50F775F50C8760

Function 6CC76460 Relevance: 10.6, APIs: 7, Instructions: 57fileCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 6CC76470
DeleteFileA.KERNEL32(04EF000D), ref: 6CC76495
GetFileAttributesA.KERNEL32(04EF000D), ref: 6CC7649D
CreateFileA.KERNEL32(04EEFFF3,40000000,00000002,00000000,00000002,00000080,00000000), ref: 6CC764C3
CloseHandle.KERNEL32(00000000), ref: 6CC764CA
CreateFileA.KERNEL32(04EEFFF3,40000000,00000002,00000000,00000002,00000080,00000000), ref: 6CC764F7
CloseHandle.KERNEL32(00000000), ref: 6CC764FE

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandle$AttributesDeleteEvent
String ID:
API String ID: 2203751429-0
Opcode ID: 3d2e5cd0f4cf9da0af811dfd967509fcb094f56545992e50b08b6526712692d1
Instruction ID: d09ad21fa5e9877ff06f0cb55b7babffce5b3e749c5ba567a7798c3b828e3240
Opcode Fuzzy Hash: 3d2e5cd0f4cf9da0af811dfd967509fcb094f56545992e50b08b6526712692d1
Instruction Fuzzy Hash: 8411E575684A44ABEB209FB0DC0EF45BB74EB0672AF68C740F2C0DB5C2D764D8458B65

Function 6CC7B950 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6CC7B98F
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC7B9B8
CloseHandle.KERNEL32(?), ref: 6CC7B9C1
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 6CC7B9CA
CloseHandle.KERNEL32(00000000), ref: 6CC7B9D1

Strings

82.157.76.20, xrefs: 6CC7B956, 6CC7B985

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CloseHandleObjectSingleWait$CreateEvent
String ID: 82.157.76.20
API String ID: 3556256739-3546086885
Opcode ID: ed4805cf4e77fe5e1e8ac29b821ef3e3a7efd5d26bbb1ba2e0684776bc89a9d3
Instruction ID: a95a95773a328ad299edf46d75801e4877c077c7caab62392d05e74c67c75ada
Opcode Fuzzy Hash: ed4805cf4e77fe5e1e8ac29b821ef3e3a7efd5d26bbb1ba2e0684776bc89a9d3
Instruction Fuzzy Hash: 3601B571B44309BFDB109FA8CC5AF9EBBB4FB06715F244340F524AB2D1E67196048B95

Function 6CC90ACF Relevance: 9.3, APIs: 6, Instructions: 319fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(6CCA0168,00000000,00000000), ref: 6CC90B17
__fassign.LIBCMT ref: 6CC90CF6
__fassign.LIBCMT ref: 6CC90D13
WriteFile.KERNEL32(?,00000010,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC90D5B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CC90D9B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC90E47

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: d2dbd31e49a5e613c80834c08f7c12763d94a2ad3d6af44b2d6e2edc4434d6c9
Instruction ID: e4c112de1d590fa456894cd01af18e2df0ae6ad9a5c6044ade596c5b7bb182ca
Opcode Fuzzy Hash: d2dbd31e49a5e613c80834c08f7c12763d94a2ad3d6af44b2d6e2edc4434d6c9
Instruction Fuzzy Hash: C1D18B75E012989FCF05CFE8C8809EDBBB5BF49318F28415AE855BB741E730A946CB60

Function 6CC79120 Relevance: 9.1, APIs: 6, Instructions: 77pipesleepmemoryCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 6CC79152
PeekNamedPipe.KERNEL32(?,?,00000400,00000000,?,00000000), ref: 6CC79177
LocalAlloc.KERNEL32(00000040,?), ref: 6CC791A7
ReadFile.KERNEL32(?,00000000,?,00000000,00000000), ref: 6CC791C2
LocalFree.KERNEL32(00000000,00000000,00000000), ref: 6CC791F3
PeekNamedPipe.KERNEL32(?,?,00000400,00000000,?,00000000), ref: 6CC79218

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: LocalNamedPeekPipe$AllocFileFreeReadSleep
String ID:
API String ID: 2866027955-0
Opcode ID: d1b341d8b73e38f53de2bcea944356dca27b0153543163c2614830e64c305113
Instruction ID: 3d13916bfd16b4bc3bbd121677b9bea9939ed557e713d948755075a66540aa0c
Opcode Fuzzy Hash: d1b341d8b73e38f53de2bcea944356dca27b0153543163c2614830e64c305113
Instruction Fuzzy Hash: E72132B1600618ABDB10CF95CC49FDABB7DFF05704F4441A5A708E6590E7709A94CFA5

Function 6CC773A0 Relevance: 9.1, APIs: 6, Instructions: 61synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,723C8B34,?,00000000,?,00000000,6CC949D0,000000FF,?,6CC74467), ref: 6CC773E6
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,?,00000000,6CC949D0,000000FF,?,6CC74467), ref: 6CC773ED
CloseHandle.KERNEL32(?,?,00000000,?,00000000,6CC949D0,000000FF,?,6CC74467), ref: 6CC773F8
CloseHandle.KERNEL32(?,?,00000000,?,00000000,6CC949D0,000000FF,?,6CC74467), ref: 6CC773FD
DestroyCursor.USER32(?), ref: 6CC77422
CloseHandle.KERNEL32(?,?,00000000,?,00000000,6CC949D0,000000FF,?,6CC74467), ref: 6CC77439

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CloseHandle$ObjectSingleWait$CursorDestroy
String ID:
API String ID: 2059078238-0
Opcode ID: 048067467cd1bfa865e9726325f4557960f8c0b74f7cbb376a86f8802b668f20
Instruction ID: add45eda3f08e4bd1e0d265860e7466f70fc000fd5a31f550e2cfdfc0c71b472
Opcode Fuzzy Hash: 048067467cd1bfa865e9726325f4557960f8c0b74f7cbb376a86f8802b668f20
Instruction Fuzzy Hash: 7F11B132604214DFDF16CF15CC84B467BB9FF4A360F1142AAED198B6A4DB31A810CF90

Function 6CC84A0E Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CC84917,6CC82E1A,6CC8287E,?,6CC82A9B,?,00000001,?,?,00000001,?,6CC9FC58,0000000C,6CC82B8F), ref: 6CC84A1C
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CC84A2A
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CC84A43
SetLastError.KERNEL32(00000000,6CC82A9B,?,00000001,?,?,00000001,?,6CC9FC58,0000000C,6CC82B8F,?,00000001,?), ref: 6CC84A95

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1ef4485944183eafa48ed896795f58b6c00714f318da4db7a5bd64c3a471ced9
Instruction ID: acec51bfa6e05e2b3e26aa5446e2a948cef891e518399672ea03c4b2231b0749
Opcode Fuzzy Hash: 1ef4485944183eafa48ed896795f58b6c00714f318da4db7a5bd64c3a471ced9
Instruction Fuzzy Hash: 2C01283221F7215DA61489B76CE8ADF3F7CDB027BD320032AE0246AED0FF5548868548

Function 6CC7A050 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6CC7A074
capGetDriverDescriptionA.AVICAP32(00000000,?,00000064,?,00000032), ref: 6CC7A0B8
CreateWindowExA.USER32(00000000,#32770,6CC9E2CD,80000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6CC7A13A
capCreateCaptureWindowA.AVICAP32(00000000,50000000,00000000,00000000,00000000,00000000,?,00000000), ref: 6CC7A19B

Strings

#32770, xrefs: 6CC7A12F

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Create$Window$CaptureDescriptionDriverEvent
String ID: #32770
API String ID: 1834932511-463685578
Opcode ID: e4367d4aec1a87bd34503815465d5627f91b648c21718c027da7cac70a201cf9
Instruction ID: e23021871663beb19acf779636513bcf1c18ae2e6127e821be583b174b5a205f
Opcode Fuzzy Hash: e4367d4aec1a87bd34503815465d5627f91b648c21718c027da7cac70a201cf9
Instruction Fuzzy Hash: 27417C31B04304ABFB20CF75CC59B9AFBB4EF45304F104258E945AFAC0E3B1A54587A5

Function 6CC8C6A5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6CC8C6AA

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 5397d53f933b4456936808af31dea5dba4630939c1b178c2155f8dbdd9ac44de
Instruction ID: ebe76b34080da2f03bac3eed0703aabef90bb3c6cad4fb03ccf280c1136aa4f7
Opcode Fuzzy Hash: 5397d53f933b4456936808af31dea5dba4630939c1b178c2155f8dbdd9ac44de
Instruction Fuzzy Hash: 2D219D71606205AFDB10AFA68D80D9BBFADAF417ACB144725F814D7A50FB30EC5487A0

Function 6CC7BAE0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57processCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104), ref: 6CC7BB2E
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 6CC7BBBD

Strings

%s %s,MainRun, xrefs: 6CC7BB46
rundll32.exe, xrefs: 6CC7BB3B
D, xrefs: 6CC7BB54

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CreateFileModuleNameProcess
String ID: %s %s,MainRun$D$rundll32.exe
API String ID: 2157755880-3438581015
Opcode ID: 18e988f62000c86f7ab66db5170c56bcc56c0a262764a05c0b4158f34218e741
Instruction ID: 0e2b4107dcf7bc83c395b7e31d80db99d7351b7ad581a52085163f42e3f39d01
Opcode Fuzzy Hash: 18e988f62000c86f7ab66db5170c56bcc56c0a262764a05c0b4158f34218e741
Instruction Fuzzy Hash: DE111FB494121CABEB20DF50DC9DBDAB7BCEB04708F5005D5E608A7680E7B59A888F95

Function 6CC72F03 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000003,00000080,00000000), ref: 6CC72F25
SetFilePointer.KERNEL32(00000000,?,?,00000000), ref: 6CC72F38
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 6CC72F59
CloseHandle.KERNEL32(00000000), ref: 6CC72F60

Strings

p, xrefs: 6CC72F79

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID: p
API String ID: 3604237281-2181537457
Opcode ID: add7faf5fe9530361b0cbf5673c5c619d7a9419715af153d6f66057a982e9f57
Instruction ID: 69c5eff8c020848d41f463832a3cdd85fe1af0c229ac3c72d843cd7c6009ab49
Opcode Fuzzy Hash: add7faf5fe9530361b0cbf5673c5c619d7a9419715af153d6f66057a982e9f57
Instruction Fuzzy Hash: 72115E76A04618AFDB60CF58CC49FDEB7B8FF49711F00425AF519E7280DB34AA448B94

Function 6CC889D2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6CC88984,?,?,6CC8894C,00000104,?,?), ref: 6CC889E7
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CC889FA
FreeLibrary.KERNEL32(00000000,?,?,6CC88984,?,?,6CC8894C,00000104,?,?), ref: 6CC88A1D

Strings

mscoree.dll, xrefs: 6CC889E0
CorExitProcess, xrefs: 6CC889F2

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2d0b89b441d0294a0d4bbdc10234a72c28c537414a7ce9483e79384b7b2b8174
Instruction ID: 855d294ffffd4628c3acef472bb4845ca08f00759d37b9c4486a42552e9708c9
Opcode Fuzzy Hash: 2d0b89b441d0294a0d4bbdc10234a72c28c537414a7ce9483e79384b7b2b8174
Instruction Fuzzy Hash: AFF08235A02619FBDF119F51DD09BDEBF78EB0571AF200165F809B29A0DB358E40DA91

Function 6CC76C20 Relevance: 7.7, APIs: 5, Instructions: 179registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000F003F,?), ref: 6CC76C3D
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 6CC76C68
LocalAlloc.KERNEL32(00000040,?), ref: 6CC76CC6
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?), ref: 6CC76D66

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: AllocEnumInfoLocalOpenQueryValue
String ID:
API String ID: 3558969620-0
Opcode ID: 68b1fa25c0e0293d5060977bdeba8c137469ee01e25c1ac61ccb26e4714c7461
Instruction ID: 31dca48f9bb76bbf2ab572a5807a0cd1bd38fe7ae0af4f9ccdb2115605efbb88
Opcode Fuzzy Hash: 68b1fa25c0e0293d5060977bdeba8c137469ee01e25c1ac61ccb26e4714c7461
Instruction Fuzzy Hash: B0515971D01119AFCB11CFA8CD81AEEBBB9EF09304F1441A6E905F7640E7319A55CBA0

Function 6CC77880 Relevance: 7.6, APIs: 5, Instructions: 140sleepmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,723C8B34), ref: 6CC778D6
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000), ref: 6CC7790C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC77917
Sleep.KERNEL32(00000096), ref: 6CC77922
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?), ref: 6CC77945

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFreeObjectSingleSleepWait
String ID:
API String ID: 2458869650-0
Opcode ID: d04f397237a199ca0fcecf24408d2966351d7a14e23f2af1c2ef6b678e08e81b
Instruction ID: 3ba1d55e4dffea1c9f122c7df4e85d316bfa34ef4bbbb1787ce312b5c5561904
Opcode Fuzzy Hash: d04f397237a199ca0fcecf24408d2966351d7a14e23f2af1c2ef6b678e08e81b
Instruction Fuzzy Hash: 6241C175A01606AFDB21CF20CC44F9B7BB9EF89718F104628E95997780E735E909CBA1

Function 6CC8901D Relevance: 7.6, APIs: 5, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6CC8908B
_free.LIBCMT ref: 6CC890AB
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 6CC8910C
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 6CC8911E
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 6CC8912B

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: __crt_fast_encode_pointer$_free
String ID:
API String ID: 366466260-0
Opcode ID: beec63d542cd89010ae47df104fa0660d48a1c4b7611a3edf24c648e8d7b4468
Instruction ID: 879a9f0ee5e07a19eb1bd810d4477aa672d92c8414578d2310c91a670229647f
Opcode Fuzzy Hash: beec63d542cd89010ae47df104fa0660d48a1c4b7611a3edf24c648e8d7b4468
Instruction Fuzzy Hash: 9141C536A022149BCB10CF69C994A9EBBB6EF8971CF1541A8D515EB740E731ED06CB80

Function 6CC77460 Relevance: 7.6, APIs: 5, Instructions: 94synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,723C8B34), ref: 6CC77492
CloseHandle.KERNEL32(?), ref: 6CC7749B
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000), ref: 6CC7753E
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 6CC77567
CloseHandle.KERNEL32(00000000), ref: 6CC77570

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CloseHandleObjectSingleWait$CreateEvent
String ID:
API String ID: 3556256739-0
Opcode ID: bf3344dfee969eae9bd545200fd93ba41db0f7359316ce67d426e774222beb3a
Instruction ID: 38e15148eed024f07a63c3331418fa2635546bd48aad60db50a7b3275da51344
Opcode Fuzzy Hash: bf3344dfee969eae9bd545200fd93ba41db0f7359316ce67d426e774222beb3a
Instruction Fuzzy Hash: 6B31E171B04709BFEB118F64CC06B99BBB4FF06714F10421AE611ABBC0DBB169948BE1

Function 6CC78560 Relevance: 7.6, APIs: 5, Instructions: 93windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 6CC785F7
CreateCompatibleBitmap.GDI32(00000000,00000001,00000001), ref: 6CC78604
GetDIBits.GDI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6CC78617
ReleaseDC.USER32(00000000,00000000), ref: 6CC78620
DeleteObject.GDI32(00000000), ref: 6CC78627

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: BitmapBitsCompatibleCreateDeleteObjectRelease
String ID:
API String ID: 3052192651-0
Opcode ID: d4e57b3eb2cbde3123c4bc922f9008523a09b007c31c065860350a9c07441985
Instruction ID: 4d33e17c54d46c10ca460d4243d155f69aa73184f08dc39d9a3ba3e2b0749f6f
Opcode Fuzzy Hash: d4e57b3eb2cbde3123c4bc922f9008523a09b007c31c065860350a9c07441985
Instruction Fuzzy Hash: 8431E671601214AFEB088F29C899B5ABFB5EF45311F0581AAF905DF3D1D374CA00CBA0

Function 6CC723B0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 6CC723C7
waveOutGetNumDevs.WINMM ref: 6CC723E1
waveOutOpen.WINMM(?,0000FFFF,?,00000001,00000001,00000001), ref: 6CC7241E
waveOutPrepareHeader.WINMM(?,?), ref: 6CC7245A
waveOutWrite.WINMM(?,?,00000020), ref: 6CC72497

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: wave$DevsEventHeaderOpenPrepareWrite
String ID:
API String ID: 3194336841-0
Opcode ID: 0ebb375703c14ee80abbefad42060b526f4b2deeda28ab66f5e0bb0dc1c1965e
Instruction ID: c7fec9934210a8d1f1f8492a4cd2e2620a03989c97612aa181b259d4355e15d4
Opcode Fuzzy Hash: 0ebb375703c14ee80abbefad42060b526f4b2deeda28ab66f5e0bb0dc1c1965e
Instruction Fuzzy Hash: 8D314B72200705AFD721CF68D888F46BBF9FF08305F144518EA9A97A51E772F925DB60

Function 6CC7A6A0 Relevance: 7.6, APIs: 5, Instructions: 81synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 6CC7A6C8
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC7A712
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6CC7A73E
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC7A767
CloseHandle.KERNEL32(?), ref: 6CC7A770

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: EventObjectSingleWait$CloseCreateHandle
String ID:
API String ID: 3390247112-0
Opcode ID: 279b4409ae752be782e5cf0dd0ed90d82f0814f5141505c14d867a164c5f0386
Instruction ID: 02ee84e155c3f6eec619f080d0453326a16027dc011ed1c4273c4851a3ec7424
Opcode Fuzzy Hash: 279b4409ae752be782e5cf0dd0ed90d82f0814f5141505c14d867a164c5f0386
Instruction Fuzzy Hash: D921A372A04218EFDB11DF58DC01B99B7B4FF49321F2043AAE914AB291D7719954CBD1

Function 6CC79DF0 Relevance: 7.5, APIs: 5, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC79E07
GetThreadDesktop.USER32(00000000,?,00000000), ref: 6CC79E0E
GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 6CC79E2C
SetThreadDesktop.USER32(00000000,?,00000000), ref: 6CC79E37
CloseDesktop.USER32(00000000,?,00000000), ref: 6CC79E42

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: DesktopThread$CloseCurrentInformationObjectUser
String ID:
API String ID: 2068333509-0
Opcode ID: b08636bad3a66392f505fc76b0ceec830fa7fe2ea6c232b649bc60f89372aca2
Instruction ID: a85fa654b8a8530cb06e46d366c9a09f5024f206a80bf3063c879fe772e5a7ec
Opcode Fuzzy Hash: b08636bad3a66392f505fc76b0ceec830fa7fe2ea6c232b649bc60f89372aca2
Instruction Fuzzy Hash: 0E01A231701208ABDB109F759C48AFEB7BCEF4A711F4001AAE906D6140EEA0994587A0

Function 6CC8DDE8 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6CC8DE00

Part of subcall function 6CC89856: RtlFreeHeap.NTDLL(00000000,00000000,?,6CC89200), ref: 6CC8986C
Part of subcall function 6CC89856: GetLastError.KERNEL32(?,?,6CC89200), ref: 6CC8987E

_free.LIBCMT ref: 6CC8DE12
_free.LIBCMT ref: 6CC8DE24
_free.LIBCMT ref: 6CC8DE36
_free.LIBCMT ref: 6CC8DE48

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 542006880114e67aff52bfeecc82f54024354e7a2592f3f919e3b0aa62845d26
Instruction ID: eff1bb02b20f6ad23c210132d57aa87572b6b06c360445cecd88f434a152b7d5
Opcode Fuzzy Hash: 542006880114e67aff52bfeecc82f54024354e7a2592f3f919e3b0aa62845d26
Instruction Fuzzy Hash: 5EF0FF3160761597CA20DB96E489C5B7BF9EB1171CBA0081EF01DD7F00E730F98487A4

Function 6CC7B040 Relevance: 7.5, APIs: 5, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6CC7B061
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC7B08A
CloseHandle.KERNEL32(?), ref: 6CC7B093
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 6CC7B09C
CloseHandle.KERNEL32(00000000), ref: 6CC7B0A3

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CloseHandleObjectSingleWait$CreateEvent
String ID:
API String ID: 3556256739-0
Opcode ID: 9c3ae04e0acce454d93c9074dd66d4712a1ee055ee9109e9376cd69498775d36
Instruction ID: 1cbd7ee561717a56f5594b61a90d11045a8dd6c2f1d0e0e2416a4ad9187f9afe
Opcode Fuzzy Hash: 9c3ae04e0acce454d93c9074dd66d4712a1ee055ee9109e9376cd69498775d36
Instruction Fuzzy Hash: EEF06271B44208BBEB109FE48C1AF9E7A78EB05712F600754F621B91D1E67115148B59

Function 6CC71D90 Relevance: 7.5, APIs: 5, Instructions: 29sleepCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,6CC74311,00000004), ref: 6CC71DB4
CancelIo.KERNEL32(?,?,6CC713C0), ref: 6CC71DC0
closesocket.WS2_32(?), ref: 6CC71DD6
Sleep.KERNEL32(000001F4,?,6CC713C0), ref: 6CC71DE1
SetEvent.KERNEL32(?,?,6CC713C0), ref: 6CC71DED

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CancelEventSleepclosesocketsetsockopt
String ID:
API String ID: 1813706226-0
Opcode ID: 846efdfae42e5a501a382f4226c55a451b314436dc499b00d6b1a105a61c46c5
Instruction ID: 19f62f7d37e14ae7e23923bb139eaa05fec2e274b99d3153b9c12f5e17729d38
Opcode Fuzzy Hash: 846efdfae42e5a501a382f4226c55a451b314436dc499b00d6b1a105a61c46c5
Instruction Fuzzy Hash: 8DF03031201705BFDB615F60CC09BDABBB8EF06712F1043A9F6AA961A0DFB128549B52

Function 6CC76AF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000002,?,00000000,00000000,00000000,000F003F,00000000,?,723C8B34,723C8B34), ref: 6CC76B45
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,0002001F,?,?,00000000,00000000,00000000,000F003F,00000000,?,723C8B34,723C8B34), ref: 6CC76B5B
RegSetValueExA.ADVAPI32(?,Host,00000000,00000001,?,?,?,00000000,0002001F,?,?,00000000,00000000,00000000,000F003F,00000000), ref: 6CC76B8A

Strings

Host, xrefs: 6CC76B82

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CreateOpenValue
String ID: Host
API String ID: 2195001959-1863695555
Opcode ID: f3ccf1780b6b0ba5c4681492007c4570c326b6b3a0c2daf7ae5c6bededeb6a03
Instruction ID: 3b95025d66d0d888e90ffd271b6b62472e5332e334fe6d8c7f4b2a605d241703
Opcode Fuzzy Hash: f3ccf1780b6b0ba5c4681492007c4570c326b6b3a0c2daf7ae5c6bededeb6a03
Instruction Fuzzy Hash: 8C217171A04608AFDB108F66CC44FEFBBBDFB8A714F10426AF502E3651E77559058670

Function 6CC75B38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78processCOMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6CC75B3E

Part of subcall function 6CC79E80: InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 6CC79F12
Part of subcall function 6CC79E80: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 6CC79F51
Part of subcall function 6CC79E80: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 6CC79F76
Part of subcall function 6CC79E80: InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 6CC79FBA

CreateProcessA.KERNEL32(?,CcRmt Update,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 6CC75BFD

Strings

CcRmt Update, xrefs: 6CC75BF4
D, xrefs: 6CC75B67

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Internet$CreateFileOpen$ProcessRead_strrchr
String ID: CcRmt Update$D
API String ID: 1702296723-2240332167
Opcode ID: 266540a6a249d0cccb9c4140bb89ac974144b94a5288702e5e016175634763b0
Instruction ID: e5acfa88db64678c673dcd69b6dc2256aaccf758eea378c80b8fca95b7a76dc9
Opcode Fuzzy Hash: 266540a6a249d0cccb9c4140bb89ac974144b94a5288702e5e016175634763b0
Instruction Fuzzy Hash: 5B21F572D097858AC710CF20C9403ABB7E1FFD9308F14AB1EF9801A645FBB19488CB92

Function 6CC75280 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E64,723C8B34,?,6CCA3E50), ref: 6CC71225
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E8C), ref: 6CC7124E
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EB4), ref: 6CC71270
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EDC), ref: 6CC7129E
Part of subcall function 6CC711C0: WSAStartup.WS2_32(00000202,?), ref: 6CC712B0
Part of subcall function 6CC711C0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6CC712BE

Part of subcall function 6CC71470: setsockopt.WS2_32(00000000), ref: 6CC714AF
Part of subcall function 6CC71470: CancelIo.KERNEL32(00000000), ref: 6CC714BB
Part of subcall function 6CC71470: closesocket.WS2_32(00000000), ref: 6CC714D1
Part of subcall function 6CC71470: Sleep.KERNEL32(000001F4), ref: 6CC714DC
Part of subcall function 6CC71470: SetEvent.KERNEL32(00000000), ref: 6CC714E8
Part of subcall function 6CC71470: ResetEvent.KERNEL32(00000000), ref: 6CC714FE
Part of subcall function 6CC71470: socket.WS2_32(00000002,00000001,00000006), ref: 6CC71524
Part of subcall function 6CC71470: gethostbyname.WS2_32(723C8B34), ref: 6CC7154A
Part of subcall function 6CC71470: htons.WS2_32(?), ref: 6CC7157B
Part of subcall function 6CC71470: connect.WS2_32(00000000,?,00000010), ref: 6CC7159E
Part of subcall function 6CC71470: setsockopt.WS2_32(00000000,0000FFFF,00000008,?,00000001), ref: 6CC715E3

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,82.157.76.20), ref: 6CC75304
WaitForSingleObject.KERNEL32(?,000000FF,?,00000001), ref: 6CC7533E
CloseHandle.KERNEL32(?), ref: 6CC75356

Strings

82.157.76.20, xrefs: 6CC752CA

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CriticalEventInitializeSection$Createsetsockopt$CancelCloseHandleObjectResetSingleSleepStartupWaitclosesocketconnectgethostbynamehtonssocket
String ID: 82.157.76.20
API String ID: 1068952029-3546086885
Opcode ID: 76b0ee108cba956150e16356ae24f625821bee30279cbf53b3e5d95bcf8f127c
Instruction ID: e04a8648bb59d81b8291104a7ca9764c680e8a056f84630fe7ccf95ac71af082
Opcode Fuzzy Hash: 76b0ee108cba956150e16356ae24f625821bee30279cbf53b3e5d95bcf8f127c
Instruction Fuzzy Hash: C52190719002589BCF20CFA4CD55BDEBBB4EB05714F00469AE91AB76D0EB705A88CFA1

Function 6CC74600 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E64,723C8B34,?,6CCA3E50), ref: 6CC71225
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3E8C), ref: 6CC7124E
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EB4), ref: 6CC71270
Part of subcall function 6CC711C0: InitializeCriticalSection.KERNEL32(6CCA3EDC), ref: 6CC7129E
Part of subcall function 6CC711C0: WSAStartup.WS2_32(00000202,?), ref: 6CC712B0
Part of subcall function 6CC711C0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6CC712BE

Part of subcall function 6CC71470: setsockopt.WS2_32(00000000), ref: 6CC714AF
Part of subcall function 6CC71470: CancelIo.KERNEL32(00000000), ref: 6CC714BB
Part of subcall function 6CC71470: closesocket.WS2_32(00000000), ref: 6CC714D1
Part of subcall function 6CC71470: Sleep.KERNEL32(000001F4), ref: 6CC714DC
Part of subcall function 6CC71470: SetEvent.KERNEL32(00000000), ref: 6CC714E8
Part of subcall function 6CC71470: ResetEvent.KERNEL32(00000000), ref: 6CC714FE
Part of subcall function 6CC71470: socket.WS2_32(00000002,00000001,00000006), ref: 6CC71524
Part of subcall function 6CC71470: gethostbyname.WS2_32(723C8B34), ref: 6CC7154A
Part of subcall function 6CC71470: htons.WS2_32(?), ref: 6CC7157B
Part of subcall function 6CC71470: connect.WS2_32(00000000,?,00000010), ref: 6CC7159E
Part of subcall function 6CC71470: setsockopt.WS2_32(00000000,0000FFFF,00000008,?,00000001), ref: 6CC715E3

WaitForSingleObject.KERNEL32(?,000000FF,?,82.157.76.20,723C8B34), ref: 6CC74674
WaitForSingleObject.KERNEL32 ref: 6CC74695
CloseHandle.KERNEL32(?), ref: 6CC746BB

Strings

82.157.76.20, xrefs: 6CC7464A

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CriticalInitializeSection$Event$ObjectSingleWaitsetsockopt$CancelCloseCreateHandleResetSleepStartupclosesocketconnectgethostbynamehtonssocket
String ID: 82.157.76.20
API String ID: 88612883-3546086885
Opcode ID: 31ffc21cbcca82348b5151caaf7d36339289252a56c83a7c3e8fcc5bcdf2c204
Instruction ID: f95bfbcbe33dd469bab70ff9221a005d965749d88850ffcfe9f8d8cb9c98090d
Opcode Fuzzy Hash: 31ffc21cbcca82348b5151caaf7d36339289252a56c83a7c3e8fcc5bcdf2c204
Instruction Fuzzy Hash: B5218B31A04158DBDF24CFA5CD18B9DBBB4EB46324F10439AE526B3AE0EB315A44CF61

Function 6CC8AF24 Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6CC8AFAB

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 1a404cf76349f340f0e7371324ae5700b4ad8df0bbe55cf79db790904a36dcb1
Instruction ID: 0287ad2bd726b8e98d821fed232284ed0607928baa00f9a1a7de5d014ee0ef59
Opcode Fuzzy Hash: 1a404cf76349f340f0e7371324ae5700b4ad8df0bbe55cf79db790904a36dcb1
Instruction Fuzzy Hash: 30B11272A066469FDB01CF69CCA07AFBFB5EF46348F1441AAD854DBB41E3359902CB60

Function 6CC8BF33 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CC8C55F: _free.LIBCMT ref: 6CC8C56D

Part of subcall function 6CC8BC1C: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,6CC8E35A,?,00000000,00000000), ref: 6CC8BCBE

GetLastError.KERNEL32 ref: 6CC8BF9B
__dosmaperr.LIBCMT ref: 6CC8BFA2
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6CC8BFE1
__dosmaperr.LIBCMT ref: 6CC8BFE8

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: d83da9f9a8c429d02d623bd3b7c54c3c6192cb4285df435561f689fb46aa5000
Instruction ID: b5658430d42647a49df116eae4420b2318978abaaca09adc99a0cd7d4a389ac1
Opcode Fuzzy Hash: d83da9f9a8c429d02d623bd3b7c54c3c6192cb4285df435561f689fb46aa5000
Instruction Fuzzy Hash: E821B67560A615AFDB109F678CA085BBFADEF4536C7048614F82897B50FB30EC548FA0

Function 6CC89BD6 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000030,00000000,00000034,6CC86925,00000000,00000104,6CCA3E50,?,6CC882D7,00000104,00000030,6CC8853F,00000104,?,6CCA3E50,00000000), ref: 6CC89BDB
_free.LIBCMT ref: 6CC89C38
_free.LIBCMT ref: 6CC89C6E
SetLastError.KERNEL32(00000000,00000007,000000FF,?,6CC882D7,00000104,00000030,6CC8853F,00000104,?,6CCA3E50,00000000,?,6CC7B7E6,6CCA3E50,?), ref: 6CC89C79

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 4f4c39ff13a290706ce811fda1727d4038b0d189470e0ac10d1ef3a7953edb40
Instruction ID: 17e3a8b4f938e3c904631a6d2caf34f620df5a44def49382ac6f3375eb97ac2f
Opcode Fuzzy Hash: 4f4c39ff13a290706ce811fda1727d4038b0d189470e0ac10d1ef3a7953edb40
Instruction Fuzzy Hash: 3F11A7327475062AD71117AB5C88EAF3DBAA7C677DB250224F12993ED0FF62880A8251

Function 6CC89D2D Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6CC89EA6,6CC8987C,?,?,6CC89200), ref: 6CC89D32
_free.LIBCMT ref: 6CC89D8F
_free.LIBCMT ref: 6CC89DC5
SetLastError.KERNEL32(00000000,00000007,000000FF,?,?,6CC89EA6,6CC8987C,?,?,6CC89200), ref: 6CC89DD0

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: a41121910026354c27619f4b4dcbf646c27fabafbfe3c64aa52dcce86ea410c2
Instruction ID: e88c2bf4f022bda6abbed5cb0a28b4575864c17b881f8130dc17990839dc7025
Opcode Fuzzy Hash: a41121910026354c27619f4b4dcbf646c27fabafbfe3c64aa52dcce86ea410c2
Instruction Fuzzy Hash: 88110A323075112AC71117AB5C88EAF3E7AB7C637EB250225F52C83ED0FE61880A8254

Function 6CC84CC6 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 6CC84CE0

Part of subcall function 6CC84C2D: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 6CC84C5C
Part of subcall function 6CC84C2D: ___AdjustPointer.LIBCMT ref: 6CC84C77

_UnwindNestedFrames.LIBCMT ref: 6CC84CF5
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 6CC84D06
CallCatchBlock.LIBVCRUNTIME ref: 6CC84D2E

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 2998c2b33bb3f1adc102fd6f89abba6b44238b633e1d319362221238c3744714
Instruction ID: 052c01b22f5f5e6ec25cad65a2237ddec1019565d768a82723178839fc59a713
Opcode Fuzzy Hash: 2998c2b33bb3f1adc102fd6f89abba6b44238b633e1d319362221238c3744714
Instruction Fuzzy Hash: 36011772501148BBDF029E95CD44DEB3F6DEF4875CF044018FE1856A20E776E865DBA0

Function 6CC7A5F0 Relevance: 6.0, APIs: 4, Instructions: 32windowCOMMON

Download Yara Rule

APIs

ICSendMessage.MSVFW32(?,0000400E,00000000,00000000), ref: 6CC7A60E
ICSeqCompressFrameEnd.MSVFW32(?), ref: 6CC7A618
ICCompressorFree.MSVFW32(?), ref: 6CC7A61F
ICClose.MSVFW32(?), ref: 6CC7A628

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CloseCompressCompressorFrameFreeMessageSend
String ID:
API String ID: 2045547716-0
Opcode ID: 8fa7f489db3c1230d16f8bfaa84dff740e07af22011d83f315096588b67056b0
Instruction ID: e18295fc73f039ecf2cef29cd217f9e0603d11a6c0d21cc91134c04f76baa00b
Opcode Fuzzy Hash: 8fa7f489db3c1230d16f8bfaa84dff740e07af22011d83f315096588b67056b0
Instruction Fuzzy Hash: E3F082B2241219B7D7101F258D09F9A7B78FF86706F104110F714A6580E7B5E515C7B8

Function 6CC9301D Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000020,00000000,00000000,00000000,?,6CC91B8B,00000000,00000001,00000000,00000000,?,6CC90EA6,00000000,6CCA0168,00000000), ref: 6CC93034
GetLastError.KERNEL32(?,6CC91B8B,00000000,00000001,00000000,00000000,?,6CC90EA6,00000000,6CCA0168,00000000,00000000,00000000,?,6CC913FA,00000010), ref: 6CC93040

Part of subcall function 6CC93006: CloseHandle.KERNEL32(FFFFFFFE,6CC93050,?,6CC91B8B,00000000,00000001,00000000,00000000,?,6CC90EA6,00000000,6CCA0168,00000000,00000000,00000000), ref: 6CC93016

___initconout.LIBCMT ref: 6CC93050

Part of subcall function 6CC92FC8: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CC92FF7,6CC91B78,00000000,?,6CC90EA6,00000000,6CCA0168,00000000,00000000), ref: 6CC92FDB

WriteConsoleW.KERNEL32(00000000,00000020,00000000,00000000,?,6CC91B8B,00000000,00000001,00000000,00000000,?,6CC90EA6,00000000,6CCA0168,00000000,00000000), ref: 6CC93065

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5601ee177ec29cee5a193b14effbe9a30c280370afe80477a88940df6fd7f23e
Instruction ID: 64138b99bddde538dec14d5fb49553d258bb579c484f09378ee989652f37790d
Opcode Fuzzy Hash: 5601ee177ec29cee5a193b14effbe9a30c280370afe80477a88940df6fd7f23e
Instruction Fuzzy Hash: 53F01C36601529BBCF121FD6CC0C9CD3F76FB097A5F084210FA0C96520D7328820DB91

Function 6CC89349 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6CC89352

Part of subcall function 6CC89856: RtlFreeHeap.NTDLL(00000000,00000000,?,6CC89200), ref: 6CC8986C
Part of subcall function 6CC89856: GetLastError.KERNEL32(?,?,6CC89200), ref: 6CC8987E

_free.LIBCMT ref: 6CC89365
_free.LIBCMT ref: 6CC89376
_free.LIBCMT ref: 6CC89387

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 02587f39fe5183a9855fc2ac54bee4419e9257a53e3abd256a70f5cc7d40da7c
Instruction ID: 2d603af7a180b5cce503d7c1751439df376cc0a47bed69eaad9e1e96294ffdab
Opcode Fuzzy Hash: 02587f39fe5183a9855fc2ac54bee4419e9257a53e3abd256a70f5cc7d40da7c
Instruction Fuzzy Hash: F9E046B5F021209ECE131F91FA2948EBFB5F70678CB89000AF00047F10DB39981A9F99

Function 6CC88A62 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6CC88AA5, 6CC88AAC, 6CC88AE2

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: b22c189fe95a9afef2f0c8cbe292b30455ba1bb92eba4340ed9f594fe2ac9eac
Instruction ID: 4d4ecbabb3a0263690672e6fac33e20c40546162c2960956d5478a006fcd9c5a
Opcode Fuzzy Hash: b22c189fe95a9afef2f0c8cbe292b30455ba1bb92eba4340ed9f594fe2ac9eac
Instruction Fuzzy Hash: 81416DB1A06215AFDB119B9A9D80DAFBFF8EB85B1CF1401A7E504D7A40F7709A44CB90

Function 6CC74CE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70processCOMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6CC74D15
CreateProcessA.KERNEL32(00000000,-00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 6CC74D83

Strings

D, xrefs: 6CC74D3F

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: CreateProcess_strrchr
String ID: D
API String ID: 510072314-2746444292
Opcode ID: 05f173d91133bfee180fa39b256c51687b4d2d358b7814c57a8c3db9be9ee543
Instruction ID: f809f4522ae63054aea234d1532ce5f7cf84126104c7d22f143f101b40001815
Opcode Fuzzy Hash: 05f173d91133bfee180fa39b256c51687b4d2d358b7814c57a8c3db9be9ee543
Instruction Fuzzy Hash: F511B132D1121967CB20CAD0DD40BEE7BB9EB9A358F10135AFC00B6644FBA504858AE0

Function 6CC8243F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 6CC82D31

Part of subcall function 6CC8487C: RaiseException.KERNEL32(?,?,?,6CC741A7,?,6CCA3E50,?,?,?,?,?,?,6CC741A7,?,6CCA0260), ref: 6CC848DC

__CxxThrowException@8.LIBVCRUNTIME ref: 6CC82D4E

Strings

Unknown exception, xrefs: 6CC82D5B

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: d763bc6223fafaefa5cd2e550c665c71ab4452a74959ca9323c39cefbf4385ce
Instruction ID: d4b832a1e36220de86383f868e166f2942f62169b8beb9345c4f028409587b25
Opcode Fuzzy Hash: d763bc6223fafaefa5cd2e550c665c71ab4452a74959ca9323c39cefbf4385ce
Instruction Fuzzy Hash: ACF0C234C0220D76DB04ABA9D83CDDF7F6C6B0125CBA08662A828D7E90FB30E619C1D0

Function 6CC72E1D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 6CC72E1F
MoveFileA.KERNEL32(?,00000001), ref: 6CC72E2A

Strings

q, xrefs: 6CC72E38

Memory Dump Source

Source File: 00000005.00000002.2909685870.000000006CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CC70000, based on PE: true

Associated: 00000005.00000002.2909606220.000000006CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909713906.000000006CC95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909732236.000000006CCA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2909754104.000000006CCA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cc70000_rundll32.jbxd

Similarity

API ID: FileMovelstrlen
String ID: q
API String ID: 3773443382-4110462503
Opcode ID: 3d4a517bdd7eff00161b0d8e195fcb8c7afce0cbfe0cca208d11edabcfd69b34
Instruction ID: cc17f110a8e38a9f6d9602d1cc805e8260294a0714a253075dba1615ea829d09
Opcode Fuzzy Hash: 3d4a517bdd7eff00161b0d8e195fcb8c7afce0cbfe0cca208d11edabcfd69b34
Instruction Fuzzy Hash: 79E09236B055299FCB65DF559C5DBEEBBB8FB49315F4000AEE80AC2680DF391504CB61

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report X7qGiXszrq.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_26a67898946df8cd7879fcf65642466ed07e12_7522e4b5_70e4fd71-13fe-4d60-9d7f-63a045af65b8\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_26a67898946df8cd7879fcf65642466ed07e12_7522e4b5_9202bffe-b83e-455e-a4a2-48e27a682c9d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_6e27b41365c35c573789b1cc3865f957bf2a54_7522e4b5_3d1832b8-3231-4d87-a53d-dff582db6ccb\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8252.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER82DF.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER82FF.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E48.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E58.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F14.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F43.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F44.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FB1.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Windows Analysis Report
X7qGiXszrq.dll

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre