Edit tour

Windows Analysis Report
wceaux.dll.dll

Overview

General Information

Sample name:	wceaux.dll.dll renamed because original name is a hash value
Original sample name:	wceaux.dll.exe
Analysis ID:	1581367
MD5:	177e88e0d32bb18b1afb5c5c4a91acbd
SHA1:	2cbd021dd56ac01c92aba1de638b4b605c9e512c
SHA256:	e3ad34dd6ec85367c0599bef73654883fbc2b76b9ddd24ad1604ad19f09db0c0
Tags:	exeuser-windshock
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7484 cmdline: loaddll64.exe "C:\Users\user\Desktop\wceaux.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7564 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 7588 cmdline: rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7732 cmdline: C:\Windows\system32\WerFault.exe -u -p 7588 -s 332 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7572 cmdline: rundll32.exe C:\Users\user\Desktop\wceaux.dll.dll,WCEAddNTLMCredentials MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7740 cmdline: C:\Windows\system32\WerFault.exe -u -p 7572 -s 324 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7916 cmdline: rundll32.exe C:\Users\user\Desktop\wceaux.dll.dll,WCEDelNTLMCredentials MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7952 cmdline: C:\Windows\system32\WerFault.exe -u -p 7916 -s 324 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 8020 cmdline: rundll32.exe C:\Users\user\Desktop\wceaux.dll.dll,WCEGetNTLMCredentials MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 8056 cmdline: C:\Windows\system32\WerFault.exe -u -p 8020 -s 296 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 8124 cmdline: rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",WCEAddNTLMCredentials MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8132 cmdline: rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",WCEDelNTLMCredentials MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8140 cmdline: rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",WCEGetNTLMCredentials MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8156 cmdline: rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",_0212DBDHJKSAHD0183923kljmLKL MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: wceaux.dll.dll	Virustotal: Detection: 55%			Perma Link
Source: wceaux.dll.dll	ReversingLabs: Detection: 44%

Source: wceaux.dll.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_wce_905ba8786e3d43c26ec942c5ac4372ed80eef926_34d188ac_7b3b61dd-f760-40ad-b1e3-c9cd550b56fc\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_wce_603d3a596b89bf838e816eb97eecc919abe468_34d188ac_adbca7aa-f72d-47c6-930d-6a35b35040f9\	Jump to behavior

Source: Amcache.hve.9.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8F9D75E64

3_2_00007FF8F9D75E64

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7588 -s 332

Source: classification engine

Classification label: mal48.winDLL@24/17@0/0

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8020
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7572
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7916
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7588

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\e7099e54-d0ad-4733-922b-a97e57fb7efc

Jump to behavior

Source: wceaux.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\wceaux.dll.dll,WCEAddNTLMCredentials

Source: wceaux.dll.dll	Virustotal: Detection: 55%
Source: wceaux.dll.dll	ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\wceaux.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\wceaux.dll.dll,WCEAddNTLMCredentials
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7588 -s 332
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7572 -s 324
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\wceaux.dll.dll,WCEDelNTLMCredentials
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7916 -s 324
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\wceaux.dll.dll,WCEGetNTLMCredentials
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 8020 -s 296
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",WCEAddNTLMCredentials
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",WCEDelNTLMCredentials
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",WCEGetNTLMCredentials
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",_0212DBDHJKSAHD0183923kljmLKL
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\wceaux.dll.dll,WCEAddNTLMCredentials	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\wceaux.dll.dll,WCEDelNTLMCredentials	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\wceaux.dll.dll,WCEGetNTLMCredentials	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",WCEAddNTLMCredentials	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",WCEDelNTLMCredentials	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",WCEGetNTLMCredentials	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",_0212DBDHJKSAHD0183923kljmLKL	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: wceaux.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: wceaux.dll.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8F9D76D30 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_00007FF8F9D76D30

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

API coverage: 1.1 %

Source: C:\Windows\System32\loaddll64.exe TID: 7488

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_wce_905ba8786e3d43c26ec942c5ac4372ed80eef926_34d188ac_7b3b61dd-f760-40ad-b1e3-c9cd550b56fc\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_wce_603d3a596b89bf838e816eb97eecc919abe468_34d188ac_adbca7aa-f72d-47c6-930d-6a35b35040f9\	Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8F9D72940 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_00007FF8F9D72940

Source: C:\Windows\System32\rundll32.exe

3_2_00007FF8F9D76D30

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8F9D72940 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_00007FF8F9D72940
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8F9D75A4C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_00007FF8F9D75A4C

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",#1

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8F9D7443C GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_00007FF8F9D7443C

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8F9D741D8 HeapCreate,GetVersion,HeapSetInformation,

3_2_00007FF8F9D741D8

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Rundll32	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wceaux.dll.dll	55%	Virustotal		Browse
wceaux.dll.dll	45%	ReversingLabs	Win64.Hacktool.Wce

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.9.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581367
Start date and time:	2024-12-27 14:15:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	wceaux.dll.dll renamed because original name is a hash value
Original Sample Name:	wceaux.dll.exe
Detection:	MAL
Classification:	mal48.winDLL@24/17@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 2 Number of non-executed functions: 22
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 13.107.246.63, 40.126.53.19, 20.109.210.53
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	wp.bat	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://online-ops.mypasschange.com/landingPage/2/fbb0559ebe1911efb53c0242ac190102	Get hash	malicious	Unknown	Browse	13.107.246.63
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	EwhnoHx0n5.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	qZA8AyGxiA.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	13.107.246.63

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_wce_4026f1157d2df5ef6bac8fe9276b3cbf2d69f6_34d188ac_00d32710-3c9d-4bcb-be66-813bee057e70\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7588359547429644
Encrypted:	false
SSDEEP:	96:uLFj0sieyKyZsjH4RvM7ffXQXIDcQ7c6QecEjcw3nXaXz+HbHgSQgJj9NFQIDV9O:IBieyZJ0V8eJDjVtLzuiFTZ24lO8S
MD5:	AB608E39749DD78F2C5929338B86090E
SHA1:	0995450FA7A96F4C011E7153088AF1E303D2DFBD
SHA-256:	AF71E16F0E609F1EB8CDA652A3A511BB19661222502EEFACE4CAD98E435E3F6A
SHA-512:	665D09F18F46155461AB08D0E933C7B5FDB82B4347CFE90155D1BD653150619F71695735F0EED48114903EEBB3C35CCCA12C9A3E9AAEA1269CDCE4FBEA72789E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.7.7.8.9.5.9.8.2.1.4.2.3.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.7.7.8.9.6.0.8.9.9.5.9.5.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.0.d.3.2.7.1.0.-.3.c.9.d.-.4.b.c.b.-.b.e.6.6.-.8.1.3.b.e.e.0.5.7.e.7.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.e.5.f.b.0.5.0.-.6.c.2.6.-.4.f.c.8.-.a.7.f.7.-.7.d.1.a.5.e.4.c.e.b.8.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.w.c.e.a.u.x...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.a.4.-.0.0.0.1.-.0.0.1.4.-.c.7.8.2.-.6.7.7.8.6.1.5.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_wce_4026f1157d2df5ef6bac8fe9276b3cbf2d69f6_34d188ac_5f2726b2-8ab6-43b7-b59b-1c82eee9c0a5\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7617155449225228
Encrypted:	false
SSDEEP:	96:ou5FVXsi2UyKytsjH4RvM7ffXQXIDcQ7c6QecEjcw3nXaXz+HbHgSQgJj9NFQIDW:fsi2UytJ0V8eJDjVtLzuiFTZ24lO8S
MD5:	F586E720C92A4CC97A96F9ABAE038185
SHA1:	A90BF31C45A049805B420A3D994D652FA1349F46
SHA-256:	6F6BA1799FF857B41515F6092EF1898FF626B7626BF73F55BF0ABFAA921E58D8
SHA-512:	07D0D3D06E6C13F07D502DEC6CDD28B4653CB70060A65FBEB9396D9880E140C5380E41A56C46614E9DF5C5D90769E1D6E8C2BA5A29509F86DEDCC385EA8BDB4B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.7.7.8.9.5.9.8.3.2.1.3.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.7.7.8.9.6.0.3.0.0.8.8.3.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.f.2.7.2.6.b.2.-.8.a.b.6.-.4.3.b.7.-.b.5.9.b.-.1.c.8.2.e.e.e.9.c.0.a.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.2.6.6.0.2.0.2.-.0.c.2.b.-.4.c.1.2.-.a.7.2.d.-.7.a.a.3.d.2.d.6.1.f.5.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.w.c.e.a.u.x...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.9.4.-.0.0.0.1.-.0.0.1.4.-.8.d.e.0.-.6.5.7.8.6.1.5.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_wce_603d3a596b89bf838e816eb97eecc919abe468_34d188ac_adbca7aa-f72d-47c6-930d-6a35b35040f9\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7618426674283278
Encrypted:	false
SSDEEP:	96:cUFNsicyKyVsjH4RvM7ffoQXIDcQ7c6QecEJcw3kfXaXz+HbHgSQgJj9NFQIDV9t:90icyVO0V8ejw3jVtLzuiFTZ24lO8Sa
MD5:	168894F648813914B1406AE804EBDBD7
SHA1:	ECF5F25E88296273E17EC1225F083FFC0040E0B3
SHA-256:	6E3D958B70CCEDADB03B47F2E8EEC149B584ECAA2BB005115B3AFDCD8B40B9A7
SHA-512:	DF19C2ADC02745FBE6C028149E7D8C841045AA0BFB0D5E78DCB0FB18948D6322CD3F36C67328A4ED891B7EC2DF36F4D89E97CCA293DC310D10CEDF6F6C01E112
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.7.7.8.9.6.2.4.8.5.6.0.2.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.7.7.8.9.6.2.7.9.8.1.0.1.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.d.b.c.a.7.a.a.-.f.7.2.d.-.4.7.c.6.-.9.3.0.d.-.6.a.3.5.b.3.5.0.4.0.f.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.b.d.0.c.9.1.9.-.e.2.4.6.-.4.6.b.1.-.8.9.5.1.-.4.7.b.f.d.5.2.8.e.c.5.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.w.c.e.a.u.x...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.e.c.-.0.0.0.1.-.0.0.1.4.-.8.d.0.3.-.3.2.7.a.6.1.5.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_wce_905ba8786e3d43c26ec942c5ac4372ed80eef926_34d188ac_7b3b61dd-f760-40ad-b1e3-c9cd550b56fc\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7620455692773377
Encrypted:	false
SSDEEP:	192:YEiRy6/y0V8emdFjVtLzuiFTZ24lO8SC:jiUy5V8emdFjTzuiFTY4lO8S
MD5:	64DDA4D8F1A5DFB202491CD330F23287
SHA1:	A05F74023E5F598B0582B7216F2A2915FADFB771
SHA-256:	6B59A75864ACBF0EE97874C51250C135EBC935F0A6FA1963C1A1BA228BC9FEF9
SHA-512:	B92ADAB2A1F7AF1424D1E47AC5587CAD9EECB58D298A1478E54C0ADF8B3E5709F167074EEA3D38C140CF4163A6713DBE736190C4B2DD9ED5DC754F440FD3620C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.7.7.8.9.6.5.4.3.1.5.9.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.7.7.8.9.6.5.7.7.5.3.4.7.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.b.3.b.6.1.d.d.-.f.7.6.0.-.4.0.a.d.-.b.1.e.3.-.c.9.c.d.5.5.0.b.5.6.f.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.e.b.6.8.4.e.a.-.e.b.3.6.-.4.e.b.5.-.8.7.e.6.-.3.4.1.1.2.2.5.f.4.0.8.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.w.c.e.a.u.x...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.5.4.-.0.0.0.1.-.0.0.1.4.-.0.3.1.e.-.f.e.7.b.6.1.5.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9AAC.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 27 13:15:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60240
Entropy (8bit):	1.6188433672376599
Encrypted:	false
SSDEEP:	192:iMt83isOMZk3SSrgLWg+hHDuvXs0TBl+HQnxGzrmFSTPRCS8G0107E:dtsijOkbm+YU0P+wQnm8TPR78G0C
MD5:	F885B472BC085A8407A1524CB6253BAD
SHA1:	AF92C01443B45D5E97C35365B26A5591B1D02516
SHA-256:	BB1DA5CFA706D85D6E78CBA98EED514449974F61ECE028D8D55A1BFCA957C17B
SHA-512:	55096FCD017E080E24813F473C97E390D39F0F38AE4DCB5173A2F1510DF165D9987A84804C53E934C5639512AA9EEFE3916133748EF7A1168ECA6C08F6A8E496
Malicious:	false
Preview:	MDMP..a..... .........ng........................L................)..........T.......8...........T...............p.......................................................................................................eJ......l.......Lw......................T.............ng.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9ACC.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 27 13:15:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56812
Entropy (8bit):	1.6941856367697297
Encrypted:	false
SSDEEP:	192:ieP3Y8OMTXmpUryTqngNUSzKQ/o9b2B0PKMTClXX15r7G6uS8YSHhYt6A:bfYzImpsWxlo9EzMaXl5fv381Hhu
MD5:	3A6E57F68FB9505EEC353A09B1DDB06C
SHA1:	AE3588A9EB8CA772D861D55524B4DAE07125188A
SHA-256:	E731B27DE52D1247729664D4302BAA81BDF056613A4C64A9B4FFB389D5655E1E
SHA-512:	B07A0000CEC7647AF88BDDE96E7AF53F3827C56C394494AC901DA92F7D8246C8F6A09DDEDF502A7CBCA78EC7C8CE82BC6150F3429711974E0A529931630BF7FC
Malicious:	false
Preview:	MDMP..a..... .........ng........................L................)..........T.......8...........T...........0...........................................................................................................eJ......l.......Lw......................T.............ng.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B59.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8516
Entropy (8bit):	3.692788840307075
Encrypted:	false
SSDEEP:	192:R6l7wVeJXx+7cY16YjaFRgmfpFW4prZ89bFh4fFXm:R6lXJh+IY16YejgmfpFWLFuf4
MD5:	7CBCEC7020A1FB6C8D991ED86746AB49
SHA1:	F3BA0EFA1767C6E183FEA5066091B88D182027C7
SHA-256:	24516FBBB00DDB8355B70BF30DE6556F39CE463B8E8ED23B2E375E726E46D443
SHA-512:	8699104F1F97272B2C863707B8D7E317891246719A271F0093FD8F2AAF92C56C7885D16EF5F53CEB625419D46E38AAA2F54EA56778F97F254F9F55CB3BFBBF53
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B5A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8760
Entropy (8bit):	3.6978711521756984
Encrypted:	false
SSDEEP:	192:R6l7wVeJih+hYP6YmLC3dgmfpFW4pr789bF37fpXm:R6lXJk+hYP6YqC3dgmfpFWBFrf0
MD5:	E92CA01F831A2903EE37CFF3B0E23754
SHA1:	53CBDD70307B0197038F7F88E20567135E42DADA
SHA-256:	FAECA00D2CFC812896ED77DFDF55EBEFA2E3401E9A921FFEBCBF6B94936BDDF3
SHA-512:	1DEF3AF14FB8AC7C9171DAD765A9A286B6817425720E262F742A43558CA3B278E0319C028F0DA8637BE34E684F60082FBA6F6869770F5FFD6643659C912CEA0B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9BE7.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4754
Entropy (8bit):	4.468215175809525
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg771I9ITWpW8VYyYm8M4JC2CURFicmyq85m1Q3ptSTSYd:uIjfsI7vi7VGJecms3poOYd
MD5:	B446BD2A0FABC9BD52674FB3D2963D98
SHA1:	BC9B3D018F3C72839D712DFF3F2EA2918DA4B825
SHA-256:	1E603DBFA6E3D149A8F42437D8F17D68AE97348B588431102A7B2C0BB0361B8E
SHA-512:	9FFD54B7BEEB20C2EC45164723CD9B89CE7AB209DA5656931D35193CC6278EE658E728B1AA78CC25BFE58214A2CDE9B3C43870E18AE88FADF572B56FC440431B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="649698" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C65.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4753
Entropy (8bit):	4.469735732097993
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg771I9ITWpW8VYcYm8M4JC2CURFfyq85m1IwptSTS6d:uIjfsI7vi7V4Jr9poO6d
MD5:	549856F4757388AA2CD7C0E6E18AED82
SHA1:	88B02614C8DD6787B0572504A32773A7400BAD71
SHA-256:	25A0920549B2754DA91B43C7F921F332AE3606EA47589B57007D5B191CA50890
SHA-512:	2E3648FD8E70DF44483996084E7BE57C246F0674977477AA56624939BB9E5F909AF3EA95958211B7C8BCC2F55B12AED9314AEEBF9FD0E4E9BFA34E0BC6A5C0EF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="649698" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA50D.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 27 13:16:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56728
Entropy (8bit):	1.693199128002363
Encrypted:	false
SSDEEP:	192:rA3g8OMRJC/OSqz1b5IKD1abQsPfSjSAVvq2:cgzqCv65ISax6eAdq
MD5:	5B03CD608D63C6401577ED3BE9D21319
SHA1:	D6207B8AEB308B5AC49F1B20022576B4D0D7B816
SHA-256:	B0076C3D8DFA1C17F41F85600880846A0133F4040018D2B842856970F92BAF53
SHA-512:	D222C2CE08580C3C41BD403B3C44D8730D98F0BCEB0E989054E8FA67DE49F727A1189198EE0E9862A36F736BCE062596F6A8AD3E5788415B67CC0115A946216F
Malicious:	false
Preview:	MDMP..a..... .........ng........................L................)..........T.......8...........T.......................................................................................................................eJ......l.......Lw......................T.............ng.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA57B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8760
Entropy (8bit):	3.696870209596343
Encrypted:	false
SSDEEP:	192:R6l7wVeJct+9/Y16Ym4C3dgmfpAWMCprv89b3h7f0GA9m:R6lXJG+dY16YBC3dgmfpAWMv3Nfl
MD5:	A6583577B01C8592ECA12FA2067B1DA6
SHA1:	97876472CC2E8C3F3AE30AA7F7AE60961397D7A6
SHA-256:	FFF545B59B5BB6F68F8DDBB7C2A13BA8111B92552C8188D52585A9D4AC89E89D
SHA-512:	42D304004EBA3B1768C8C40095B766A004D69B859E88FF32803DB24B874F11D842F81D844089169AA1293904CCB2689386E4B590A037F7E42681C58CBDE40DC8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA59B.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4754
Entropy (8bit):	4.471653013378267
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg771I9ITWpW8VYU0Ym8M4JC2CUSFTzyq85m1WptSTSOd:uIjfsI7vi7VbJoSpoOOd
MD5:	69CF546D0446357CAD6FDFEB3C3B9BEC
SHA1:	C037BCFAB277261EA2004BB113A0EFA985B75717
SHA-256:	A834CE129CA72F0EE4D5077FFD11064A8D43FAF9331D63FBCCDE9C89F1E67C5D
SHA-512:	D978E800B86BAE91CBE7AF9FC12EE8683E194497624A43C174301B69C80669386008E9ED6DFEAB6E0DB78B3C268918A40913410ABEE78674727769B76477F731
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="649698" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB096.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 27 13:16:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	59096
Entropy (8bit):	1.6452025100926815
Encrypted:	false
SSDEEP:	192:QLj3J4AsOMV9kSSS/JqdUMc3r14twPvkzqv9wrKck2bjSnPb:ubRjehr8Zi1kuqmMKnP
MD5:	82455D72D3AD6FC0A17A1AD9D73F8BEC
SHA1:	8BC2E9132F3822FF76355BBFF97287262BC7E471
SHA-256:	140D44B2172471E89DFA7A39C00B22146ADF735D755D9BA5B6E0721D4ECD214D
SHA-512:	41C7AB30169B29EF371C1F9AD2BF16E6870A555B1B3408E38AF8D8AB6BCDE207E3FDA80D704DB9D2744E23D75B9E7AB1C6CA27FD7E384EB545D72C07B211FD39
Malicious:	false
Preview:	MDMP..a..... .........ng........................L................)..........T.......8...........T.......................................................................................................................eJ......l.......Lw......................T.......T.....ng.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB0D5.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8760
Entropy (8bit):	3.6988516094481265
Encrypted:	false
SSDEEP:	192:R6l7wVeJ3z+HYX6YmxC3dgmfpEWaYpre89bYVTfQIm:R6lXJD+HYX6YoC3dgmfpEWaiYxfm
MD5:	2AE38A2E35B597910E0D863A10539F32
SHA1:	3071757C04C9A756BA240223AFD4087658CEDF8A
SHA-256:	C37015E1DCB35981D3C2ABEAD41405BD652EE8BC64AAFF3DC3DD67DA93B450AC
SHA-512:	0EB61D0421C8D6C851A279D5BC8BEDE0D8AE0B81404A206CD7447E95218579A2AAB8DCE858375DE0868F68CA233531096C443AD15745BC368F1A0E48A3EE587E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.0.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB105.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4754
Entropy (8bit):	4.471147569461926
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg771I9ITWpW8VYJOYm8M4JC2CUeFzyq85m1xptSTSDwMDd:uIjfsI7vi7V4Jw9poOLDd
MD5:	A8C72BC0DC88B426B28BF1CA5DAE0D84
SHA1:	953C8E073973B75B4962E28CC2DCC3960525FEB3
SHA-256:	79FFDE687943142A67816AD70DC7F36C51B6A1C6306EACBA9BDFCB37DBA3F9F6
SHA-512:	8DAFE5B0CCD129E9B2E405D3E5BD6A1123FC7E3703B909A1ACAC221E049BF6BCF80CBF1C528120EBD762F7D90CF4C0C8C7AE22BEC7274CB6BE7D2480F0B99384
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="649698" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.394683838286927
Encrypted:	false
SSDEEP:	6144:Ml4fiJoH0ncNXiUjt10qCG/gaocYGBoaUMMhA2NX4WABlBuNAfOBSqa:E4vFCMYQUMM6VFYSfU
MD5:	6A0228D8C1B569A446FF5D1989D06D0B
SHA1:	FCD1906FA881202A8E596B3DD492378C1789A37A
SHA-256:	CA206B3D8A7E6BD802EEA43F7AD32AD8CFB54F058117799339522BB86232EFEB
SHA-512:	46ADA8740CF577144357896CB85EC4291455A32FC99394581597ADD629D86964060139CE9A74759C10FF29EDE3F4BC5FF37A5BF7A2914B3AD1D244AB449BC47A
Malicious:	false
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.W.xaX..............................................................................................................................................................................................................................................................................................................................................Y..L........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	5.609896248759093
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	wceaux.dll.dll
File size:	43'008 bytes
MD5:	177e88e0d32bb18b1afb5c5c4a91acbd
SHA1:	2cbd021dd56ac01c92aba1de638b4b605c9e512c
SHA256:	e3ad34dd6ec85367c0599bef73654883fbc2b76b9ddd24ad1604ad19f09db0c0
SHA512:	165a38611857944bb357c33a8e4c9f10e33df9717da2ebc51dab557c4810d639db945f084319448345a3032d2137bc42dc4461a178abeb50c80b25f5ab11fcda
SSDEEP:	768:Xh+soAMY5tTzpqglG1tQ/T5Ng3u7lDsHX0rUgTZXjkDtEy16iYKpV:x+soAMY5ppq0T5tp8CUgZev3V
TLSH:	11131809A6F440F4E4A7A235D8F36E25E772BC05A335874F025882AE1FA37D1993C736
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.r..O...O...O..t9...O..t9...O...7...O...O..YO..t9..-O..t9...O..t9...O..Rich.O..........PE..d.....aO.........." .....d...T.....

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180002ca8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x4F610201 [Wed Mar 14 20:39:29 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	d34166060112fc82fcc2e4c9358caadd

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007F2208F8A7F7h
call 00007F2208F8BF68h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007F2208F8A69Ch
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 00000088h
dec eax
lea ecx, dword ptr [000093C5h]
call dword ptr [00005377h]
dec eax
mov eax, dword ptr [000094B0h]
dec eax
mov dword ptr [esp+58h], eax
inc ebp
xor eax, eax
dec eax
lea edx, dword ptr [esp+60h]
dec eax
mov ecx, dword ptr [esp+58h]
call 00007F2208F8EC9Ah
dec eax
mov dword ptr [esp+50h], eax
dec eax
cmp dword ptr [esp+50h], 00000000h
je 00007F2208F8A833h
dec eax
mov dword ptr [esp+38h], 00000000h
dec eax
lea eax, dword ptr [esp+48h]
dec eax
mov dword ptr [esp+30h], eax
dec eax
lea eax, dword ptr [esp+40h]
dec eax
mov dword ptr [esp+28h], eax
dec eax
lea eax, dword ptr [00009370h]
dec eax
mov dword ptr [esp+20h], eax
dec esp
mov ecx, dword ptr [esp+50h]
dec esp
mov eax, dword ptr [esp+58h]
dec eax
mov edx, dword ptr [esp+60h]
xor ecx, ecx
call 00007F2208F8EC48h
jmp 00007F2208F8A814h
dec eax
mov eax, dword ptr [eax+eax+00000000h]

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 build 30319
[EXP] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xa6b0	0xbb	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9ff0	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe000	0x588	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf000	0x158	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x1f8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x632a	0x6400	84751a483e5489fb1ec21e67514b9d91	False	0.54828125	data	6.073496541705557	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x276b	0x2800	cb32ec6bde4d1c0a66e56d29c8e44db4	False	0.346875	data	4.541348064802024	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x2260	0x1000	3c339c87f825728501a713d11c5ab959	False	0.202392578125	MPEG ADTS, layer III, v2, 32 kbps, 16 kHz, 2x Monaural	2.6330611832406086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xe000	0x588	0x600	396adfe8f564a3392b1efb8c52d74bd6	False	0.48046875	data	4.045553297147021	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf000	0x1d0	0x200	cc170129f1cba1725253a369758c5767	False	0.53125	data	4.0291684370630865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

PSAPI.DLL

GetModuleInformation

KERNEL32.dll

GetStartupInfoW, HeapSize, GetVersionExA, IsBadReadPtr, GetCurrentProcess, GetModuleHandleA, GetCurrentThreadId, FlsSetValue, GetCommandLineA, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, RtlUnwindEx, EncodePointer, FlsGetValue, FlsFree, SetLastError, GetLastError, FlsAlloc, HeapFree, Sleep, GetProcAddress, GetModuleHandleW, ExitProcess, DecodePointer, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, HeapSetInformation, GetVersion, HeapCreate, HeapDestroy, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LeaveCriticalSection, EnterCriticalSection, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapAlloc, HeapReAlloc, LoadLibraryW, WriteFile, GetModuleFileNameW, LCMapStringW, MultiByteToWideChar, GetStringTypeW

Exports

Name	Ordinal	Address
WCEAddNTLMCredentials	1	0x180001120
WCEDelNTLMCredentials	2	0x180001740
WCEGetNTLMCredentials	3	0x1800014b0
_0212DBDHJKSAHD0183923kljmLKL	4	0x180001830

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 14:15:57.365022898 CET	1.1.1.1	192.168.2.9	0x226d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:15:57.365022898 CET	1.1.1.1	192.168.2.9	0x226d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	08:15:59
Start date:	27/12/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\wceaux.dll.dll"
Imagebase:	0x7ff68c8d0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:15:59
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:15:59
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",#1
Imagebase:	0x7ff6662d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:15:59
Start date:	27/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\wceaux.dll.dll,WCEAddNTLMCredentials
Imagebase:	0x7ff7be680000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:15:59
Start date:	27/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",#1
Imagebase:	0x7ff7be680000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:15:59
Start date:	27/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7588 -s 332
Imagebase:	0x7ff6bc970000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:15:59
Start date:	27/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7572 -s 324
Imagebase:	0x7ff6bc970000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:16:02
Start date:	27/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\wceaux.dll.dll,WCEDelNTLMCredentials
Imagebase:	0x7ff7be680000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:16:02
Start date:	27/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7916 -s 324
Imagebase:	0x7ff6bc970000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:16:05
Start date:	27/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\wceaux.dll.dll,WCEGetNTLMCredentials
Imagebase:	0x7ff7be680000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:16:05
Start date:	27/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 8020 -s 296
Imagebase:	0x7ff6bc970000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:16:08
Start date:	27/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",WCEAddNTLMCredentials
Imagebase:	0x7ff7be680000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:16:08
Start date:	27/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",WCEDelNTLMCredentials
Imagebase:	0x7ff7be680000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:16:08
Start date:	27/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",WCEGetNTLMCredentials
Imagebase:	0x7ff7be680000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:16:08
Start date:	27/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\wceaux.dll.dll",_0212DBDHJKSAHD0183923kljmLKL
Imagebase:	0x7ff7be680000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.4%
Total number of Nodes:	147
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF8F9D741D8 Relevance: 4.5, APIs: 3, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE ref: 00007FF8F9D741EE
GetVersion.KERNEL32 ref: 00007FF8F9D74200
HeapSetInformation.KERNEL32 ref: 00007FF8F9D7421E

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 997bfbc3af8d81a5df5bc88b9129ba6fd724082e3b9dda339bcc15cb436c9478
Instruction ID: 1a6905a8faa44c2f28f5083c0600cb5a39b715f11ff715af04ca227e61330571
Opcode Fuzzy Hash: 997bfbc3af8d81a5df5bc88b9129ba6fd724082e3b9dda339bcc15cb436c9478
Instruction Fuzzy Hash: 9FE06534A19AC24AF7897F11AC857751251BFA97C1FA01034D92D12BDCDE3C90458701

Function 00007FF8F9D72A38 Relevance: 10.6, APIs: 7, Instructions: 93
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8F9D741D8: HeapCreate.KERNELBASE ref: 00007FF8F9D741EE
Part of subcall function 00007FF8F9D741D8: GetVersion.KERNEL32 ref: 00007FF8F9D74200
Part of subcall function 00007FF8F9D741D8: HeapSetInformation.KERNEL32 ref: 00007FF8F9D7421E

_RTC_Initialize.LIBCMT ref: 00007FF8F9D72A6A
GetCommandLineA.KERNEL32 ref: 00007FF8F9D72A6F

Part of subcall function 00007FF8F9D74074: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF8F9D72A81), ref: 00007FF8F9D7408D
Part of subcall function 00007FF8F9D74074: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF8F9D72A81), ref: 00007FF8F9D740E4
Part of subcall function 00007FF8F9D74074: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF8F9D72A81), ref: 00007FF8F9D7411F
Part of subcall function 00007FF8F9D74074: free.LIBCMT ref: 00007FF8F9D7412C
Part of subcall function 00007FF8F9D74074: FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF8F9D72A81), ref: 00007FF8F9D74137

Part of subcall function 00007FF8F9D73934: GetStartupInfoW.KERNEL32 ref: 00007FF8F9D73955

__setargv.LIBCMT ref: 00007FF8F9D72A98
_cinit.LIBCMT ref: 00007FF8F9D72AAC

Part of subcall function 00007FF8F9D73044: FlsFree.KERNEL32(?,?,?,?,00007FF8F9D72B16), ref: 00007FF8F9D73053
Part of subcall function 00007FF8F9D73044: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8F9D72B16), ref: 00007FF8F9D746FB
Part of subcall function 00007FF8F9D73044: free.LIBCMT ref: 00007FF8F9D74704
Part of subcall function 00007FF8F9D73044: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8F9D72B16), ref: 00007FF8F9D7472B

Part of subcall function 00007FF8F9D73C08: free.LIBCMT ref: 00007FF8F9D73C59

Part of subcall function 00007FF8F9D73484: Sleep.KERNEL32(?,?,?,00007FF8F9D73157,?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000), ref: 00007FF8F9D734C9

FlsSetValue.KERNEL32 ref: 00007FF8F9D72B46
GetCurrentThreadId.KERNEL32 ref: 00007FF8F9D72B5A
free.LIBCMT ref: 00007FF8F9D72B69

Part of subcall function 00007FF8F9D733C4: HeapFree.KERNEL32(?,?,00000000,00007FF8F9D73190,?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000), ref: 00007FF8F9D733DA
Part of subcall function 00007FF8F9D733C4: _errno.LIBCMT ref: 00007FF8F9D733E4
Part of subcall function 00007FF8F9D733C4: GetLastError.KERNEL32(?,?,00000000,00007FF8F9D73190,?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000), ref: 00007FF8F9D733EC

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: free$FreeHeap$ByteCharCriticalDeleteEnvironmentMultiSectionStringsWide$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValueVersion__setargv_cinit_errno
String ID:
API String ID: 125979975-0
Opcode ID: 82984610075875e2758a1e2d1a82b4e38c7a1569fd0a662286cf425e448c85d3
Instruction ID: a647c613c5a2a988556118de064881c17cf0a7a2a4aa7c04fc53f51f66585cc3
Opcode Fuzzy Hash: 82984610075875e2758a1e2d1a82b4e38c7a1569fd0a662286cf425e448c85d3
Instruction Fuzzy Hash: E131C220E0D2C38DFB647F61AE4227A9195AF707D4F344135DA7D952DEEE2CB4414163

Non-executed Functions

Function 00007FF8F9D76D30 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 136
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76D75
GetProcAddress.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76D91
EncodePointer.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76DA3
GetProcAddress.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76DBA
EncodePointer.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76DC3
GetProcAddress.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76DDA
EncodePointer.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76DE3
GetProcAddress.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76DFA
EncodePointer.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76E03
GetProcAddress.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76E22
EncodePointer.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76E2B
DecodePointer.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76E5E
DecodePointer.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76E6E
DecodePointer.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76EC4
DecodePointer.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76EE5
DecodePointer.KERNEL32(?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D76EFF

Strings

MessageBoxW, xrefs: 00007FF8F9D76D87
GetUserObjectInformationW, xrefs: 00007FF8F9D76DE9
USER32.DLL, xrefs: 00007FF8F9D76D6E
GetProcessWindowStation, xrefs: 00007FF8F9D76E18
GetLastActivePopup, xrefs: 00007FF8F9D76DC9
GetActiveWindow, xrefs: 00007FF8F9D76DA9

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2643518689-564504941
Opcode ID: 7126393cb91ae6d21767fd20c508c5358afa12ec465495caf84aa2c059b04e92
Instruction ID: b681c02fff3c59dc7bc81b46867da09427280492dc00ed4e0b89ffcb3f1e6bd2
Opcode Fuzzy Hash: 7126393cb91ae6d21767fd20c508c5358afa12ec465495caf84aa2c059b04e92
Instruction Fuzzy Hash: 35513921E0AB9389EF58BF21AD5457566A0AF69BC0FA44439CC2E537D8EF3CA4458312

Function 00007FF8F9D75E64 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_set_error_mode.LIBCMT ref: 00007FF8F9D75EA9
_set_error_mode.LIBCMT ref: 00007FF8F9D75EBA
GetModuleFileNameW.KERNEL32 ref: 00007FF8F9D75F1C

Part of subcall function 00007FF8F9D75B98: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF8F9D75C3A), ref: 00007FF8F9D75BB0

GetStdHandle.KERNEL32 ref: 00007FF8F9D76031
WriteFile.KERNEL32 ref: 00007FF8F9D7608E

Strings

Microsoft Visual C++ Runtime Library, xrefs: 00007FF8F9D75FD5
..., xrefs: 00007FF8F9D75F6E
<program name unknown>, xrefs: 00007FF8F9D75F2B
Runtime Error!Program: , xrefs: 00007FF8F9D75EE9

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 2183313154-4022980321
Opcode ID: 676dd48fe9fbcaf1a08a0692f5ec2adea2d448fb9f0e2010ff2199a1a9b47712
Instruction ID: eff8e7111aae111da57a8fa140d85e136996f302cfe8839165e669d86a8c25a5
Opcode Fuzzy Hash: 676dd48fe9fbcaf1a08a0692f5ec2adea2d448fb9f0e2010ff2199a1a9b47712
Instruction Fuzzy Hash: 6251D021E186C289FB64BF21AD156BA6391BFA57C4FA00535EE6D02BCDDF3DE1058203

Function 00007FF8F9D72940 Relevance: 12.1, APIs: 8, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF8F9D72CFB
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8F9D72D1A
RtlVirtualUnwind.KERNEL32 ref: 00007FF8F9D72D66
IsDebuggerPresent.KERNEL32 ref: 00007FF8F9D72DD8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8F9D72DF0
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8F9D72DFD
GetCurrentProcess.KERNEL32 ref: 00007FF8F9D72E16
TerminateProcess.KERNEL32 ref: 00007FF8F9D72E24

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 20a5a98babd681ad70e4611849a092fa1c64d813bd7e320488a916c7f07e98f8
Instruction ID: 748dd0a33600f680d349701e6593e11ae28ffc57adf91c230f96372a7fc39248
Opcode Fuzzy Hash: 20a5a98babd681ad70e4611849a092fa1c64d813bd7e320488a916c7f07e98f8
Instruction Fuzzy Hash: 9831C335908BC68DE750AF25FD8436977A0FBA47C4F60003ADAAD427A9DF7CE0448B42

Function 00007FF8F9D75A4C Relevance: 9.1, APIs: 6, Instructions: 80
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF8F9D75AB9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8F9D75AD1
RtlVirtualUnwind.KERNEL32 ref: 00007FF8F9D75B0B
IsDebuggerPresent.KERNEL32 ref: 00007FF8F9D75B41
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8F9D75B4B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8F9D75B56

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae14c21b3f482a3df79c7facf59147b486a4809d9013bcbf1c7470dafe44c80a
Instruction ID: e90a56e5e87c411a119067365157ca2ea1ccd36f55c2b81ef3835a1b97fbb8a2
Opcode Fuzzy Hash: ae14c21b3f482a3df79c7facf59147b486a4809d9013bcbf1c7470dafe44c80a
Instruction Fuzzy Hash: 0A316232618BC689DB60DF25EC407AE73A0FB94794F600136EAAD43B99DF38D545CB01

Function 00007FF8F9D7443C Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8F9D74473
GetCurrentProcessId.KERNEL32 ref: 00007FF8F9D7447E
GetCurrentThreadId.KERNEL32 ref: 00007FF8F9D7448A
GetTickCount.KERNEL32 ref: 00007FF8F9D74496
QueryPerformanceCounter.KERNEL32 ref: 00007FF8F9D744A7

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 0418deb8ddc5fb68e550113ee5d5b7929d0a60cf44efac977928625c5e23b0c1
Instruction ID: 0e3f4476b08c49bf05aef314c87dd4839a8bb7a9fc83f5b0bd26e3fd4a1cd36b
Opcode Fuzzy Hash: 0418deb8ddc5fb68e550113ee5d5b7929d0a60cf44efac977928625c5e23b0c1
Instruction Fuzzy Hash: 6D018431A29E8589E7509F21EC842666360FB59BD0F642530DE6E47BE8DE3CD8848301

Function 00007FF8F9D761FC Relevance: 107.7, APIs: 86, Instructions: 180
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.LIBCMT ref: 00007FF8F9D76211

Part of subcall function 00007FF8F9D733C4: HeapFree.KERNEL32(?,?,00000000,00007FF8F9D73190,?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000), ref: 00007FF8F9D733DA
Part of subcall function 00007FF8F9D733C4: _errno.LIBCMT ref: 00007FF8F9D733E4
Part of subcall function 00007FF8F9D733C4: GetLastError.KERNEL32(?,?,00000000,00007FF8F9D73190,?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000), ref: 00007FF8F9D733EC

free.LIBCMT ref: 00007FF8F9D7621A
free.LIBCMT ref: 00007FF8F9D76223
free.LIBCMT ref: 00007FF8F9D7622C
free.LIBCMT ref: 00007FF8F9D76235
free.LIBCMT ref: 00007FF8F9D7623E
free.LIBCMT ref: 00007FF8F9D76246
free.LIBCMT ref: 00007FF8F9D7624F
free.LIBCMT ref: 00007FF8F9D76258
free.LIBCMT ref: 00007FF8F9D76261
free.LIBCMT ref: 00007FF8F9D7626A
free.LIBCMT ref: 00007FF8F9D76273
free.LIBCMT ref: 00007FF8F9D7627C
free.LIBCMT ref: 00007FF8F9D76285
free.LIBCMT ref: 00007FF8F9D7628E
free.LIBCMT ref: 00007FF8F9D76297
free.LIBCMT ref: 00007FF8F9D762A3
free.LIBCMT ref: 00007FF8F9D762AF
free.LIBCMT ref: 00007FF8F9D762BB
free.LIBCMT ref: 00007FF8F9D762C7
free.LIBCMT ref: 00007FF8F9D762D3
free.LIBCMT ref: 00007FF8F9D762DF
free.LIBCMT ref: 00007FF8F9D762EB
free.LIBCMT ref: 00007FF8F9D762F7
free.LIBCMT ref: 00007FF8F9D76303
free.LIBCMT ref: 00007FF8F9D7630F
free.LIBCMT ref: 00007FF8F9D7631B
free.LIBCMT ref: 00007FF8F9D76327
free.LIBCMT ref: 00007FF8F9D76333
free.LIBCMT ref: 00007FF8F9D7633F
free.LIBCMT ref: 00007FF8F9D7634B
free.LIBCMT ref: 00007FF8F9D76357
free.LIBCMT ref: 00007FF8F9D76363
free.LIBCMT ref: 00007FF8F9D7636F
free.LIBCMT ref: 00007FF8F9D7637B
free.LIBCMT ref: 00007FF8F9D76387
free.LIBCMT ref: 00007FF8F9D76393
free.LIBCMT ref: 00007FF8F9D7639F
free.LIBCMT ref: 00007FF8F9D763AB
free.LIBCMT ref: 00007FF8F9D763B7
free.LIBCMT ref: 00007FF8F9D763C3
free.LIBCMT ref: 00007FF8F9D763CF
free.LIBCMT ref: 00007FF8F9D763DB
free.LIBCMT ref: 00007FF8F9D763E7
free.LIBCMT ref: 00007FF8F9D763F3
free.LIBCMT ref: 00007FF8F9D763FF
free.LIBCMT ref: 00007FF8F9D7640B
free.LIBCMT ref: 00007FF8F9D76417
free.LIBCMT ref: 00007FF8F9D76423
free.LIBCMT ref: 00007FF8F9D7642F
free.LIBCMT ref: 00007FF8F9D7643B
free.LIBCMT ref: 00007FF8F9D76447
free.LIBCMT ref: 00007FF8F9D76453
free.LIBCMT ref: 00007FF8F9D7645F
free.LIBCMT ref: 00007FF8F9D7646B
free.LIBCMT ref: 00007FF8F9D76477
free.LIBCMT ref: 00007FF8F9D76483
free.LIBCMT ref: 00007FF8F9D7648F
free.LIBCMT ref: 00007FF8F9D7649B
free.LIBCMT ref: 00007FF8F9D764A7
free.LIBCMT ref: 00007FF8F9D764B3
free.LIBCMT ref: 00007FF8F9D764BF
free.LIBCMT ref: 00007FF8F9D764CB
free.LIBCMT ref: 00007FF8F9D764D7
free.LIBCMT ref: 00007FF8F9D764E3
free.LIBCMT ref: 00007FF8F9D764EF
free.LIBCMT ref: 00007FF8F9D764FB
free.LIBCMT ref: 00007FF8F9D76507
free.LIBCMT ref: 00007FF8F9D76513
free.LIBCMT ref: 00007FF8F9D7651F
free.LIBCMT ref: 00007FF8F9D7652B
free.LIBCMT ref: 00007FF8F9D76537
free.LIBCMT ref: 00007FF8F9D76543
free.LIBCMT ref: 00007FF8F9D7654F
free.LIBCMT ref: 00007FF8F9D7655B
free.LIBCMT ref: 00007FF8F9D76567
free.LIBCMT ref: 00007FF8F9D76573
free.LIBCMT ref: 00007FF8F9D7657F
free.LIBCMT ref: 00007FF8F9D7658B
free.LIBCMT ref: 00007FF8F9D76597
free.LIBCMT ref: 00007FF8F9D765A3
free.LIBCMT ref: 00007FF8F9D765AF
free.LIBCMT ref: 00007FF8F9D765BB
free.LIBCMT ref: 00007FF8F9D765C7
free.LIBCMT ref: 00007FF8F9D765D3
free.LIBCMT ref: 00007FF8F9D765DF

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 15cbabff7e33032904a872daad262153c54f526a8d1959d8c2e880c7293a7a9a
Instruction ID: c821e82674f4a5ab743baad82b33f02d77462d39b006661cef7d8c19a76c1483
Opcode Fuzzy Hash: 15cbabff7e33032904a872daad262153c54f526a8d1959d8c2e880c7293a7a9a
Instruction Fuzzy Hash: 6FA184216195D389FF52FEB9DC952FC9322AFA4B84F145533DA2D4A1EBCE14D841C322

Function 00007FF8F9D749C4 Relevance: 19.6, APIs: 13, Instructions: 90
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__free_lconv_mon.LIBCMT ref: 00007FF8F9D74A1C

Part of subcall function 00007FF8F9D76658: free.LIBCMT ref: 00007FF8F9D76676
Part of subcall function 00007FF8F9D76658: free.LIBCMT ref: 00007FF8F9D76688
Part of subcall function 00007FF8F9D76658: free.LIBCMT ref: 00007FF8F9D7669A
Part of subcall function 00007FF8F9D76658: free.LIBCMT ref: 00007FF8F9D766AC
Part of subcall function 00007FF8F9D76658: free.LIBCMT ref: 00007FF8F9D766BE
Part of subcall function 00007FF8F9D76658: free.LIBCMT ref: 00007FF8F9D766D0
Part of subcall function 00007FF8F9D76658: free.LIBCMT ref: 00007FF8F9D766E2
Part of subcall function 00007FF8F9D76658: free.LIBCMT ref: 00007FF8F9D766F4
Part of subcall function 00007FF8F9D76658: free.LIBCMT ref: 00007FF8F9D76706
Part of subcall function 00007FF8F9D76658: free.LIBCMT ref: 00007FF8F9D76718
Part of subcall function 00007FF8F9D76658: free.LIBCMT ref: 00007FF8F9D7672D
Part of subcall function 00007FF8F9D76658: free.LIBCMT ref: 00007FF8F9D76742
Part of subcall function 00007FF8F9D76658: free.LIBCMT ref: 00007FF8F9D76757

free.LIBCMT ref: 00007FF8F9D74A10

Part of subcall function 00007FF8F9D733C4: HeapFree.KERNEL32(?,?,00000000,00007FF8F9D73190,?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000), ref: 00007FF8F9D733DA
Part of subcall function 00007FF8F9D733C4: _errno.LIBCMT ref: 00007FF8F9D733E4
Part of subcall function 00007FF8F9D733C4: GetLastError.KERNEL32(?,?,00000000,00007FF8F9D73190,?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000), ref: 00007FF8F9D733EC

free.LIBCMT ref: 00007FF8F9D74A32
__free_lconv_num.LIBCMT ref: 00007FF8F9D74A3E
free.LIBCMT ref: 00007FF8F9D74A4A
free.LIBCMT ref: 00007FF8F9D74A56
free.LIBCMT ref: 00007FF8F9D74A7A
free.LIBCMT ref: 00007FF8F9D74A8E
free.LIBCMT ref: 00007FF8F9D74A9D
free.LIBCMT ref: 00007FF8F9D74AA9
free.LIBCMT ref: 00007FF8F9D74AD6
free.LIBCMT ref: 00007FF8F9D74AFE
free.LIBCMT ref: 00007FF8F9D74B18

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: 23c609f733f07835caa72da90042f1454ba816881de7ed8ff564466146b10a00
Instruction ID: 1783c51dfdc60f575aee3dfcfccee06a8b1cce7f6a38da54318a59d266a30072
Opcode Fuzzy Hash: 23c609f733f07835caa72da90042f1454ba816881de7ed8ff564466146b10a00
Instruction Fuzzy Hash: AD412231A0A6C689FF66EE65C8913BC6351AFA4BC8F645432DA2D162DDCF2CA441C712

Function 00007FF8F9D76764 Relevance: 15.2, APIs: 10, Instructions: 206
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8F9D767FE
malloc.LIBCMT ref: 00007FF8F9D76867
MultiByteToWideChar.KERNEL32 ref: 00007FF8F9D7689B
LCMapStringW.KERNEL32 ref: 00007FF8F9D768C2
LCMapStringW.KERNEL32 ref: 00007FF8F9D7690A
malloc.LIBCMT ref: 00007FF8F9D76967

Part of subcall function 00007FF8F9D75564: _FF_MSGBANNER.LIBCMT ref: 00007FF8F9D75594
Part of subcall function 00007FF8F9D75564: HeapAlloc.KERNEL32(?,?,00000000,00007FF8F9D73434,?,?,?,00007FF8F9D747C9,?,?,?,00007FF8F9D74873,?,?,0000000D,00007FF8F9D7326B), ref: 00007FF8F9D755B9
Part of subcall function 00007FF8F9D75564: _callnewh.LIBCMT ref: 00007FF8F9D755D2
Part of subcall function 00007FF8F9D75564: _errno.LIBCMT ref: 00007FF8F9D755DD
Part of subcall function 00007FF8F9D75564: _errno.LIBCMT ref: 00007FF8F9D755E8

LCMapStringW.KERNEL32 ref: 00007FF8F9D7699C
WideCharToMultiByte.KERNEL32 ref: 00007FF8F9D769DC
free.LIBCMT ref: 00007FF8F9D769F0
free.LIBCMT ref: 00007FF8F9D76A01

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocHeap_callnewh
String ID:
API String ID: 1080698880-0
Opcode ID: 7a7f4ddb3ae76de8b67dbf5cce7d4a81f9819bd86c0c0b50ebf52d2d6808bd9b
Instruction ID: 0ad43e93fef624cdd2d26df9c81a1de29cdbd2ee4ad1ce415742be3aade0a296
Opcode Fuzzy Hash: 7a7f4ddb3ae76de8b67dbf5cce7d4a81f9819bd86c0c0b50ebf52d2d6808bd9b
Instruction Fuzzy Hash: E581A532E087C29AEF24AF2598401797695FF68BE4FA44235DA6D47BD8EF3CD5008702

Function 00007FF8F9D73934 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF8F9D73955

Part of subcall function 00007FF8F9D73484: Sleep.KERNEL32(?,?,?,00007FF8F9D73157,?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000), ref: 00007FF8F9D734C9

GetFileType.KERNEL32 ref: 00007FF8F9D73AC0
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8F9D73AFE

Strings

@, xrefs: 00007FF8F9D73BB9

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID: @
API String ID: 3473179607-2766056989
Opcode ID: 00ca648bd395ddd2171da7c9fed6850a1ca2a6c068c1278825d17e34f68edf08
Instruction ID: e5ddb11d7c2f656f64c08ccf50380f90d10f8e04dba71321f7f27b7e320d1701
Opcode Fuzzy Hash: 00ca648bd395ddd2171da7c9fed6850a1ca2a6c068c1278825d17e34f68edf08
Instruction Fuzzy Hash: BE818061A087C289EB14AF24E98432977A0FB64BB4F648335DA7E432D9DF3CE455C306

Function 00007FF8F9D74768 Relevance: 12.1, APIs: 8, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_FF_MSGBANNER.LIBCMT ref: 00007FF8F9D7478F

Part of subcall function 00007FF8F9D760C4: _set_error_mode.LIBCMT ref: 00007FF8F9D760CD
Part of subcall function 00007FF8F9D760C4: _set_error_mode.LIBCMT ref: 00007FF8F9D760DC

Part of subcall function 00007FF8F9D75E64: _set_error_mode.LIBCMT ref: 00007FF8F9D75EA9
Part of subcall function 00007FF8F9D75E64: _set_error_mode.LIBCMT ref: 00007FF8F9D75EBA
Part of subcall function 00007FF8F9D75E64: GetModuleFileNameW.KERNEL32 ref: 00007FF8F9D75F1C

Part of subcall function 00007FF8F9D735CC: ExitProcess.KERNEL32 ref: 00007FF8F9D735DB

Part of subcall function 00007FF8F9D73404: malloc.LIBCMT ref: 00007FF8F9D7342F
Part of subcall function 00007FF8F9D73404: Sleep.KERNEL32(?,?,?,00007FF8F9D747C9,?,?,?,00007FF8F9D74873,?,?,0000000D,00007FF8F9D7326B,?,?,?,00007FF8F9D73338), ref: 00007FF8F9D73442

_errno.LIBCMT ref: 00007FF8F9D747D1
_lock.LIBCMT ref: 00007FF8F9D747E5
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,00007FF8F9D74873,?,?,0000000D,00007FF8F9D7326B,?,?,?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D747FB
free.LIBCMT ref: 00007FF8F9D74808
_errno.LIBCMT ref: 00007FF8F9D7480D
LeaveCriticalSection.KERNEL32(?,?,?,00007FF8F9D74873,?,?,0000000D,00007FF8F9D7326B,?,?,?,00007FF8F9D73338,?,?,?,00007FF8F9D72B7F), ref: 00007FF8F9D74830

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 5237ddcdf528f6dac07083468c855ddec8e8eae0eed08637655a34e7628e6a7d
Instruction ID: 06124c359dded3addb28d60586975abac9bdc6ab5f071d0d42ff1c3a8b68049c
Opcode Fuzzy Hash: 5237ddcdf528f6dac07083468c855ddec8e8eae0eed08637655a34e7628e6a7d
Instruction Fuzzy Hash: DE216A20E096C68AF766BF50AC4477A6292AFA17C0F745035D96E476CACF3CE8408743

Function 00007FF8F9D73760 Relevance: 10.6, APIs: 7, Instructions: 98
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.LIBCMT ref: 00007FF8F9D73789

Part of subcall function 00007FF8F9D74850: _amsg_exit.LIBCMT ref: 00007FF8F9D7487A

DecodePointer.KERNEL32(?,?,?,?,?,?,0000000D,00007FF8F9D73931,?,?,00000000,00007FF8F9D7487F,?,?,0000000D,00007FF8F9D7326B), ref: 00007FF8F9D737BC
DecodePointer.KERNEL32(?,?,?,?,?,?,0000000D,00007FF8F9D73931,?,?,00000000,00007FF8F9D7487F,?,?,0000000D,00007FF8F9D7326B), ref: 00007FF8F9D737DA
DecodePointer.KERNEL32(?,?,?,?,?,?,0000000D,00007FF8F9D73931,?,?,00000000,00007FF8F9D7487F,?,?,0000000D,00007FF8F9D7326B), ref: 00007FF8F9D7381A
DecodePointer.KERNEL32(?,?,?,?,?,?,0000000D,00007FF8F9D73931,?,?,00000000,00007FF8F9D7487F,?,?,0000000D,00007FF8F9D7326B), ref: 00007FF8F9D73834
DecodePointer.KERNEL32(?,?,?,?,?,?,0000000D,00007FF8F9D73931,?,?,00000000,00007FF8F9D7487F,?,?,0000000D,00007FF8F9D7326B), ref: 00007FF8F9D73844
ExitProcess.KERNEL32 ref: 00007FF8F9D738D0

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID:
API String ID: 3411037476-0
Opcode ID: d3a8da53ed391471388f78f64e86a742749b6b563194e49ac7503e1833e6085f
Instruction ID: c54751e5f18395ac548913bd00a11a91d8601523980d65b87911efbd1d4ef48e
Opcode Fuzzy Hash: d3a8da53ed391471388f78f64e86a742749b6b563194e49ac7503e1833e6085f
Instruction Fuzzy Hash: 42419221A19AC289E754BF11FD40239A6A5BFA87C4F344039DA6D477EDEF3CE4458302

Function 00007FF8F9D752F4 Relevance: 9.1, APIs: 6, Instructions: 118
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_getptd.LIBCMT ref: 00007FF8F9D75313

Part of subcall function 00007FF8F9D731A8: _amsg_exit.LIBCMT ref: 00007FF8F9D731BE

Part of subcall function 00007FF8F9D74E8C: _getptd.LIBCMT ref: 00007FF8F9D74E96
Part of subcall function 00007FF8F9D74E8C: _amsg_exit.LIBCMT ref: 00007FF8F9D74F33

Part of subcall function 00007FF8F9D74FEC: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,00007FF8F9D7532E,?,?,?,?,?,00007FF8F9D754EB), ref: 00007FF8F9D75016

Part of subcall function 00007FF8F9D73404: malloc.LIBCMT ref: 00007FF8F9D7342F
Part of subcall function 00007FF8F9D73404: Sleep.KERNEL32(?,?,?,00007FF8F9D747C9,?,?,?,00007FF8F9D74873,?,?,0000000D,00007FF8F9D7326B,?,?,?,00007FF8F9D73338), ref: 00007FF8F9D73442

free.LIBCMT ref: 00007FF8F9D7539E

Part of subcall function 00007FF8F9D733C4: HeapFree.KERNEL32(?,?,00000000,00007FF8F9D73190,?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000), ref: 00007FF8F9D733DA
Part of subcall function 00007FF8F9D733C4: _errno.LIBCMT ref: 00007FF8F9D733E4
Part of subcall function 00007FF8F9D733C4: GetLastError.KERNEL32(?,?,00000000,00007FF8F9D73190,?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000), ref: 00007FF8F9D733EC

_lock.LIBCMT ref: 00007FF8F9D753CE
free.LIBCMT ref: 00007FF8F9D75471
free.LIBCMT ref: 00007FF8F9D7549D
_errno.LIBCMT ref: 00007FF8F9D754A2

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: adfb820b848d519fb1358119614a4682fba55ad3dc335ba9987c428d9ecf103c
Instruction ID: 6f3e466729bce65bf7148fa4f477ec7789d1634068c047af77b02304425ae417
Opcode Fuzzy Hash: adfb820b848d519fb1358119614a4682fba55ad3dc335ba9987c428d9ecf103c
Instruction Fuzzy Hash: AA519131A096C68DE754BF259840279B6A1BBA0BD9F244036D96D473DACF3DE441C713

Function 00007FF8F9D74074 Relevance: 9.1, APIs: 6, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF8F9D72A81), ref: 00007FF8F9D7408D
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF8F9D72A81), ref: 00007FF8F9D740E4
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF8F9D72A81), ref: 00007FF8F9D7411F
free.LIBCMT ref: 00007FF8F9D7412C
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF8F9D72A81), ref: 00007FF8F9D74137
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF8F9D72A81), ref: 00007FF8F9D74145

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$free
String ID:
API String ID: 517548149-0
Opcode ID: 62c78459a40748443fd2c85b1eb12fe1d3c86d9aba43775558c0520dc8f346ea
Instruction ID: 3b580374187fd5fe5e8272429d924605d7a56c77b3c025ae7f9b1deb37bcf9c0
Opcode Fuzzy Hash: 62c78459a40748443fd2c85b1eb12fe1d3c86d9aba43775558c0520dc8f346ea
Instruction Fuzzy Hash: 8B213232A097C189EB65AF15AC40169B7E5FBA8BD0B584034DE9E07B9CDF3CE451C706

Function 00007FF8F9D73124 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000,00007FF8F9D73434), ref: 00007FF8F9D7312E
FlsGetValue.KERNEL32(?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000,00007FF8F9D73434), ref: 00007FF8F9D7313C
SetLastError.KERNEL32(?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000,00007FF8F9D73434), ref: 00007FF8F9D73194

Part of subcall function 00007FF8F9D73484: Sleep.KERNEL32(?,?,?,00007FF8F9D73157,?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000), ref: 00007FF8F9D734C9

FlsSetValue.KERNEL32(?,?,00000000,00007FF8F9D7554D,?,?,?,?,00007FF8F9D75602,?,?,00000000,00007FF8F9D73434), ref: 00007FF8F9D73168
free.LIBCMT ref: 00007FF8F9D7318B

Part of subcall function 00007FF8F9D7306C: _lock.LIBCMT ref: 00007FF8F9D730C0
Part of subcall function 00007FF8F9D7306C: _lock.LIBCMT ref: 00007FF8F9D730DF

GetCurrentThreadId.KERNEL32 ref: 00007FF8F9D7317C

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 9046769ee5b5d8007ce9bd779be04ed4bd1bebc68c88bb67ae1db3be94da147b
Instruction ID: 657fea88c4ef74400edb200fa30e2517c65d798084187e4b6ec71211b4f11f92
Opcode Fuzzy Hash: 9046769ee5b5d8007ce9bd779be04ed4bd1bebc68c88bb67ae1db3be94da147b
Instruction Fuzzy Hash: 34012524A097C68EFB19BF65AC88178A751BF687E0F248238CD3D023DDDE3CE4458212

Function 00007FF8F9D76AC8 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8F9D76B22
malloc.LIBCMT ref: 00007FF8F9D76B86
MultiByteToWideChar.KERNEL32 ref: 00007FF8F9D76BCE
GetStringTypeW.KERNEL32 ref: 00007FF8F9D76BE5
free.LIBCMT ref: 00007FF8F9D76BF9

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: 4197c3f5a9b9ad05d1792587c407f8471a23bb75f3626596d7a776d2ff48d1ef
Instruction ID: c43fb63f69848ccb3baeb930b2474bd560cdd1d74117f09a9fa51c4f4cf17d02
Opcode Fuzzy Hash: 4197c3f5a9b9ad05d1792587c407f8471a23bb75f3626596d7a776d2ff48d1ef
Instruction Fuzzy Hash: 57415022A04BC18AEF10AF259C005A97795FF65BE8F684635EE3D477D8EE3CE4018302

Function 00007FF8F9D75CDC Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,00007FF8F9D75DF1,?,?,?,?,00007FF8F9D73706,?,?,?,00007FF8F9D72AB1), ref: 00007FF8F9D75D05
DecodePointer.KERNEL32(?,?,?,00007FF8F9D75DF1,?,?,?,?,00007FF8F9D73706,?,?,?,00007FF8F9D72AB1), ref: 00007FF8F9D75D15

Part of subcall function 00007FF8F9D76CA8: _errno.LIBCMT ref: 00007FF8F9D76CB1
Part of subcall function 00007FF8F9D76CA8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8F9D76CBC

EncodePointer.KERNEL32(?,?,?,00007FF8F9D75DF1,?,?,?,?,00007FF8F9D73706,?,?,?,00007FF8F9D72AB1), ref: 00007FF8F9D75D93

Part of subcall function 00007FF8F9D73508: realloc.LIBCMT ref: 00007FF8F9D73533
Part of subcall function 00007FF8F9D73508: Sleep.KERNEL32(?,?,00000000,00007FF8F9D75D83,?,?,?,00007FF8F9D75DF1,?,?,?,?,00007FF8F9D73706), ref: 00007FF8F9D7354F

EncodePointer.KERNEL32(?,?,?,00007FF8F9D75DF1,?,?,?,?,00007FF8F9D73706,?,?,?,00007FF8F9D72AB1), ref: 00007FF8F9D75DA3
EncodePointer.KERNEL32(?,?,?,00007FF8F9D75DF1,?,?,?,?,00007FF8F9D73706,?,?,?,00007FF8F9D72AB1), ref: 00007FF8F9D75DB0

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: 4020895f4579cb890be3ec8236cf22bf03a5c23994690ca6febfbd4cbd483088
Instruction ID: ec3307051531e13aeeb9e317815254e1d947d8005a8f7df3af75bbadd52b05a3
Opcode Fuzzy Hash: 4020895f4579cb890be3ec8236cf22bf03a5c23994690ca6febfbd4cbd483088
Instruction Fuzzy Hash: B7219121B19BC649EB04BF21FD48169A251BF68BC0FA44835D96E477DCEE3DE085C302

Function 00007FF8F9D73590 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,00007FF8F9D735D9,?,?,00000028,00007FF8F9D755AD,?,?,00000000,00007FF8F9D73434,?,?,?,00007FF8F9D747C9), ref: 00007FF8F9D7359F
GetProcAddress.KERNEL32(?,?,000000FF,00007FF8F9D735D9,?,?,00000028,00007FF8F9D755AD,?,?,00000000,00007FF8F9D73434,?,?,?,00007FF8F9D747C9), ref: 00007FF8F9D735B4

Strings

CorExitProcess, xrefs: 00007FF8F9D735AA
mscoree.dll, xrefs: 00007FF8F9D73598

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 352be39e4b11eef8345133aae6bfe6d534a86633cfd5650ce4515e53a04240e6
Instruction ID: b18aeafedf625e7f2a7ad799fb7b44ca7f883b97de1fe5b0991588ef9ac8d03d
Opcode Fuzzy Hash: 352be39e4b11eef8345133aae6bfe6d534a86633cfd5650ce4515e53a04240e6
Instruction Fuzzy Hash: C5E0EC10F096868AFF1D6F61ACC457416905F78781B68143AC42E063E8DE3CA5898211

Function 00007FF8F9D75800 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF8F9D7584E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8F9D75859
DecodePointer.KERNEL32(?,?,?,?,?,00007FF8F9D76CFC,?,?,?,?,00007FF8F9D757AA), ref: 00007FF8F9D75908
_lock.LIBCMT ref: 00007FF8F9D75933

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: 1186b08b6f24f277772bad81521af2655619e9034e19ddc1f486a25c540ade82
Instruction ID: 7845a87322564bf8eb09c308514c41cfb31a1fd49f7c693d2bfbe8463ece50cc
Opcode Fuzzy Hash: 1186b08b6f24f277772bad81521af2655619e9034e19ddc1f486a25c540ade82
Instruction Fuzzy Hash: 93517231A086CA8EEB69AF25AC402396651EBA57D0F344535D97E426DCDF3EF841C603

Function 00007FF8F9D74E8C Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF8F9D74E96

Part of subcall function 00007FF8F9D731A8: _amsg_exit.LIBCMT ref: 00007FF8F9D731BE

_lock.LIBCMT ref: 00007FF8F9D74EC4
free.LIBCMT ref: 00007FF8F9D74EFA
_amsg_exit.LIBCMT ref: 00007FF8F9D74F33

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: c2d705e3473a406f3fcada80591938e82bf615478f0ee564bb4276966eef9738
Instruction ID: e872b35fa124a342f90eaa0fe266bef32e5f45f6753364defa12d9e7de121cfa
Opcode Fuzzy Hash: c2d705e3473a406f3fcada80591938e82bf615478f0ee564bb4276966eef9738
Instruction Fuzzy Hash: 8511FC31A196C689EB95AF10E880778B2A2EFA4784F284435DA6D037D9DF2CE450C702

Function 00007FF8F9D73044 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,00007FF8F9D72B16), ref: 00007FF8F9D73053
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8F9D72B16), ref: 00007FF8F9D746FB
free.LIBCMT ref: 00007FF8F9D74704
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8F9D72B16), ref: 00007FF8F9D7472B

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 56a830950c2ab184f401ce3ac379cb7e1f416c44d659004cc0f349f5e33fcec8
Instruction ID: 752760128c5ebed62cae62465e7b22131d32304d421b23a132e0bb9536febf35
Opcode Fuzzy Hash: 56a830950c2ab184f401ce3ac379cb7e1f416c44d659004cc0f349f5e33fcec8
Instruction Fuzzy Hash: 3B116035E096C28EE755AF11AC5427963A1EFA1BD4F780131DA7D026ECCF3CE4808702

Function 00007FF8F9D74B98 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF8F9D74B9E

Part of subcall function 00007FF8F9D731A8: _amsg_exit.LIBCMT ref: 00007FF8F9D731BE

_getptd.LIBCMT ref: 00007FF8F9D74BBE
_lock.LIBCMT ref: 00007FF8F9D74BD1
_amsg_exit.LIBCMT ref: 00007FF8F9D74BFF

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: 394f0da4975551f222ce854e0696739fdc27f771140fe9660421bd1c5574318e
Instruction ID: 0f10d47e9e14cb3684d714f8fd7a5a0850cea7d434c59ee94a3e3136142b6a01
Opcode Fuzzy Hash: 394f0da4975551f222ce854e0696739fdc27f771140fe9660421bd1c5574318e
Instruction Fuzzy Hash: 3BF01D21A0A0C2C9FB557F519C517B85762AFF4BC0F680139DA3C0B3DADE1CA840C712

Function 00007FF8F9D721E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF8F9D72243
GetCurrentProcess.KERNEL32 ref: 00007FF8F9D7225D

Part of subcall function 00007FF8F9D72050: IsBadReadPtr.KERNEL32 ref: 00007FF8F9D7208D

Strings

msv1_0.dll, xrefs: 00007FF8F9D7223C

Memory Dump Source

Source File: 00000003.00000002.2036573447.00007FF8F9D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8F9D70000, based on PE: true

Associated: 00000003.00000002.2036543269.00007FF8F9D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036612376.00007FF8F9D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036646004.00007FF8F9D7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2036682519.00007FF8F9D7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8f9d70000_rundll32.jbxd

Similarity

API ID: CurrentHandleModuleProcessRead
String ID: msv1_0.dll
API String ID: 1127731934-3020988122
Opcode ID: 2628a342e41d05837928dbf836fdca699977a2040fe578c6c07e6d8be5ce4c2b
Instruction ID: 13b551c707fd1e34146141524e89e8c2cbf66180d0dc15370dffb0db29beac19
Opcode Fuzzy Hash: 2628a342e41d05837928dbf836fdca699977a2040fe578c6c07e6d8be5ce4c2b
Instruction Fuzzy Hash: 2B41AA32A0D6C58ADB60DF59E89032AB7E0F798794F200535EA9E83B98DF7CD5408B11

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report wceaux.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_wce_4026f1157d2df5ef6bac8fe9276b3cbf2d69f6_34d188ac_00d32710-3c9d-4bcb-be66-813bee057e70\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_wce_4026f1157d2df5ef6bac8fe9276b3cbf2d69f6_34d188ac_5f2726b2-8ab6-43b7-b59b-1c82eee9c0a5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_wce_603d3a596b89bf838e816eb97eecc919abe468_34d188ac_adbca7aa-f72d-47c6-930d-6a35b35040f9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_wce_905ba8786e3d43c26ec942c5ac4372ed80eef926_34d188ac_7b3b61dd-f760-40ad-b1e3-c9cd550b56fc\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9AAC.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9ACC.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B59.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B5A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9BE7.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C65.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA50D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA57B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA59B.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB096.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB0D5.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB105.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Windows Analysis Report
wceaux.dll.dll

Function 00007FF8F9D741D8 Relevance: 4.5, APIs: 3, Instructions: 20
memoryCOMMON

Function 00007FF8F9D72A38 Relevance: 10.6, APIs: 7, Instructions: 93
threadCOMMON

Function 00007FF8F9D76D30 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 136
libraryloaderCOMMONLIBRARYCODE