Edit tour

Windows Analysis Report
temp_error_logs.scr.exe

Overview

General Information

Sample name:	temp_error_logs.scr.exe
Analysis ID:	1648207
MD5:	51a1010aa03722eae1fa2a8c55e80885
SHA1:	c43a11071ca070c9d01298046eb44f8a1cf7d0a6
SHA256:	07162f49a860051f8f878b3e3824168d8e0ede5672d21ab3746a2ee5410c0bb3
Tags:	exeuser-smica83
Infos:

Detection

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Joe Sandbox ML detected suspicious sample

AV process strings found (often used to terminate AV products)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

temp_error_logs.scr.exe (PID: 1796 cmdline: "C:\Users\user\Desktop\temp_error_logs.scr.exe" MD5: 51A1010AA03722EAE1FA2A8C55E80885)

WerFault.exe (PID: 2176 cmdline: C:\Windows\system32\WerFault.exe -u -p 1796 -s 708 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-25T16:44:04.866114+0100	2028371	3	Unknown Traffic	192.168.2.4	49712	185.114.247.104	443	TCP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: temp_error_logs.scr.exe	Virustotal: Detection: 34%			Perma Link
Source: temp_error_logs.scr.exe	ReversingLabs: Detection: 33%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.1% probability

Source: unknown

HTTPS traffic detected: 185.114.247.104:443 -> 192.168.2.4:49712 version: TLS 1.2

Source: temp_error_logs.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\temp_error_logs.scr.exe

Code function: 4x nop then push r12

0_2_00007FF73EF51E03

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49712 -> 185.114.247.104:443

Source: global traffic

HTTP traffic detected: GET /wp-content/plugins/fluentform/storage/framework/intext.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 1Host: autoservice-23.ru

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: autoservice-23.ru

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.3Date: Tue, 25 Mar 2025 15:44:05 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: X-Forwarded-Proto,Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://autoservice-23.ru/wp-json/>; rel="https://api.w.org/"

Source: temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1162972079.0000013840FD2000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gmpg.org/xfn/11
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F7D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: temp_error_logs.scr.exe, 00000000.00000002.1222281582.0000013840F37000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1163063671.0000013840F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoservice-23.ru/
Source: temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1162972079.0000013840FD2000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoservice-23.ru/comments/feed/
Source: temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1162972079.0000013840FD2000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoservice-23.ru/feed/
Source: temp_error_logs.scr.exe, 00000000.00000002.1222217573.0000013840F13000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F60000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222281582.0000013840F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoservice-23.ru/wp-content/plugins/fluentform/storage/framework/intext.php
Source: temp_error_logs.scr.exe, 00000000.00000002.1222217573.0000013840F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoservice-23.ru/wp-content/plugins/fluentform/storage/framework/intext.phpM
Source: temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1162972079.0000013840FD2000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoservice-23.ru/wp-includes/css/classic-themes.min.css?ver=1
Source: temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1162972079.0000013840FD2000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoservice-23.ru/wp-includes/css/dist/block-library/style.min.css?ver=6.1.7
Source: temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F7D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoservice-23.ru/wp-json/
Source: temp_error_logs.scr.exe, 00000000.00000002.1222217573.0000013840F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoservice-23.ru:443/wp-content/plugins/fluentform/storage/framework/intext.php
Source: temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1162972079.0000013840FD2000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown

HTTPS traffic detected: 185.114.247.104:443 -> 192.168.2.4:49712 version: TLS 1.2

Source: C:\Users\user\Desktop\temp_error_logs.scr.exe

Code function: 0_2_00007FF73EF57F70 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,

0_2_00007FF73EF57F70

Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Code function: 0_2_00007FF73EF59EF0	0_2_00007FF73EF59EF0
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Code function: 0_2_00007FF73EF5A630	0_2_00007FF73EF5A630
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Code function: 0_2_00007FF73EF5B080	0_2_00007FF73EF5B080
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Code function: 0_2_00007FF73EF596F0	0_2_00007FF73EF596F0
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Code function: 0_2_00007FF73EF57D00	0_2_00007FF73EF57D00
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Code function: 0_2_00007FF73EF54F60	0_2_00007FF73EF54F60

Source: C:\Users\user\Desktop\temp_error_logs.scr.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1796 -s 708

Source: temp_error_logs.scr.exe

Static PE information: Number of sections : 11 > 10

Source: temp_error_logs.scr.exe

Static PE information: Section: .rsrc ZLIB complexity 0.9972568469101124

Source: classification engine

Classification label: mal52.winEXE@2/5@1/1

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1796

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\e4f18b9f-cae7-4505-aa49-a3ef386508b3

Jump to behavior

Source: temp_error_logs.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\temp_error_logs.scr.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: temp_error_logs.scr.exe	Virustotal: Detection: 34%
Source: temp_error_logs.scr.exe	ReversingLabs: Detection: 33%

Source: unknown	Process created: C:\Users\user\Desktop\temp_error_logs.scr.exe "C:\Users\user\Desktop\temp_error_logs.scr.exe"
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1796 -s 708

Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Section loaded: dpapi.dll	Jump to behavior

Source: temp_error_logs.scr.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: temp_error_logs.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: temp_error_logs.scr.exe

Static PE information: section name: .xdata

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\temp_error_logs.scr.exe

API coverage: 3.5 %

Source: C:\Users\user\Desktop\temp_error_logs.scr.exe TID: 1016

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: temp_error_logs.scr.exe, 00000000.00000002.1222281582.0000013840F7D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F7D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: temp_error_logs.scr.exe, 00000000.00000002.1222217573.0000013840F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0;
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\temp_error_logs.scr.exe

Code function: 0_2_00007FF73EF59E20 LoadLibraryA,RtlQueueWorkItem,LdrLoadDll,

0_2_00007FF73EF59E20

Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Code function: 0_2_00007FF73EF66300 SetUnhandledExceptionFilter,__initenv,		0_2_00007FF73EF66300
Source: C:\Users\user\Desktop\temp_error_logs.scr.exe	Code function: 0_2_00007FF73EF51190 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,GetStartupInfoA,		0_2_00007FF73EF51190

Source: C:\Users\user\Desktop\temp_error_logs.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Software Packing	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	14 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
temp_error_logs.scr.exe	34%	Virustotal		Browse
temp_error_logs.scr.exe	33%	ReversingLabs	Win64.Trojan.Sonbokli

Source	Detection	Scanner	Label
https://autoservice-23.ru/wp-content/plugins/fluentform/storage/framework/intext.php	0%	Avira URL Cloud	safe
https://autoservice-23.ru/feed/	0%	Avira URL Cloud	safe
https://autoservice-23.ru/	0%	Avira URL Cloud	safe
https://autoservice-23.ru/comments/feed/	0%	Avira URL Cloud	safe
https://autoservice-23.ru/wp-json/	0%	Avira URL Cloud	safe
https://autoservice-23.ru/wp-includes/css/dist/block-library/style.min.css?ver=6.1.7	0%	Avira URL Cloud	safe
https://autoservice-23.ru:443/wp-content/plugins/fluentform/storage/framework/intext.php	0%	Avira URL Cloud	safe
https://autoservice-23.ru/wp-content/plugins/fluentform/storage/framework/intext.phpM	0%	Avira URL Cloud	safe
https://autoservice-23.ru/wp-includes/css/classic-themes.min.css?ver=1	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
autoservice-23.ru	185.114.247.104	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://autoservice-23.ru/wp-content/plugins/fluentform/storage/framework/intext.php	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://autoservice-23.ru:443/wp-content/plugins/fluentform/storage/framework/intext.php	temp_error_logs.scr.exe, 00000000.00000002.1222217573.0000013840F13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.3.dr	false		high
https://autoservice-23.ru/feed/	temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1162972079.0000013840FD2000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://autoservice-23.ru/wp-includes/css/classic-themes.min.css?ver=1	temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1162972079.0000013840FD2000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://autoservice-23.ru/wp-content/plugins/fluentform/storage/framework/intext.phpM	temp_error_logs.scr.exe, 00000000.00000002.1222217573.0000013840F13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://autoservice-23.ru/wp-json/	temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F7D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://autoservice-23.ru/wp-includes/css/dist/block-library/style.min.css?ver=6.1.7	temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1162972079.0000013840FD2000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://autoservice-23.ru/	temp_error_logs.scr.exe, 00000000.00000002.1222281582.0000013840F37000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1163063671.0000013840F37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gmpg.org/xfn/11	temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1162972079.0000013840FD2000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.w.org/	temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F7D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://autoservice-23.ru/comments/feed/	temp_error_logs.scr.exe, 00000000.00000003.1162988527.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000003.1162972079.0000013840FD2000.00000004.00000020.00020000.00000000.sdmp, temp_error_logs.scr.exe, 00000000.00000002.1222395858.0000013840F8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.114.247.104	autoservice-23.ru	Russian Federation		9123	TIMEWEB-ASRU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1648207
Start date and time:	2025-03-25 16:43:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	temp_error_logs.scr.exe
Detection:	MAL
Classification:	mal52.winEXE@2/5@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 24
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, WerFault.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20, 20.190.135.6, 184.31.69.3, 4.245.163.56
Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:44:04	API Interceptor	1x Sleep call for process: temp_error_logs.scr.exe modified
11:44:10	API Interceptor	1x Sleep call for process: WerFault.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TIMEWEB-ASRU	Payment Advice Note from 18.03.2025.docx	Get hash	malicious	Unknown	Browse	188.225.72.170
	Payment Advice Note from 18.03.2025.docx	Get hash	malicious	Unknown	Browse	188.225.72.170
	Nueva orden.xla.xlsx	Get hash	malicious	Unknown	Browse	188.225.72.170
	Nueva orden.xla.xlsx	Get hash	malicious	Unknown	Browse	188.225.72.170
	PO#450-146675.xla.xlsx	Get hash	malicious	Unknown	Browse	188.225.72.170
	PO 23-179, PO 23-181.xls	Get hash	malicious	Unknown	Browse	188.225.72.170
	Mawaris-RFQ.xls	Get hash	malicious	Unknown	Browse	188.225.72.170
	PO#450-146675.xla.xlsx	Get hash	malicious	Unknown	Browse	188.225.72.170
	PO 23-179, PO 23-181.xls	Get hash	malicious	Unknown	Browse	188.225.72.170
	BGL-17-2025, Packing List ... . 2073799 07 [S-29-40].xls	Get hash	malicious	Unknown	Browse	188.225.72.170

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	ASIr1Bo2x9.exe	Get hash	malicious	LummaC Stealer	Browse	185.114.247.104
	ySTYvI9Pvk.exe	Get hash	malicious	LummaC Stealer	Browse	185.114.247.104
	6aOM10d2pR.exe	Get hash	malicious	LummaC Stealer	Browse	185.114.247.104
	Ec0AgD2t1q.exe	Get hash	malicious	DarkVision Rat	Browse	185.114.247.104
	750413b4e6897a671bc759e04597952a0be747830189873b.xlsm.1.ps1	Get hash	malicious	LummaC Stealer	Browse	185.114.247.104
	quotation_1.xlsx	Get hash	malicious	Unknown	Browse	185.114.247.104
	Untitled_20250325.docx.doc	Get hash	malicious	Unknown	Browse	185.114.247.104
	750413b4e6897a671bc759e04597952a0be747830189873b.bin.exe	Get hash	malicious	LummaC Stealer	Browse	185.114.247.104
	Qyk8RJnGN7.exe	Get hash	malicious	LummaC Stealer	Browse	185.114.247.104
	h2H2R15NDO.exe	Get hash	malicious	LummaC Stealer	Browse	185.114.247.104

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_temp_error_logs._c9874d87b4e07e6dca25199d889b2514353f5c4_28bacb84_746fe102-aa32-49db-9307-f63256ef4eb2\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9258917181282965
Encrypted:	false
SSDEEP:	96:1dJFGSL5s6hOA77fnBQXIDcQtc6vCHcECcw38+HbHg/5yuuzOqgOyjCD5Pkg9hiR:R95Zm0zLMIJjV3izuiF1Z24lO8H
MD5:	7EFA2BEA1B8EC806C778FB01AF836BAE
SHA1:	051E0C20FF1A44E95FC0E54546F2AC6364622FCE
SHA-256:	9F679BB4E3BD62D5758B369896EA7EE9E6987874895570AB4113A2D49E974029
SHA-512:	DE3EE220AB7F169623D012C1CB4F1C9E1F9D59D08877029DBBD1F7268C2E98FE7CC53E3125F440569C094414505321218385FD31BE26841D6DCE89A50E715E20
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.7.3.9.1.0.4.6.8.2.6.5.7.0.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.7.3.9.1.0.4.7.8.8.9.0.7.4.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.4.6.f.e.1.0.2.-.a.a.3.2.-.4.9.d.b.-.9.3.0.7.-.f.6.3.2.5.6.e.f.4.e.b.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.0.6.7.2.e.b.4.-.6.b.3.d.-.4.9.e.5.-.b.e.d.3.-.3.0.0.6.8.f.b.4.0.2.e.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.t.e.m.p._.e.r.r.o.r._.l.o.g.s...s.c.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.0.4.-.0.0.0.1.-.0.0.1.8.-.8.b.8.1.-.9.e.b.b.9.c.9.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.4.5.5.2.6.1.6.8.a.b.5.8.e.b.8.9.a.9.b.a.4.e.b.c.8.f.8.2.a.d.6.0.0.0.0.f.f.f.f.!.0.0.0.0.c.4.3.a.1.1.0.7.1.c.a.0.7.0.c.9.d.0.1.2.9.8.0.4.6.e.b.4.4.f.8.a.1.c.f.7.d.0.a.6.!.t.e.m.p._.e.r.r.o.r._.l.o.g.s...s.c.r...e.x.e.....T.a.r.g.e.t.A.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER114A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8824
Entropy (8bit):	3.7023186062917524
Encrypted:	false
SSDEEP:	192:R6l7wVeJ/5gxIPIQ6Y6UuXgmfgLc9pDt89bibqcfZ8jm:R6lXJxyIPIQ6Y5uXgmfgLcSib5fu6
MD5:	F6749ECD9D640B363572D63E80805730
SHA1:	54BEE9F06559264D804E4E7FC94F2C9439AF49D7
SHA-256:	43A69F2F1012EAB53D89195163FAA55934CBC452242930D2DB08BCC34B574D94
SHA-512:	80A43753A155B928275FCC33CB510283B4B451DA1D8BDFE6E69EFF2EED9717318DA1E1D60162BAAB742B8DBBD3DF923A9C9D37464EBE8E9F361E450FBB09FD42
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.7.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER11E8.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4704
Entropy (8bit):	4.453159334433156
Encrypted:	false
SSDEEP:	48:cvIwWl8zsJJg771I9KtWpW8VYEYm8M4J946FHyq85l/8sTN3d:uIjfbI7lc7VAJWQY8oN3d
MD5:	C0D0E18B265491D659C84FA256DC1AC0
SHA1:	9ADFEB315259A64B26B5764413957BB3E8190652
SHA-256:	396D18E217ACAED1619DCD45F0B291619AD017898077C93265E569C51A8194D4
SHA-512:	BF4FB64357829BCB35C50245A860621FF5F8B585489DC13FC1530BA6C6417D2213029C495E42AF716CA52639C5A95EF8FAE561DC33A08A95E5BDA4F48E6D968D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="776566" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2C.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Mar 25 15:44:07 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	143426
Entropy (8bit):	1.3750227114062652
Encrypted:	false
SSDEEP:	192:Or8+h1muhqRQEKO+B3dxo769vOUm+gEV/MCYtnNF6CAd8fTJVgk5hpatAJG0:1+h1FmQU+Btxo76pQHYvsNF6CqMrNNJ
MD5:	0A414479DDAA2AFD89871757B5548FBA
SHA1:	FE39B31CB783B689BA7ABE424BB90EF8DDED9F10
SHA-256:	B03D703148D5D3BFF71BC2E572161713C6BE6A8ED065020C6377B4750F64882D
SHA-512:	B8E103DB1701BA2D3E955C296B8C65E590A534FC71B11385F660D4AE721A8B7B6A9ECA099E603E06B9D20D74E19CD9B27806B346C8D982D546841CB49C5B26D1
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......G..g....................................$................S..........`.......8...........T............8..z.......................................................................................................eJ......p.......Lw......................T...........B..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468831394625387
Encrypted:	false
SSDEEP:	6144:OIXfpi67eLPU9skLmb0b4jWSPKaJG8nAgejZMMhA2gX4WABlVuNNdwBCswSb7i:DXD94jWlLZMM6YFU/+7i
MD5:	FC0C1414C04B2A7DB043A9C051726650
SHA1:	C9E1E0831DA4BB2E3BE834404E981D666D95F0A9
SHA-256:	BD42EA8397BA4FC0787DDE9828C57CCF55DEA4DDE95D5C7F1DEB49893E5902C1
SHA-512:	A7AD3AC376F566847C351CD56FC479774451DF4203514A9A8F0D183C3B5D1EA64B71F87519A631738F32CCB2589BBC2BC11FE596FF8FDAD3FA57A7875789575B
Malicious:	false
Reputation:	low
Preview:	regf:...:....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.444798509982794
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	temp_error_logs.scr.exe
File size:	170'496 bytes
MD5:	51a1010aa03722eae1fa2a8c55e80885
SHA1:	c43a11071ca070c9d01298046eb44f8a1cf7d0a6
SHA256:	07162f49a860051f8f878b3e3824168d8e0ede5672d21ab3746a2ee5410c0bb3
SHA512:	2e095305a85009a9d27db558979ccf1242b08db15949b76a6e32378b8311ce0baea7ae74db01a3aac0d004c0ab937d47472de7a9f6ca6d2bf9a248ee8b8a714b
SSDEEP:	3072:RZAApTxg89HNH2XpykZOq78L/3GaT0pYQzO7zsCgxeD5zDR5:RDpn9tFkZ/0vGa4DzO/pgxeD5zV5
TLSH:	04F3C016F39362FCC523C47442AB7672BE32B86606204F7E63E8E7315E21E115B3DA59
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......g...............&.......................@....................................d.....`... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400014d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x67D3FC0A [Fri Mar 14 09:51:06 2025 UTC]
TLS Callbacks:	0x40001680, 0x1, 0x40001650, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2a7632ed785255ad126b2e8d95a9fa96

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00011615h]
mov dword ptr [eax], 00000001h
call 00007F750CB66EEFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [000115F5h]
mov dword ptr [eax], 00000000h
call 00007F750CB66ECFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F750CB6D1B4h
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F750CB67219h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec ecx
mov ebx, ecx
ret
dec ecx
mov edx, ecx
inc ecx
mov eax, dword ptr [ebx+08h]
inc ecx
jmp dword ptr [ebx]
ret
nop
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0000DAA5h]
dec eax
mov eax, dword ptr [eax]
dec eax
test eax, eax
je 00007F750CB67264h
nop dword ptr [eax+eax+00h]
call eax
dec eax
mov eax, dword ptr [0000DA8Fh]
dec eax
lea edx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [eax+08h]
dec eax
mov dword ptr [0000DA80h], edx
dec eax
test eax, eax
jne 00007F750CB67225h
dec eax
add esp, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16000	0xa30	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0x16340	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x13000	0x4a4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30000	0x84	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x122e0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x162a8	0x258	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xd9c8	0xda00	261b402aec60a19230b87d056ade0159	False	0.5595792717889908	data	6.242509561498838	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xf000	0x2a60	0x2c00	a653e93d53c1b8b105b8358fc9f01cd2	False	0.20152698863636365	data	4.594133415958572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x12000	0xc90	0xe00	c67563ba238553d3f6be5853b8a7d61a	False	0.42940848214285715	data	4.63680692028798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x13000	0x4a4	0x600	fe4887339b5be68f76e93d2cafad6c06	False	0.4225260416666667	data	3.7255521539049417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x14000	0x460	0x600	97e063e03464150ed3bef4069587c1f0	False	0.2994791666666667	data	3.589510160429754	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x15000	0xb60	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x16000	0xa30	0xc00	9762a552cd6b6f613713fad3bee27931	False	0.3014322916666667	data	3.775851499023205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x17000	0x68	0x200	7895f8a49816d49e5dfbf278995305f6	False	0.072265625	data	0.3406417195159507	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x18000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19000	0x16340	0x16400	bea343a54dabb53042b68171c2d74a32	False	0.9972568469101124	data	7.994057654667068	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x30000	0x84	0x200	aa7a02d4d0e2d78f411d76c773c2a134	False	0.251953125	data	1.5791638072144614	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_RCDATA	0x19058	0x162e2	data	English	United States	0.9996147495872317

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, GetStartupInfoA, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, MultiByteToWideChar, ReadConsoleA, ReadConsoleInputW, ReadConsoleW, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery, WideCharToMultiByte
msvcrt.dll	__C_specific_handler, ___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _assert, _cexit, _commode, _errno, _filelengthi64, _fileno, _fmode, _initterm, _localtime64, _lock, _mktime64, _onexit, _time64, _unlock, _utime64, _wfopen_s, _wfreopen_s, _wstat64, abort, calloc, exit, fclose, fflush, fgetpos, fprintf, fputc, fread, free, fsetpos, fwrite, localeconv, malloc, memcmp, memcpy, memset, realloc, remove, signal, strerror, strlen, strncmp, vfprintf, wcslen
SHELL32.dll	SHGetFolderPathW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-25T16:44:04.866114+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49712	185.114.247.104	443	TCP

Network Port Distribution

Total Packets: 15
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2025 16:44:04.411334991 CET	49712	443	192.168.2.4	185.114.247.104
Mar 25, 2025 16:44:04.411376953 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:04.411477089 CET	49712	443	192.168.2.4	185.114.247.104
Mar 25, 2025 16:44:04.434096098 CET	49712	443	192.168.2.4	185.114.247.104
Mar 25, 2025 16:44:04.434129000 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:04.865977049 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:04.866113901 CET	49712	443	192.168.2.4	185.114.247.104
Mar 25, 2025 16:44:04.869659901 CET	49712	443	192.168.2.4	185.114.247.104
Mar 25, 2025 16:44:04.869678974 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:04.870037079 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:04.910397053 CET	49712	443	192.168.2.4	185.114.247.104
Mar 25, 2025 16:44:04.931905985 CET	49712	443	192.168.2.4	185.114.247.104
Mar 25, 2025 16:44:04.933309078 CET	49712	443	192.168.2.4	185.114.247.104
Mar 25, 2025 16:44:04.933381081 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:05.985377073 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:05.985404968 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:05.985410929 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:05.985419989 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:05.985445976 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:05.985471010 CET	49712	443	192.168.2.4	185.114.247.104
Mar 25, 2025 16:44:05.985486031 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:05.985497952 CET	49712	443	192.168.2.4	185.114.247.104
Mar 25, 2025 16:44:05.985526085 CET	49712	443	192.168.2.4	185.114.247.104
Mar 25, 2025 16:44:05.985887051 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:05.985902071 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:05.986025095 CET	49712	443	192.168.2.4	185.114.247.104
Mar 25, 2025 16:44:05.986031055 CET	443	49712	185.114.247.104	192.168.2.4
Mar 25, 2025 16:44:05.986092091 CET	49712	443	192.168.2.4	185.114.247.104
Mar 25, 2025 16:44:05.987016916 CET	49712	443	192.168.2.4	185.114.247.104

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2025 16:44:03.932454109 CET	59160	53	192.168.2.4	1.1.1.1
Mar 25, 2025 16:44:04.404454947 CET	53	59160	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 25, 2025 16:44:03.932454109 CET	192.168.2.4	1.1.1.1	0x694a	Standard query (0)	autoservice-23.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 25, 2025 16:44:04.404454947 CET	1.1.1.1	192.168.2.4	0x694a	No error (0)	autoservice-23.ru		185.114.247.104	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

autoservice-23.ru

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49712	185.114.247.104	443	1796	C:\Users\user\Desktop\temp_error_logs.scr.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 15:44:04 UTC	312	OUT	GET /wp-content/plugins/fluentform/storage/framework/intext.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 1 Host: autoservice-23.ru
2025-03-25 15:44:04 UTC	1	OUT	Data Raw: 00 Data Ascii:
2025-03-25 15:44:05 UTC	399	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.3 Date: Tue, 25 Mar 2025 15:44:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: X-Forwarded-Proto,Accept-Encoding Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://autoservice-23.ru/wp-json/>; rel="https://api.w.org/"
2025-03-25 15:44:05 UTC	15985	IN	Data Raw: 62 33 64 63 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 2d 52 55 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 74 69 74 6c 65 3e d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 26 23 38 32 31 32 3b 20 d0 90 d0 b2 d1 82 Data Ascii: b3dc<!doctype html><html lang="ru-RU"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="http://gmpg.org/xfn/11"><title> —
2025-03-25 15:44:05 UTC	16384	IN	Data Raw: 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 73 29 2c 64 6c 3d 6c 21 3d 27 64 61 74 61 4c 61 79 65 72 27 3f 27 26 6c 3d 27 2b 6c 3a 27 27 3b 6a 2e 61 73 79 6e 63 3d 74 72 75 65 3b 6a 2e 73 72 63 3d 0a 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 6d 2e 27 2b 27 6a 73 3f 69 64 3d 27 2b 69 2b 64 6c 3b 66 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 6a 2c 66 29 3b 0a 7d 29 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 2c 27 73 63 72 69 70 74 27 2c 27 64 61 74 61 4c 61 79 65 72 27 2c 27 47 54 4d 2d 4b 53 51 44 32 37 4e 27 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 45 6e 64 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 Data Ascii: ByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='//www.googletagmanager.com/gtm.'+'js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-KSQD27N');</script>... End Google Tag Ma

Statistics

Click to jump to process

Memory Usage

• temp_error_logs.scr.exe
• WerFault.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Behavior

• temp_error_logs.scr.exe
• WerFault.exe

Click to jump to process

Target ID:	0
Start time:	11:44:02
Start date:	25/03/2025
Path:	C:\Users\user\Desktop\temp_error_logs.scr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\temp_error_logs.scr.exe"
Imagebase:	0x7ff73ef50000
File size:	170'496 bytes
MD5 hash:	51A1010AA03722EAE1FA2A8C55E80885
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:44:06
Start date:	25/03/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1796 -s 708
Imagebase:	0x7ff75b790000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.9%
Total number of Nodes:	718
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF73EF59EF0 Relevance: .2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6bf7d0c8fe181a9623d5925791fbdcaca1bbc105312d8e4c8a8ca1a1468ec64
Instruction ID: 7009512d5756c1049e2b82f79213d181e1f81779446907d2f9a369038eb730df
Opcode Fuzzy Hash: a6bf7d0c8fe181a9623d5925791fbdcaca1bbc105312d8e4c8a8ca1a1468ec64
Instruction Fuzzy Hash: B291AF61A08A0393FB94BB26A81472AA6A0FF85B94F804634DE4D077C4DF7DD658EB50

Function 00007FF73EF595F0 Relevance: 3.0, APIs: 2, Instructions: 38
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,?,?,?,00007FF73EF5851B), ref: 00007FF73EF59618
RtlCreateHeap.NTDLL ref: 00007FF73EF5965F

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: Heap$AllocateCreate
String ID:
API String ID: 2875408731-0
Opcode ID: 45a0b8ff22522911d1057891351f0735db9bb9d063b9c7c5c479dd8d70dcfec2
Instruction ID: 4ee3480a74b69a79f6f13c85c020412e38b60f9d3525d661099494db66b35455
Opcode Fuzzy Hash: 45a0b8ff22522911d1057891351f0735db9bb9d063b9c7c5c479dd8d70dcfec2
Instruction Fuzzy Hash: 59F0A461B19B1352FBA8BB566410722E2D0BF58780F884139DE9D437D0EF7CA509E710

Function 00007FF73EF59680 Relevance: 3.0, APIs: 2, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL ref: 00007FF73EF596A1
RtlCreateHeap.NTDLL ref: 00007FF73EF596CF

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: Heap$CreateFree
String ID:
API String ID: 144610141-0
Opcode ID: 101db8124988f8e4862053b535dfbd00e50db68e29e974497628e07aa69a8635
Instruction ID: 68cfd25438b6f2e279e00ec9c06c096a5c67bc06148a49d69083b2aacf03c65b
Opcode Fuzzy Hash: 101db8124988f8e4862053b535dfbd00e50db68e29e974497628e07aa69a8635
Instruction Fuzzy Hash: 50F0E262F1961243FBA4BB72B814766A291BB84784F888130CE8D42B50DF7CD14AA700

Function 00007FF73EF592A0 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32 ref: 00007FF73EF592DE

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: cc5af16b011dc5285d9b29731af92b68653836618e66b83070b605036bae9e72
Instruction ID: 15773d69caa7cff7a66cd43e5bf4af0361721cb975be4ae27ad54cc1d586d10c
Opcode Fuzzy Hash: cc5af16b011dc5285d9b29731af92b68653836618e66b83070b605036bae9e72
Instruction Fuzzy Hash: 37117561B18643A2F7D4B725A4117BB9254BFE0384FC00436E95E467D5DFFCE209A760

Non-executed Functions

Function 00007FF73EF57D00 Relevance: 15.2, APIs: 10, Instructions: 151
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL ref: 00007FF73EF57D34
RtlFreeHeap.NTDLL ref: 00007FF73EF57D89
RtlAllocateHeap.NTDLL ref: 00007FF73EF57DB1
RtlFreeHeap.NTDLL ref: 00007FF73EF57DF0
RtlFreeHeap.NTDLL ref: 00007FF73EF57E19
RtlCreateHeap.NTDLL ref: 00007FF73EF57E4F
RtlCreateHeap.NTDLL ref: 00007FF73EF57F0F
RtlCreateHeap.NTDLL ref: 00007FF73EF57F4C

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: Heap$CreateFree$Allocate
String ID:
API String ID: 2480555710-0
Opcode ID: 8d694fd0fdc66734268c303074884b01219bdd152ddbd9f9321bd9b1a1414a03
Instruction ID: b265d81d69e65d633337452ee168667f2289021caa87d837240be1859e65f05d
Opcode Fuzzy Hash: 8d694fd0fdc66734268c303074884b01219bdd152ddbd9f9321bd9b1a1414a03
Instruction Fuzzy Hash: D551B162709B4352FBA4EF66A85477AA291FF88784F484134DE8E43BC4DF7CE5089750

Function 00007FF73EF51190 Relevance: 12.2, APIs: 8, Instructions: 195
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF73EF511F6
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF73EF51268
malloc.MSVCRT ref: 00007FF73EF51332
strlen.MSVCRT ref: 00007FF73EF51355
malloc.MSVCRT ref: 00007FF73EF51361
memcpy.MSVCRT ref: 00007FF73EF51375
GetStartupInfoA.KERNEL32 ref: 00007FF73EF51473

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpystrlen
String ID:
API String ID: 649803965-0
Opcode ID: 8a8c1a0eff158d8a5ae4aa765fc55ba72e4a50bebe21823d76f0685f7758aa9c
Instruction ID: 8d2bbe65b1b0fe0559e6c3ce8f0f1c044dd6e9f92d554f5ca0ec2b01457d414a
Opcode Fuzzy Hash: 8a8c1a0eff158d8a5ae4aa765fc55ba72e4a50bebe21823d76f0685f7758aa9c
Instruction Fuzzy Hash: 8D817BB1A08A07A2FBA0BB11E450779A7A5AF65780FC48435DD0D437D1DEADF94CA360

Function 00007FF73EF596F0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitUnicodeString.NTDLL ref: 00007FF73EF59747
RtlInitUnicodeString.NTDLL ref: 00007FF73EF5975E
RtlInitUnicodeString.NTDLL ref: 00007FF73EF59773
RtlCreateProcessParametersEx.NTDLL ref: 00007FF73EF597CE

Strings

X, xrefs: 00007FF73EF59888
0, xrefs: 00007FF73EF599AB

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: InitStringUnicode$CreateParametersProcess
String ID: 0$X
API String ID: 1304967405-1332872418
Opcode ID: f7127379a99f92a086bf996d42cc71ef38bae533fff528e9dd0a822ae2e01cfb
Instruction ID: f35c3d300d1ba38989a728a8cc7edeef1b0bf5bf1112acb1b190b625da4fd723
Opcode Fuzzy Hash: f7127379a99f92a086bf996d42cc71ef38bae533fff528e9dd0a822ae2e01cfb
Instruction Fuzzy Hash: 17021532608BC182E7718B19E4847EBB7A4F7D4754F409229DBD806B99DFBDD288CB40

Function 00007FF73EF57F70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 83
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDosPathNameToNtPathName_U.NTDLL ref: 00007FF73EF57FD3
NtCreateFile.NTDLL ref: 00007FF73EF5806B
NtWriteFile.NTDLL ref: 00007FF73EF580AC

Strings

@, xrefs: 00007FF73EF58026
0, xrefs: 00007FF73EF5800F

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: FilePath$CreateNameName_Write
String ID: 0$@
API String ID: 1228129568-1545510068
Opcode ID: e2da1879468594a945b82b292004a44407e8b0cbf8f9ad71b4337f4e9967bf2b
Instruction ID: ba5fc0a45e1dd4edf5fcbd07df9e972771eac0f7afdd0302c6fe947148e401f7
Opcode Fuzzy Hash: e2da1879468594a945b82b292004a44407e8b0cbf8f9ad71b4337f4e9967bf2b
Instruction Fuzzy Hash: D0414772608B8196E3609F24F45479BBBA0F784798F504225EBCC47B98DF7DD189CB50

Function 00007FF73EF54F60 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 1312COMMON

Download Yara Rule

Strings

Infinity, xrefs: 00007FF73EF55276
, xrefs: 00007FF73EF56378
NaN, xrefs: 00007FF73EF551EB
, xrefs: 00007FF73EF565D2

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID:
String ID: $ $Infinity$NaN
API String ID: 0-3274152445
Opcode ID: 61342fece5fd6cb937b5f64854fbb4bb46eed0723f01c327d97ab98e16c63858
Instruction ID: f2462ed9143de77278cbad67e7a8e8e8f87a079e6e612fddf900f5c83bc595d3
Opcode Fuzzy Hash: 61342fece5fd6cb937b5f64854fbb4bb46eed0723f01c327d97ab98e16c63858
Instruction Fuzzy Hash: 27C21BB2A1C6439BE7A19F25A04033AF7A0FB91784F904135EA4E47BC5DBBCE5489F10

Function 00007FF73EF51E03 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.MSVCRT ref: 00007FF73EF51EBA

Strings

CCG , xrefs: 00007FF73EF51E26

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 76ab41f24a7f5b04c51b0460a949affb4a2fb1d3548f6bdda32b6d52bb6a166d
Instruction ID: c20801f8713e3bb9f69c24cb5d6b46bffc99f8577716c5501baa81a64c5adc90
Opcode Fuzzy Hash: 76ab41f24a7f5b04c51b0460a949affb4a2fb1d3548f6bdda32b6d52bb6a166d
Instruction Fuzzy Hash: 5421F6A1E0890373FBF47264444033990816F66364FF54B72D52D823D0DEECFA89A271

Function 00007FF73EF59E20 Relevance: 3.1, APIs: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

RtlQueueWorkItem.NTDLL ref: 00007FF73EF59E4E
LdrLoadDll.NTDLL ref: 00007FF73EF59ED8

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: ItemLoadQueueWork
String ID:
API String ID: 6490277-0
Opcode ID: a4a14fc619a4463911ebad1713f9d064b622d46d4a90150803d43663eb35926a
Instruction ID: 5fe50bceb24adc327465d226fec64261392e740436e5a9ca4eed22b628ff6c2c
Opcode Fuzzy Hash: a4a14fc619a4463911ebad1713f9d064b622d46d4a90150803d43663eb35926a
Instruction Fuzzy Hash: D111E26271874252EBA4AB21F4457AFA360EB94780F880039EF4E43BD4DE7CD648C710

Function 00007FF73EF5A630 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc7d027e30cde5be59ef34678afdda9546d3181ffc4ab0ca0754bf804e54345
Instruction ID: 193b375f9cc3e0e96cd49f874c73364293cbdd6c3e55ef0604b7cf55a6cc7f0c
Opcode Fuzzy Hash: 8bc7d027e30cde5be59ef34678afdda9546d3181ffc4ab0ca0754bf804e54345
Instruction Fuzzy Hash: 6502D6F2A0490297DBA4EF11D448979B7A1FB2478CF814231DE5E03385DE78FAA4DB64

Function 00007FF73EF5B080 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: FileHeapPath$AllocateCreateFreeNameName_Write
String ID:
API String ID: 2903292020-0
Opcode ID: 633de45d674dc8c4db2da714eacc9ae17f83c0d85a2261250dbdc99f141f6848
Instruction ID: 982ffb0ce231551ac9783bfb67f12792eec88c4eb3881fcc077f9b82b92de2c2
Opcode Fuzzy Hash: 633de45d674dc8c4db2da714eacc9ae17f83c0d85a2261250dbdc99f141f6848
Instruction Fuzzy Hash: 6EC18CB2F0451299FB54EBB6C8403ED6772AF94788F808035CE4D57B8ACFB8A649D750

Function 00007FF73EF66300 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8be7e3710fcabe9086267d8ce94f58c0b54f25baa977db2af5f9d803065b01
Instruction ID: 3bfa90e08f684f44e71e2ba250f21f739ab83bf4588ec640c27395ae42603eb3
Opcode Fuzzy Hash: 8a8be7e3710fcabe9086267d8ce94f58c0b54f25baa977db2af5f9d803065b01
Instruction Fuzzy Hash: CB01DE97F0D6DA5BEB9696340D2A0286E905BA290079E40ABD648873D3E84CBC09E365

Function 00007FF73EF51830 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00007FF73EF51949

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF73EF51A42
Address %p has no image-section, xrefs: 00007FF73EF518A0, 00007FF73EF51AB0
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF73EF51A9C
Mingw-w64 runtime failure:, xrefs: 00007FF73EF51868

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: fa6c5ac48142c49164c701b6888af4b52aed866cdcc2da347c30c072c70abddf
Instruction ID: 44d0b30b5bcfbd0a4673a54ddb349929bd7c0b9595107e16b3436ead5c638caa
Opcode Fuzzy Hash: fa6c5ac48142c49164c701b6888af4b52aed866cdcc2da347c30c072c70abddf
Instruction Fuzzy Hash: E371F4B2B04B43A6EB90BB11E840679B7A0BF557A4F844235EE5C073D1EE7CE649D360

Function 00007FF73EF52640 Relevance: 7.6, APIs: 5, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wstat64.MSVCRT ref: 00007FF73EF52665
malloc.MSVCRT ref: 00007FF73EF52719
memcpy.MSVCRT ref: 00007FF73EF52731
_wstat64.MSVCRT ref: 00007FF73EF52746
free.MSVCRT ref: 00007FF73EF5275A

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: _wstat64$freemallocmemcpy
String ID:
API String ID: 324876230-0
Opcode ID: cb20074061b83dc237ea17077cfb99d21f12d9678310afc12d433fa758a84f54
Instruction ID: 31ebf19687db44ccd7f05add99da0772a1eafb0cca9d41bc7bf783da7d0c81eb
Opcode Fuzzy Hash: cb20074061b83dc237ea17077cfb99d21f12d9678310afc12d433fa758a84f54
Instruction Fuzzy Hash: 17518BA590865791FBE4BB55900437AA2F0FB24B94FC04236DE4D462C4DFBCDB89E760

Function 00007FF73EF588D0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 193
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF73EF58AA1
strncmp.MSVCRT ref: 00007FF73EF58AB3

Strings

.dll, xrefs: 00007FF73EF58B61, 00007FF73EF58BA7
api-ms, xrefs: 00007FF73EF58A97, 00007FF73EF58AA6

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: strlenstrncmp
String ID: .dll$api-ms
API String ID: 1310274236-874385306
Opcode ID: 15f9cfa00f77da772cf3e58a2c1a8ed68c79611611a7f7ab7c884745f453a9f9
Instruction ID: c3fad3adcb98dcc50df7ee3782787319558042db8979c95aa4849caeda2cc733
Opcode Fuzzy Hash: 15f9cfa00f77da772cf3e58a2c1a8ed68c79611611a7f7ab7c884745f453a9f9
Instruction Fuzzy Hash: FE71D4A1B08687B2EE90AB1198503B9A790FF94784FC44535DE4E077C5DFBCE609E720

Function 00007FF73EF56790 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 127
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00000000,00007FF73EF569E7,?,?,?,00007FF73EF55230), ref: 00007FF73EF567BD
InitializeCriticalSection.KERNEL32(?,?,?,00000000,00007FF73EF569E7,?,?,?,00007FF73EF55230), ref: 00007FF73EF567FD
InitializeCriticalSection.KERNEL32(?,?,?,00000000,00007FF73EF569E7,?,?,?,00007FF73EF55230), ref: 00007FF73EF56806

Strings

Infinity, xrefs: 00007FF73EF56790

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: CriticalInitializeSection$Sleep
String ID: Infinity
API String ID: 1960909292-1015270809
Opcode ID: 016a7b2fca0e0e16e3dd9f19df01cba44b9a9ed007330a499fdd088cbe308813
Instruction ID: e4fce0780674e3d618c2a297e5962c109678250c554fab4b11847e577e717221
Opcode Fuzzy Hash: 016a7b2fca0e0e16e3dd9f19df01cba44b9a9ed007330a499fdd088cbe308813
Instruction Fuzzy Hash: 204194A3E0D5DB6BFBD2A7245C650786F90AFA1B00BCA4076C54D873D2DD9CA90DE320

Function 00007FF73EF574D0 Relevance: 6.1, APIs: 4, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF73EF5752A
MultiByteToWideChar.KERNEL32 ref: 00007FF73EF5756A

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: f02b0bbac395ea30659d931ca654f9b0482af7a83527db6b36d24e4e81786109
Instruction ID: 7a9c7f6501f5cc1ff1bba9ee70f5204d284593c3211a4495bad062a3d7437bf2
Opcode Fuzzy Hash: f02b0bbac395ea30659d931ca654f9b0482af7a83527db6b36d24e4e81786109
Instruction Fuzzy Hash: 1E31B6F2A0C28397E3A05B28B40036DB690BBA1794F948135EA9C877D4DFBDD6499B10

Function 00007FF73EF51AC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 209COMMON

Download Yara Rule

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF73EF51D98
Unknown pseudo relocation bit size %d., xrefs: 00007FF73EF51D84

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: 418f5de58d772dc4593c2d5cc216fe415ddbde4a04ea340d9d8ff17af06fa429
Instruction ID: 7ee0f6d15f5a0b4340c89ab1c33dabfcb0c41c0b99e9f5fa5634b6d9e966011d
Opcode Fuzzy Hash: 418f5de58d772dc4593c2d5cc216fe415ddbde4a04ea340d9d8ff17af06fa429
Instruction Fuzzy Hash: 4371D4A2F14A47A6EB90BB61D800769A361BF65B94F944631CD0C177C4EE7CF608E620

Function 00007FF73EF5CD9F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

!num_bits, xrefs: 00007FF73EF5E172
libs/miniz/miniz_tinfl.c, xrefs: 00007FF73EF5E16B

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID:
String ID: !num_bits$libs/miniz/miniz_tinfl.c
API String ID: 0-446014870
Opcode ID: 196e568b28f3d2b6abc3b8b06c965f5327417a55b6843ce999670c9af3d10bbf
Instruction ID: 4784c2f8765a26763700d0ba793c7268fbb52014065311ae7c68304f6bea91c9
Opcode Fuzzy Hash: 196e568b28f3d2b6abc3b8b06c965f5327417a55b6843ce999670c9af3d10bbf
Instruction Fuzzy Hash: 9D31F8B3A0D6C396F7B49B14E80436AA291FB91350F548235C6AE83BC4DEFCD508EB10

Function 00007FF73EF51720 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF73EF517A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF73EF51787
Unknown error, xrefs: 00007FF73EF5180C

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 743bb071061fffd6250729550fc8921ece9cae6b505e584f7d90744a993c8ee9
Instruction ID: 23ff3e263fbffd08c389c5cb94dc4f83a642e4073502c17be0f8faf2d4e85fa6
Opcode Fuzzy Hash: 743bb071061fffd6250729550fc8921ece9cae6b505e584f7d90744a993c8ee9
Instruction Fuzzy Hash: 7D01A563D0CF89C3E6419F18D8001BAB330FB6E789F559325EA8C26166DF6CE686D710

Function 00007FF73EF517C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF73EF517A0

Strings

Argument domain error (DOMAIN), xrefs: 00007FF73EF517C0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF73EF51787

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: c93dce733dc9cb8e4441e31a6181daf31e8a38fbd96fd65ed10212221be91348
Instruction ID: 151c3c779159198d44db47d4971ef5dbd5cdb7644bad6b35980262c97784fcdd
Opcode Fuzzy Hash: c93dce733dc9cb8e4441e31a6181daf31e8a38fbd96fd65ed10212221be91348
Instruction Fuzzy Hash: FDF09652D08E8982E242AF1CA4000BBB330FF5D788F549335EF8D3A196DF6CE6869710

Function 00007FF73EF517D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF73EF517A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF73EF51787
Partial loss of significance (PLOSS), xrefs: 00007FF73EF517D0

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: d66d60baebed1a45f193e17a704713a38364348463842b74604e083d8e0ef688
Instruction ID: 935d2c593846e1482594a5221e2d1178665b32ab25e3da04cee26900e7f62894
Opcode Fuzzy Hash: d66d60baebed1a45f193e17a704713a38364348463842b74604e083d8e0ef688
Instruction Fuzzy Hash: 77F09652D08E8982E242AF1CA4000BBB330FF5D788F649335EF8D36196DF6CE6869710

Function 00007FF73EF517E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF73EF517A0

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF73EF517E0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF73EF51787

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 16e0593afd3f55d1f87e90979954c1eef2b7fea2465e9028d4eff53d3fcd49a6
Instruction ID: 204d6e9355927acb0d3dc16834b486ca9543dc32b27658c4cff14988b24166f8
Opcode Fuzzy Hash: 16e0593afd3f55d1f87e90979954c1eef2b7fea2465e9028d4eff53d3fcd49a6
Instruction Fuzzy Hash: 20F09652D08E8982E242AF1CA4000BBB330FF5D788F589335EF8D36196DF6CE6869710

Function 00007FF73EF517F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF73EF517A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF73EF51787
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF73EF517F0

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 95847ac1c890c04e7db8522beeb24e62a5d20daa24a230c2c0b5289aa80c3718
Instruction ID: c429b511f54ab6094f2459ffca3687d11efc8c849af74bc1eecbb0ec8fc7d94b
Opcode Fuzzy Hash: 95847ac1c890c04e7db8522beeb24e62a5d20daa24a230c2c0b5289aa80c3718
Instruction Fuzzy Hash: F4F09652D08E8982E242AF1CA4000BBB330FF5D788F549335EF8D36196DF6CE6869720

Function 00007FF73EF51800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF73EF517A0

Strings

Total loss of significance (TLOSS), xrefs: 00007FF73EF51800
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF73EF51787

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: ab87e82c848fe72dfae87f26d163e554460c21d0565fdcfa2bfb6b362917c6b0
Instruction ID: 9adbf35e498009657ae7f4abe8a5f3d9792b15cd040a2b2d1fd555166f22596c
Opcode Fuzzy Hash: ab87e82c848fe72dfae87f26d163e554460c21d0565fdcfa2bfb6b362917c6b0
Instruction Fuzzy Hash: 9EF06252D08E8982E242AF1CA4000BBB330FF9E788F549325EE8D26556DF6CE6869710

Function 00007FF73EF51758 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF73EF517A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF73EF51787
Argument singularity (SIGN), xrefs: 00007FF73EF51758

Memory Dump Source

Source File: 00000000.00000002.1258579919.00007FF73EF51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EF50000, based on PE: true

Associated: 00000000.00000002.1258558623.00007FF73EF50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258600717.00007FF73EF5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258627741.00007FF73EF60000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258654874.00007FF73EF61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258682815.00007FF73EF62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258785033.00007FF73EF66000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258804896.00007FF73EF69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1258832694.00007FF73EF80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ef50000_temp_error_logs.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 9eb74f8a180967b92df762968945e815cd93f0a72bf43f272e697a57524f7599
Instruction ID: 03f8adc974b96e1114a7c5f035c7b702eba0c481abb553b82890cac5efa60ec8
Opcode Fuzzy Hash: 9eb74f8a180967b92df762968945e815cd93f0a72bf43f272e697a57524f7599
Instruction Fuzzy Hash: 2EF09652D08E8982E242DF1CA4000BBB330FF5D788F549325EF8D36155DF28E6869710

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report temp_error_logs.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_temp_error_logs._c9874d87b4e07e6dca25199d889b2514353f5c4_28bacb84_746fe102-aa32-49db-9307-f63256ef4eb2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER114A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER11E8.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2C.tmp.dmp

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
temp_error_logs.scr.exe