Edit tour

Windows Analysis Report
ipc_core.dll.dll

Overview

General Information

Sample name:	ipc_core.dll.dll (renamed file extension from exe to dll)
Original sample name:	ipc_core.dll.exe
Analysis ID:	1501749
MD5:	e86a77bdf20a8074bf77591352707d59
SHA1:	9b6b21ea03c641eb98648281ac29cb7f52325302
SHA256:	3583cc881cb077f97422b9729075c9465f0f8f94647b746ee7fa049c4970a978
Tags:	CbS-CHexe
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7344 cmdline: loaddll64.exe "C:\Users\user\Desktop\ipc_core.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7396 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 7420 cmdline: rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7404 cmdline: rundll32.exe C:\Users\user\Desktop\ipc_core.dll.dll,CreateServiceHost MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7492 cmdline: rundll32.exe C:\Users\user\Desktop\ipc_core.dll.dll,CreateServiceInvoker MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7568 cmdline: C:\Windows\system32\WerFault.exe -u -p 7492 -s 408 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7696 cmdline: rundll32.exe C:\Users\user\Desktop\ipc_core.dll.dll,DestroyServiceHost MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7792 cmdline: rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",CreateServiceHost MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7936 cmdline: C:\Windows\system32\WerFault.exe -u -p 7792 -s 400 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7800 cmdline: rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",CreateServiceInvoker MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7984 cmdline: C:\Windows\system32\WerFault.exe -u -p 7800 -s 408 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7808 cmdline: rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",DestroyServiceHost MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7820 cmdline: rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",InitIPCCoreRuntime MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7952 cmdline: C:\Windows\system32\WerFault.exe -u -p 7820 -s 404 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7832 cmdline: rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",DestroyServiceInvoker MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ipc_core.dll.dll

Virustotal: Detection: 9%

Perma Link

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00007FF8A8DF3ABC CryptQueryObject,GetLastError,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z,CryptMsgGetParam,GetLastError,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z,LocalAlloc,GetLastError,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z,CryptMsgGetParam,GetLastError,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z,CertFindCertificateInStore,GetLastError,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z,CertFreeCertificateContext,LocalFree,CryptMsgClose,CertCloseStore,_invalid_parameter_noinfo_noreturn,

6_2_00007FF8A8DF3ABC

Source: ipc_core.dll.dll

Static PE information: certificate valid

Source: ipc_core.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: F:\Demo\ipc_sdk_fix\_win_x64\bin\RelWithDebInfo\ipc_core.pdb source: rundll32.exe, 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2272506721.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.2257390899.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2243937256.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmp, ipc_core.dll.dll

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00007FF8A8DF1BF4 WSARecv,WSARecvFrom,socket,WSAGetLastError,closesocket,

6_2_00007FF8A8DF1BF4

Source: ipc_core.dll.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: ipc_core.dll.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: ipc_core.dll.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ipc_core.dll.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: ipc_core.dll.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ipc_core.dll.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: ipc_core.dll.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ipc_core.dll.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ipc_core.dll.dll	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: ipc_core.dll.dll	String found in binary or memory: http://ocsp.digicert.com0
Source: ipc_core.dll.dll	String found in binary or memory: http://ocsp.digicert.com0A
Source: ipc_core.dll.dll	String found in binary or memory: http://ocsp.digicert.com0C
Source: ipc_core.dll.dll	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: ipc_core.dll.dll	String found in binary or memory: http://www.digicert.com/CPS0

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00007FF8A8E97510: DeviceIoControl,SetLastError,

6_2_00007FF8A8E97510

Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF2B0D	6_2_00007FF8A8DF2B0D
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF2900	6_2_00007FF8A8DF2900
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF254A	6_2_00007FF8A8DF254A
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF345E	6_2_00007FF8A8DF345E
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF10AA	6_2_00007FF8A8DF10AA
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF10C8	6_2_00007FF8A8DF10C8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF1500	6_2_00007FF8A8DF1500
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF3940	6_2_00007FF8A8DF3940
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF23A6	6_2_00007FF8A8DF23A6
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF10C8	6_2_00007FF8A8DF10C8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF125D	6_2_00007FF8A8DF125D
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8E8B9A0	6_2_00007FF8A8E8B9A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF10C8	6_2_00007FF8A8DF10C8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF3715	6_2_00007FF8A8DF3715
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF3580	6_2_00007FF8A8DF3580
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF10C8	6_2_00007FF8A8DF10C8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF3715	6_2_00007FF8A8DF3715
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF3850	6_2_00007FF8A8DF3850
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF4151	6_2_00007FF8A8DF4151
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF1965	6_2_00007FF8A8DF1965
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8E1E870	6_2_00007FF8A8E1E870
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8E8B9A0	6_2_00007FF8A8E8B9A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF361B	6_2_00007FF8A8DF361B
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF2D7E	6_2_00007FF8A8DF2D7E
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF3CE7	6_2_00007FF8A8DF3CE7
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF1B4C	6_2_00007FF8A8DF1B4C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF1500	6_2_00007FF8A8DF1500
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF3A08	6_2_00007FF8A8DF3A08
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF25D6	6_2_00007FF8A8DF25D6
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF3715	6_2_00007FF8A8DF3715
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF2EFF	6_2_00007FF8A8DF2EFF
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF27F7	6_2_00007FF8A8DF27F7
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF2824	6_2_00007FF8A8DF2824
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF1D8E	6_2_00007FF8A8DF1D8E
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF320B	6_2_00007FF8A8DF320B
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF1136	6_2_00007FF8A8DF1136
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF44DF	6_2_00007FF8A8DF44DF
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF254A	6_2_00007FF8A8DF254A
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF4543	6_2_00007FF8A8DF4543
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DFD760	6_2_00007FF8A8DFD760
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8DF1837	6_2_00007FF8A8DF1837

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A8DF14CE appears 1010 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A8DF3C9C appears 302 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A8DF2982 appears 65 times

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7492 -s 408

Source: classification engine

Classification label: mal48.evad.winDLL@26/17@0/0

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00007FF8A8DF173A GetTempPathW,GetLastError,WideCharToMultiByte,WideCharToMultiByte,GetLastError,GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

6_2_00007FF8A8DF173A

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7492
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7792
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7820
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7800

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\1e75717d-8af1-40d6-9ef4-f2941130a234

Jump to behavior

Source: ipc_core.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ipc_core.dll.dll,CreateServiceHost

Source: ipc_core.dll.dll

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\ipc_core.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ipc_core.dll.dll,CreateServiceHost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ipc_core.dll.dll,CreateServiceInvoker
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7492 -s 408
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ipc_core.dll.dll,DestroyServiceHost
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",CreateServiceHost
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",CreateServiceInvoker
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",DestroyServiceHost
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",InitIPCCoreRuntime
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",DestroyServiceInvoker
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7792 -s 400
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7820 -s 404
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7800 -s 408
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ipc_core.dll.dll,CreateServiceHost	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ipc_core.dll.dll,CreateServiceInvoker	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ipc_core.dll.dll,DestroyServiceHost	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",CreateServiceHost	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",CreateServiceInvoker	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",DestroyServiceHost	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",InitIPCCoreRuntime	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",DestroyServiceInvoker	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: ipc_core.dll.dll

Static PE information: certificate valid

Source: ipc_core.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: ipc_core.dll.dll

Static file information: File size 1716528 > 1048576

Source: ipc_core.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ipc_core.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ipc_core.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ipc_core.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ipc_core.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ipc_core.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ipc_core.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: ipc_core.dll.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: ipc_core.dll.dll

Static PE information: real checksum: 0x14580c should be: 0x1a60ed

Source: ipc_core.dll.dll

Static PE information: section name: .00cfg

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00007FF8A8E193F1 push qword ptr [rdx+rbp-75h]; ret

6_2_00007FF8A8E193F9

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00007FF8A8DF246E GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,

6_2_00007FF8A8DF246E

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

6_2_00007FF8A8DF173A

Source: C:\Windows\System32\rundll32.exe

API coverage: 0.0 %

Source: C:\Windows\System32\loaddll64.exe TID: 7348

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00007FF8A8DF12F8 GetSystemInfo,abort,

6_2_00007FF8A8DF12F8

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00007FF8A8DF3977 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_00007FF8A8DF3977

Source: C:\Windows\System32\rundll32.exe

6_2_00007FF8A8DF173A

Source: C:\Windows\System32\rundll32.exe

6_2_00007FF8A8DF3977

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",#1

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00007FF8A8DF17B2 CreateNamedPipeA,GetLastError,CreateNamedPipeA,CreateIoCompletionPort,GetLastError,CloseHandle,

6_2_00007FF8A8DF17B2

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00007FF8A8DF3292 __security_init_cookie,GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_00007FF8A8DF3292

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00007FF8A8E82D70 GetConsoleTitleW,WideCharToMultiByte,WideCharToMultiByte,GetCurrentProcess,OpenProcessToken,GetLastError,GetUserProfileDirectoryW,GetLastError,CloseHandle,CloseHandle,GetUserNameW,GetLastError,

6_2_00007FF8A8E82D70

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8E88C30 socket,closesocket,setsockopt,setsockopt,bind,WSAGetLastError,		6_2_00007FF8A8E88C30
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00007FF8A8E821E0 socket,WSAGetLastError,closesocket,setsockopt,bind,WSAGetLastError,		6_2_00007FF8A8E821E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ipc_core.dll.dll	9%	Virustotal		Browse
ipc_core.dll.dll	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.9.dr	false	URL Reputation: safe URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501749
Start date and time:	2024-08-30 12:31:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ipc_core.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	ipc_core.dll.exe
Detection:	MAL
Classification:	mal48.evad.winDLL@26/17@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 253

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

Time	Type	Description
06:32:07	API Interceptor	1x Sleep call for process: loaddll64.exe modified
06:32:18	API Interceptor	4x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ipc_34de501b8bd73c3e36d3e0acfc3b73cfa66f9184_69175d2b_a729d135-c707-4015-acc1-f27b8f28852a\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8412942902088835
Encrypted:	false
SSDEEP:	96:dZFBwctdigyKyisjk4RvFd7CtIfSQXIDcQDc6ycEIcw3qXaXz+HbHgSQgJjfo8Fk:7H3igyiDty0t2ScjDezuiFMZ24lO8h
MD5:	7BBA38D201BD868F66D956CCF360B856
SHA1:	9B35CAA6DE315E3958F294840785E2EF52C06443
SHA-256:	E32D78D901FB6C7627CDDD3898010F57CA206EFF042477969D66609B10E66878
SHA-512:	20E184AB947AD14DADFBC293F6165B6C6B89566076B00036B9373E66B60995F12E8837D461580656E28EAE8378AE80EB443E0C0F434CA997B1B09F770D67CA90
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.8.7.5.2.7.9.5.9.3.5.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.8.7.5.2.8.8.1.8.7.1.6.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.7.2.9.d.1.3.5.-.c.7.0.7.-.4.0.1.5.-.a.c.c.1.-.f.2.7.b.8.f.2.8.8.5.2.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.8.c.7.2.6.2.7.-.1.9.5.a.-.4.2.3.4.-.8.b.4.c.-.f.0.4.9.b.3.7.9.a.9.9.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.i.p.c._.c.o.r.e...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.7.0.-.0.0.0.1.-.0.0.1.4.-.3.8.3.b.-.b.8.d.c.c.7.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ipc_8b9bed975dae47e075ac375e31246032436a60ba_69175d2b_857be848-56bf-4ec5-a37e-8df4ee63ed60\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8546392267669924
Encrypted:	false
SSDEEP:	96:ECFPTdi3KtyKy+sjk4RvoQ7Ri6tQXIDcQnc6JcEPcw3eXaXz+HbHgSQgJjfo8F3G:nziwy+f0pN1gjDezuiFMZ24lO8G
MD5:	61B6AE314FCDF13A1544241209CCF35A
SHA1:	6E071B2A9E9D9BEA04392621122401F18B3C5522
SHA-256:	5E4D0BB72D066CA01A97F4201392CC9607350C4C9579BC28329A22732CD8F3F3
SHA-512:	0B0812C83A5C60FC4F32E58A724A125A17C60AF6B87091A9007C2756C88F44324A796B5ABF8A47DC78F2EF47838CA359E1A7E885CA73435512F14C6BA71A5411
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.8.7.5.2.7.9.8.0.3.6.9.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.8.7.5.2.8.7.4.5.9.7.4.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.5.7.b.e.8.4.8.-.5.6.b.f.-.4.e.c.5.-.a.3.7.e.-.8.d.f.4.e.e.6.3.e.d.6.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.6.3.9.4.f.f.f.-.4.5.1.e.-.4.c.2.a.-.a.7.f.9.-.3.b.3.d.c.8.4.a.8.7.d.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.i.p.c._.c.o.r.e...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.8.c.-.0.0.0.1.-.0.0.1.4.-.1.6.a.2.-.b.b.d.c.c.7.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ipc_94ee8ec67bc632ff8e90ed8ca719e8074793a6_69175d2b_366efc25-0cd7-4d79-ad15-0a93ec4edbd3\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8443154943697795
Encrypted:	false
SSDEEP:	96:wLvFQC9diJyKyssjk4RvFd7CtIf5OQXIDcQKc6PUcEXcw3tXaXz+HbHgSQgJjfoA:cvLiJysDtA0EYNBjDezuiFMZ24lO8h
MD5:	22263368BE32989C379D3BACF4489D0C
SHA1:	054A1388197E61203D5CA75DCE8EDDB66C8B9246
SHA-256:	41FDDE52D74BE0A547607D88A39EFE5514A35D9A2C21AFBEF6942BB9482F445A
SHA-512:	12776909E7B11C48D3C95A71E60FDEEE2965D638BBA52D084914E968EF5D8000A3DF673C90F727C6BA5E39615BCEF4BF0F80CB3E83AFE8A47620F7FA4549431A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.8.7.5.2.8.1.3.9.4.9.0.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.8.7.5.2.8.8.4.2.6.4.4.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.6.6.e.f.c.2.5.-.0.c.d.7.-.4.d.7.9.-.a.d.1.5.-.0.a.9.3.e.c.4.e.d.b.d.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.c.0.d.2.8.6.4.-.d.f.4.0.-.4.9.7.5.-.b.f.6.5.-.b.9.3.6.8.c.2.d.5.0.9.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.i.p.c._.c.o.r.e...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.7.8.-.0.0.0.1.-.0.0.1.4.-.f.b.3.e.-.b.9.d.c.c.7.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ipc_94ee8ec67bc632ff8e90ed8ca719e8074793a6_69175d2b_bddcb41c-2ce8-4647-90cb-888c62a06e81\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8412720144400108
Encrypted:	false
SSDEEP:	192:kpUBiMy67DtA0EYNBjTezuiFMZ24lO8h:uQih+DhEYNBjKzuiFMY4lO8h
MD5:	09939992FDC1289CCB8B8474712A0A43
SHA1:	51C5AF8B30797775E680D8B9616D64E9025F0DAE
SHA-256:	27491896ABAC33E3916AF609A06CF9F7C2536B3035D58FD7A9343C298632D53B
SHA-512:	09607B0004D623600F0154F4F94F0F19E0F9C628164DA3DF1D44508A16440955F33F1D955622C2EC267A1F8615F2877E39F7F230550BAE17F570E87524A68693
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.8.7.5.2.1.1.4.8.1.8.5.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.8.7.5.2.2.1.6.3.8.0.8.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.d.d.c.b.4.1.c.-.2.c.e.8.-.4.6.4.7.-.9.0.c.b.-.8.8.8.c.6.2.a.0.6.e.8.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.a.f.b.d.d.0.3.-.6.9.4.2.-.4.f.0.9.-.a.1.f.c.-.5.b.a.6.1.0.e.1.9.a.8.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.i.p.c._.c.o.r.e...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.4.4.-.0.0.0.1.-.0.0.1.4.-.f.d.4.d.-.1.c.d.9.c.7.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER100.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Aug 30 10:32:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57286
Entropy (8bit):	1.7688486169797655
Encrypted:	false
SSDEEP:	96:5t8TE/Wr27Rv+rgpuArv1bqiR9Dkaqeoi7Me5QE4MOzGY9lTSiz0/IDBPYFqxFFb:0A/4gEWkXOMgcMOzRmirPy6FczwHI
MD5:	C505C24C3F81CB1891579DFFB3BA1B0F
SHA1:	605D3F1563F284BCC3DE22051B41EE43B5A41A3B
SHA-256:	0E001FE514EC0AAF964B518F21CBD4ECD6B1883CBFD1D57467431DA37F7A8464
SHA-512:	376BECBF9BFBF85968FE9FA7B34A0ADC6A4DE7A8BE9A8C3507DD988E7EE1ACEB31B3147EFFDAD539A7E56ACD94D690C20ED8A13E44C7AB4B183D77744169FE1F
Malicious:	false
Preview:	MDMP..a..... ..........f........................................./..........T.......8...........T...........(...........................x...............................................................................eJ..............Lw......................T.......p......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER11F.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Aug 30 10:32:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60254
Entropy (8bit):	1.7724151142712445
Encrypted:	false
SSDEEP:	192:0LgEWGXhXOMDxDmFalXfAtHtOhZOe79q35lyfJ0u:9EWGXUWx7XoHtuZOe785lyN
MD5:	5DA8504AC90E33C9A53B9BD79DE1ED7E
SHA1:	3C84F1A5AC227B57EC1ED8794530D06603DEFAA6
SHA-256:	77B6C71966991A51B326135786A3A9D9994509587F99AC4A361FC78450ED79AE
SHA-512:	EDC11D74B7507E10DD7F609A1956BD0030E79ECEFB7D03C1BEEAF7F9A6362991862E82D1BEE0D1A31E7DE227C9C75F5A41D391377FC74F5EB478477B17A9C0D2
Malicious:	false
Preview:	MDMP..a..... ..........f....................................$..../..........T.......8...........T...........(...6.......................x...............................................................................eJ..............Lw......................T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AD.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8510
Entropy (8bit):	3.69575674837803
Encrypted:	false
SSDEEP:	192:R6l7wVeJes96Y2QpHWgmfoceXMpr089blTbf0MXm:R6lXJd96Yrp2gmfo7X4lvfI
MD5:	CCC19E32EC0DFD83F167010B26325F8F
SHA1:	0E15AB16144977DA536D9E399D881D94D24A8BCD
SHA-256:	7563CAB211118C4AACBE7ED374615ADCBE0E56FC236E64F08FB299CBDD6FE2BE
SHA-512:	824EEEC4F821B65F6BD17A8D115B438C629CA5C7B598A56ACA6C28909DCD4E1D6BCBE1EDF34C4E4A360967F96F1678DA08B151652A1CF0C167499DA4889CFBD8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1DB.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Aug 30 10:32:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57782
Entropy (8bit):	1.7639210892015533
Encrypted:	false
SSDEEP:	96:5t89xOr27Rv+rgpuArv1bqiR9DkaZnGiM/eoi7Me0OUl4jITDDoowLAcQQ8rgou5:03AgEWaiM/XOMB9l4U8FTQjjAEbwJpD
MD5:	C00DFFC7DAF7898948265F50170018B2
SHA1:	5777CC46F26F861046794C15391F34F44E58A776
SHA-256:	5C48BBC3DE536E2FDCA466FBF52116FD6A3CDC2A05573428B436588C22C00F5A
SHA-512:	19E5DC84E137B8AA21507F7DE714853D04409A17289BED19E79C1811B6D47D653FCB25587500FEB3FE8F78A64471D93FE163A1869D60CD3990A71932D3F6C371
Malicious:	false
Preview:	MDMP..a..... ..........f........................................./..........T.......8...........T...........(...........................x...............................................................................eJ..............Lw......................T.......x......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EC.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4763
Entropy (8bit):	4.47904454559957
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg771I9jwWpW8VYYxYm8M4JCBCpXFmyq85mtH2ptSTShd:uIjfJI7UJ7VeJib2poOhd
MD5:	EF370BA48AB81F3421E5FAFC7C67A378
SHA1:	AE6C103C230D7EC6DD83F697D7AB2B8E7E049984
SHA-256:	451E678AB6F44D75167E646C35525B89E1EAD31660418F3589F8AA887322A385
SHA-512:	3236BBD32B4EFFBB6FBCB42D260124DD739463EE7F345E705B7D39077CDE0F3380CC88347AB648F5AB3ADC61E4A3A862268F81CC8C4BFEAAB6EA7AB6EA1400C5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="478174" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER21A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8886
Entropy (8bit):	3.703974619391258
Encrypted:	false
SSDEEP:	192:R6l7wVeJwWj6Y2QNHWgmfFbrMpra89blOzfsXm:R6lXJJj6YrN2gmfFbr6lCfB
MD5:	A1DE90EF62D0FFB6D7AA72D3B7B14130
SHA1:	5DFB4A7DF2197ED862BA4D8467DCB4E94B595166
SHA-256:	F0674FE12CFC12FBC039A8F2184FA11BE5BA12170D666B083C1925FA3B7885F8
SHA-512:	9E5EA5B6585C4DF232438A7AC4FD944DFBE65BD8C613DD7F2E048CBC863F8867F67A0E1B3E9A3EC3780A4568CEA09F8BCD86DB163AC7B2BFC20C58E0C2D27D30
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.8.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER289.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4919
Entropy (8bit):	4.506157764553617
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg771I9jwWpW8VYYMYm8M4JCBCpMFpRyq8vhpC2ptSTShd:uIjfJI7UJ7VXJQWi2poOhd
MD5:	B5CDE815AE1A6BF379DE75CB0795F6D5
SHA1:	7661B3CED1F09E27FB8EEB6BD95E7B24EFCC6CC0
SHA-256:	61725A2236AFB970A1EB75966EE5ED08EFB0BB20FFB45B713AA0EFD95F69263C
SHA-512:	937A6777C90677FB99A43842B54751247015B4D476006B2F9BFBB9B8C1E8F6948FC03F6DCB6A1BC4F6F41527F496E135DB18B7796B7ABDE379255E546F610C08
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="478174" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8766
Entropy (8bit):	3.7021986836365532
Encrypted:	false
SSDEEP:	192:R6l7wVeJyHwP6Y2QbHWgmfocopfEMpry89blezfNXm:R6lXJqI6Yrb2gmfoRpfESlyfw
MD5:	756B6B0C303E869553CF374FD02709E9
SHA1:	63FF86F10C1BE8A1FA987A50E61C4D82D5118C23
SHA-256:	C14ADD08B2C07AE00C1797E8D157FDCF26B2AA5CC6F9799CE4827A32AC2DC255
SHA-512:	1312B3DCFAD2D734B912AB9EE331C6DF4AB5D6F92C91E9655203E334DD6D6E86061CAC255A5EDF9D770B4057E438FD080CEAB16343F0D8E48AF7D096E7AFE2AB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.8.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER306.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4764
Entropy (8bit):	4.48197619977705
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg771I9jwWpW8VYYLOYm8M4JCBCpVFPsyq85mtM2ptSTSnd:uIjfJI7UJ7VNJqg2poOnd
MD5:	5E53BFA957AE28580822E5E5F062B607
SHA1:	285328010F86E99354AD9FF40AD99CFB7A09619A
SHA-256:	84CFBCBDA90F6073FB1A22E35D71BB40C273B5989FD73D817F6755D679EEF910
SHA-512:	3C0F9D2FD05871096D8E2E5256F4BDDF88CC6FD65725BBED21E255A68FAACF7F536221A19560599A265C5AE91958370D759F88E97AC41AD3EF357E20B9320CFF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="478174" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE664.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Aug 30 10:32:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	72726
Entropy (8bit):	1.5530395671216937
Encrypted:	false
SSDEEP:	192:FSZUk2tMXOM75DGnxlOBOhHG0yNSLcyR5viiMJamj8QT4Sd:Iuk2LW5DGnxlO0hcSIWZiHaw8ud
MD5:	CF89D1DF773E1EC815876BA3765A10ED
SHA1:	852188605F881AA0AA7C6B27F80CE8AE743693F0
SHA-256:	EA7DBFD64A3C33618EBA1BF9D9DE4ADE444727A50E68FF8B6B622F4440C4F018
SHA-512:	33100913392A58640AA6D81A1463B72F7168AB49D56BF96E2DB808083A66DBBE8C00C9F5475D8C6C36563B89333CBF9BD0D7B6375F7C0835679CC2BCB9ABA71F
Malicious:	false
Preview:	MDMP..a..... ..........f.........................................4..........T.......8...........T...........(...........................................................................................................eJ......@.......Lw......................T.......D......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE701.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8518
Entropy (8bit):	3.6991263807686146
Encrypted:	false
SSDEEP:	192:R6l7wVeJVCQK6YtvLDd0LgmfocopfEMprM89bk8qfuUzsm:R6lXJQN6YJWgmfoRpfEwkpfuU
MD5:	FDC97E5ACC5116C8A89ED49B5DFF04D9
SHA1:	2F86BB8879EF7DF568F96C7312E7036C8714A80D
SHA-256:	869613C15F5687AA7DAA2A686CA82C337576B4BCC1463E0ECC5534292FD439BE
SHA-512:	7E614EDD13938631E1564A8C8D472A43BB94CAEA2A0EEF1B2B47E7BEF248F03FA03B9E5C60400BBBE5E250B3439B6D79DC00E4417ED6E385EECCE8D40C419F5A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE77F.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4763
Entropy (8bit):	4.477575205160149
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg771I9jwWpW8VYYbYm8M4JCBCpVFHjyq85mtUptSTSeMd:uIjfJI7UJ7V8JFjgpoO7d
MD5:	D9D2328520673600D55AD290AC51F664
SHA1:	38865D6234CB071FDA7DB4235D609D774B2E5C11
SHA-256:	63CAF91888740B7C74751855F76E5F3170663610CBB9C873A26E528480C90D52
SHA-512:	939BA739B557AA2D519750AC4F38A4F9231CEF2D742764BE231AB7AB463E22DC1FDCC88DA369EFCC06EE3F2D432C144803AE5CB48DA8CA7CB45F913816151494
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="478174" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.42241506356287
Encrypted:	false
SSDEEP:	6144:4Svfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNa0uhiTw:DvloTMW+EZMM6DFy003w
MD5:	A9B43137EAA6C5AACC12C1E61133B8ED
SHA1:	3AD33682A013EDB620FDE979A8045D9235676FAE
SHA-256:	D8BBD16620FFE31007BB67BDA62A4FD71E16819D06463C88512212D75DB84EF0
SHA-512:	97501F0CA7AD28BA531F53C077F946232467E56D6455C294A33D6C58771A3749CC869E7771A348E9CCB9DD9F0173E95E4D8E4CE557AA76340AF16B187DD43CBC
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmn5;...................................................................................................................................................................................................................................................................................................................................................-.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	6.461180239447408
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	ipc_core.dll.dll
File size:	1'716'528 bytes
MD5:	e86a77bdf20a8074bf77591352707d59
SHA1:	9b6b21ea03c641eb98648281ac29cb7f52325302
SHA256:	3583cc881cb077f97422b9729075c9465f0f8f94647b746ee7fa049c4970a978
SHA512:	54dd07cb167f1a9af2494a9557915a11057016aa175a9a9457d958ccd98e97e8170ae03c8f2e54fc927b08ad2f574c38dcf9b1cd9abc6e3be243909d912cee4b
SSDEEP:	49152:ZAc57sG0h4r8Jzm/XuPTSAyYmC25SA1oKrsg+SBsg+SBNb4Z7dK4:vj9/sAmguSBuSBNb4Z7dT
TLSH:	9785AE263268C199C1B782BDC2CBCE15D931740503318AD70CD1B7697E27AE5AEBDB1E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1s..P...P...P...(...P...%...P...%...P...%...P...%...P...?...P...;...P...P...Q..v%...P..v%...P..v%...P..v%...P..v%...P..Rich.P.

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1800010b9
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x65712458 [Thu Dec 7 01:48:08 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	0ba78fc00bbd9bca332fc0734423adc6

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	02/08/2021 02:00:00 02/08/2024 01:59:59
Subject Chain	CN="DingTalk Technology Co.,Ltd.", O="DingTalk Technology Co.,Ltd.", L=\u676d\u5dde\u5e02, S=\u6d59\u6c5f\u7701, C=CN
Version:	3
Thumbprint MD5:	D1BF882F494E317033D381F8C2DBC001
Thumbprint SHA-1:	2C25EA8587300EC8BCBC200C450A34D28D4428ED
Thumbprint SHA-256:	D36D36450A6839E6105267EC61490C1EA18AC75DC476C8325027605746DC754D
Serial:	0FAF69D7A381E92B829F9D6E3DAD925B

Entrypoint Preview

Instruction
jmp 00007FF924EA28CFh
jmp 00007FF924E2F0D2h
jmp 00007FF924DF07BDh
jmp 00007FF924E8B6D8h
jmp 00007FF924E8B473h
jmp 00007FF924E8977Eh
jmp 00007FF924E88549h
jmp 00007FF924E730A4h
jmp 00007FF924E114FFh
jmp 00007FF924E22CFAh
jmp 00007FF924E8B755h
jmp 00007FF924DFE4D0h
jmp 00007FF924EA32E3h
jmp 00007FF924E15636h
jmp 00007FF924E22CF1h
jmp 00007FF924E8A65Ch
jmp 00007FF924DF07A7h
jmp 00007FF924E259D2h
jmp 00007FF924E5C81Dh
jmp 00007FF924E1FE38h
jmp 00007FF924E69033h
jmp 00007FF924E19B4Eh
jmp 00007FF924E07E29h
jmp 00007FF924E1A8E4h
jmp 00007FF924E3D51Fh
jmp 00007FF924E888BAh
jmp 00007FF924DF1A35h
jmp 00007FF924E3B550h
jmp 00007FF924DE4C3Bh
jmp 00007FF924DF7856h
jmp 00007FF924E60471h
jmp 00007FF924E4122Ch
jmp 00007FF924DFC6D7h
jmp 00007FF924E37832h
jmp 00007FF924E37CADh
jmp 00007FF924DEF678h
jmp 00007FF924DF0DE3h
jmp 00007FF924E315BEh
jmp 00007FF924E457A9h
jmp 00007FF924E143F4h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x117740	0x1f2	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13b290	0x1a4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x141000	0x43c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x12f000	0x93d8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x133e00	0x6f330
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x142000	0xcd4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf8dac	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf9720	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xf8df0	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13a000	0x1290	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe1efe	0xe2000	c27844b5fefb8b4f32784de79741b291	False	0.32616755392699115	data	5.523661196194184	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xe3000	0x34932	0x34a00	1cd5c30f220865a911132d527e734c49	False	0.3929167903800475	data	5.129498459532087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x118000	0x16169	0xb800	b3fb7db394607a7240f19879cb42a995	False	0.07903787364130435	data	4.513010959133125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x12f000	0xa3c8	0xa400	333bb4d549be65a409dda92eef4beb2a	False	0.4789919969512195	data	5.660394348815495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x13a000	0x4bcc	0x4c00	197ecdf47ce9610bc45fc0da251b4ac9	False	0.22820723684210525	data	4.071058792988633	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x13f000	0x30e	0x400	9dc30c2dc27dfd0a59aa3c129060a973	False	0.021484375	data	0.011173818721219527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x140000	0x151	0x200	b22d534dd2b59b2bb8e0a6b93c1a6a02	False	0.05859375	data	0.3458273094223054	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x141000	0x43c	0x600	252568febe655595f67b0922b8259b51	False	0.18229166666666666	data	2.1453209082817444	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x142000	0x1b75	0x1c00	844a9ae1e1bd4f1c783e3f7f1ef00854	False	0.24093191964285715	data	3.305074690760594	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x141170	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
ADVAPI32.dll	OpenProcessToken, GetUserNameW, RegCloseKey, RegOpenKeyExW, RegQueryValueExW, CryptAcquireContextW, CryptReleaseContext, CryptGenRandom, SystemFunction036
IPHLPAPI.DLL	GetAdaptersAddresses
USERENV.dll	GetUserProfileDirectoryW
WS2_32.dll	WSAIoctl, WSARecv, WSASend, WSADuplicateSocketW, htonl, WSARecvFrom, WSASendTo, WSASetLastError, WSAStartup, select, socket, WSASocketW, ntohs, closesocket, getsockopt, setsockopt, WSAGetLastError, htons, bind, ioctlsocket, getpeername, getsockname, listen, shutdown
KERNEL32.dll	RtlCaptureContext, GetModuleHandleW, WaitForSingleObjectEx, InitializeCriticalSectionAndSpinCount, RtlLookupFunctionEntry, InitOnceBeginInitialize, RtlVirtualUnwind, IsProcessorFeaturePresent, IsDebuggerPresent, GetCurrentThreadId, GetSystemTimeAsFileTime, InitOnceComplete, SetUnhandledExceptionFilter, UnhandledExceptionFilter, InitializeSListHead, VirtualUnlock, VirtualLock, VirtualFree, VirtualProtect, GetLastError, LocalAlloc, LocalFree, GetCurrentProcessId, GetTickCount, CloseHandle, SetErrorMode, CreateIoCompletionPort, GetQueuedCompletionStatus, SetHandleInformation, PostQueuedCompletionStatus, CancelIo, CreateEventW, RegisterWaitForSingleObject, UnregisterWait, VerSetConditionMask, GetEnvironmentVariableW, SetEnvironmentVariableW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetTempPathW, QueryPerformanceCounter, QueryPerformanceFrequency, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetProcessTimes, GetCurrentProcess, GlobalMemoryStatusEx, GetSystemInfo, GetModuleFileNameW, VerifyVersionInfoW, FileTimeToSystemTime, MultiByteToWideChar, WideCharToMultiByte, GetConsoleTitleW, SetConsoleTitleW, K32GetProcessMemoryInfo, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, GetFileType, GetConsoleMode, TryEnterCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, WaitForMultipleObjects, CreateSemaphoreW, ResumeThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, CreateFileW, FlushFileBuffers, ReadFile, WriteFile, DuplicateHandle, SetLastError, ConnectNamedPipe, SetNamedPipeHandleState, PeekNamedPipe, CreateNamedPipeW, WaitNamedPipeW, GetNamedPipeHandleStateW, SwitchToThread, GetCurrentThread, QueueUserWorkItem, CreateNamedPipeA, SetConsoleMode, GetNumberOfConsoleInputEvents, ReadConsoleInputW, ReadConsoleW, WriteConsoleW, FillConsoleOutputCharacterW, FillConsoleOutputAttribute, GetConsoleCursorInfo, SetConsoleCursorInfo, GetConsoleScreenBufferInfo, SetConsoleCursorPosition, SetConsoleTextAttribute, WriteConsoleInputW, Sleep, SetConsoleCtrlHandler, GetFileAttributesW, TerminateProcess, GetExitCodeProcess, CreateProcessW, OpenProcess, UnregisterWaitEx, CreateJobObjectW, AssignProcessToJobObject, SetInformationJobObject, LCMapStringW, FormatMessageA, CreateDirectoryW, GetFileInformationByHandle, RemoveDirectoryW, SetFileTime, DeviceIoControl, MoveFileExW, CreateHardLinkW, GetLongPathNameW, GetShortPathNameW, ReadDirectoryChangesW, GetModuleHandleA, GetProcAddress, GetStdHandle, CreateFileA, GetStartupInfoW, VirtualAlloc
ole32.dll	CoCreateGuid
MSVCP140.dll	??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?_Xbad_alloc@std@@YAXXZ, ?_Xlength_error@std@@YAXPEBD@Z, ?_Xbad_function_call@std@@YAXXZ, _Mbrtowc, ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ, ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ, ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ, ?uncaught_exception@std@@YA_NXZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z, ?_Xout_of_range@std@@YAXPEBD@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z, _Mtx_init_in_situ, _Mtx_destroy_in_situ, _Mtx_lock, _Mtx_unlock, ?_Throw_C_error@std@@YAXH@Z, ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z, ??Bid@locale@std@@QEAA_KXZ, ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z, ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z, ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z, ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z, ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z, ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ, ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ, ?_Incref@facet@locale@std@@UEAAXXZ, ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A, _Xtime_get_ticks, _Query_perf_counter, _Query_perf_frequency, _Thrd_detach, _Thrd_sleep, _Thrd_id, _Cnd_do_broadcast_at_thread_exit, ?_Throw_Cpp_error@std@@YAXH@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
CRYPT32.dll	CryptMsgGetParam, CertCloseStore, CertFindCertificateInStore, CertFreeCertificateContext, CertGetNameStringW, CryptQueryObject, CryptMsgClose
WINTRUST.dll	WinVerifyTrust
VCRUNTIME140.dll	__std_type_info_destroy_list, __current_exception_context, __current_exception, __C_specific_handler, wcsrchr, wcschr, strchr, __RTDynamicCast, memchr, memset, memcmp, memmove, memcpy, _CxxThrowException, _purecall, __std_terminate, __std_exception_copy, __std_exception_destroy
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	__doserrno, exit, abort, _beginthreadex, terminate, _errno, _invalid_parameter_noinfo_noreturn, _initterm_e, _initterm, _cexit, _crt_at_quick_exit, raise, _set_invalid_parameter_handler, _seh_filter_dll, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _execute_onexit_table, _crt_atexit
api-ms-win-crt-heap-l1-1-0.dll	malloc, free, calloc, _callnewh, realloc
api-ms-win-crt-convert-l1-1-0.dll	wcstombs, atoi
api-ms-win-crt-stdio-l1-1-0.dll	_write, _read, _open_osfhandle, _lseeki64, __p__fmode, __acrt_iob_func, _get_osfhandle, __stdio_common_vsnprintf_s, __stdio_common_vfprintf, _close, __stdio_common_vsprintf, __stdio_common_vsnwprintf_s
api-ms-win-crt-time-l1-1-0.dll	_localtime64_s, _time64
api-ms-win-crt-environment-l1-1-0.dll	getenv
api-ms-win-crt-string-l1-1-0.dll	wcsncmp, strncpy_s, wcsncpy_s, _wcsrev, _wcsnicmp, wcspbrk, _wcsdup
api-ms-win-crt-utility-l1-1-0.dll	qsort
api-ms-win-crt-filesystem-l1-1-0.dll	_umask, _wchmod, _wmkdir, _wrmdir

Exports

Name	Ordinal	Address
CreateServiceHost	1	0x180001d84
CreateServiceInvoker	2	0x1800013e8
DestroyServiceHost	3	0x1800031bb
DestroyServiceInvoker	4	0x180001b72
InitIPCCoreRuntime	5	0x180001e1a

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	06:31:57
Start date:	30/08/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\ipc_core.dll.dll"
Imagebase:	0x7ff6822a0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:31:57
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:31:57
Start date:	30/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",#1
Imagebase:	0x7ff7ebef0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:31:57
Start date:	30/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\ipc_core.dll.dll,CreateServiceHost
Imagebase:	0x7ff7170a0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:31:57
Start date:	30/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",#1
Imagebase:	0x7ff7170a0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:32:00
Start date:	30/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\ipc_core.dll.dll,CreateServiceInvoker
Imagebase:	0x7ff7170a0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:32:01
Start date:	30/08/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7492 -s 408
Imagebase:	0x7ff7bd620000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:32:03
Start date:	30/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\ipc_core.dll.dll,DestroyServiceHost
Imagebase:	0x7ff7170a0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:32:06
Start date:	30/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",CreateServiceHost
Imagebase:	0x7ff7170a0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:32:06
Start date:	30/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",CreateServiceInvoker
Imagebase:	0x7ff7170a0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:32:06
Start date:	30/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",DestroyServiceHost
Imagebase:	0x7ff7170a0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:32:06
Start date:	30/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",InitIPCCoreRuntime
Imagebase:	0x7ff7170a0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:32:07
Start date:	30/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\ipc_core.dll.dll",DestroyServiceInvoker
Imagebase:	0x7ff7170a0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:32:07
Start date:	30/08/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7792 -s 400
Imagebase:	0x7ff7bd620000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:32:07
Start date:	30/08/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7820 -s 404
Imagebase:	0x7ff7bd620000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:32:07
Start date:	30/08/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7800 -s 408
Imagebase:	0x7ff7bd620000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF8A8DF13E8 Relevance: 1.7, APIs: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E02167

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 369cfe7acc4143cfdb3ae5a9d7eebba21170193639316a599e27252807aaa5c1
Instruction ID: 152ec1cea6bb20c1db0c7117bc79b25fdd3ef758ec19681d91c768b7444f88ed
Opcode Fuzzy Hash: 369cfe7acc4143cfdb3ae5a9d7eebba21170193639316a599e27252807aaa5c1
Instruction Fuzzy Hash: 2371AC72B8AB41A9FB16CBA1A4003AD23B1EF547D8F040631EE5D17BC9DF3C945A8318

Non-executed Functions

Function 00007FF8A8DF246E Relevance: 89.6, APIs: 29, Strings: 22, Instructions: 342
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF8A8E9D59D
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D5B9
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D5D9
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D5F9
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D619
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D639
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D659
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D67E
GetModuleHandleA.KERNEL32 ref: 00007FF8A8E9D69B
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D6B7
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D6CE
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D6E5
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D6FC
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D713
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D72A
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D741
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D758
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D76F
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D786
GetProcAddress.KERNEL32 ref: 00007FF8A8E9D79D
GetLastError.KERNEL32 ref: 00007FF8A8E9D7B0
GetLastError.KERNEL32 ref: 00007FF8A8E9D7C5
GetLastError.KERNEL32 ref: 00007FF8A8E9D7DA
GetLastError.KERNEL32 ref: 00007FF8A8E9D7EF
GetLastError.KERNEL32 ref: 00007FF8A8E9D804
GetLastError.KERNEL32 ref: 00007FF8A8E9D819
GetLastError.KERNEL32 ref: 00007FF8A8E9D82E
GetLastError.KERNEL32 ref: 00007FF8A8E9D843
GetLastError.KERNEL32 ref: 00007FF8A8E9D858

Strings

NtSetInformationFile, xrefs: 00007FF8A8E9D60F
NtQueryInformationFile, xrefs: 00007FF8A8E9D5EF
NtDeviceIoControlFile, xrefs: 00007FF8A8E9D5CF
ntdll.dll, xrefs: 00007FF8A8E9D596
SleepConditionVariableCS, xrefs: 00007FF8A8E9D719
GetQueuedCompletionStatusEx, xrefs: 00007FF8A8E9D6AD
InitializeConditionVariable, xrefs: 00007FF8A8E9D702
CancelSynchronousIo, xrefs: 00007FF8A8E9D775
CancelIoEx, xrefs: 00007FF8A8E9D6EB
GetProcAddress, xrefs: 00007FF8A8E9D7CD, 00007FF8A8E9D7E2, 00007FF8A8E9D7F7, 00007FF8A8E9D80C, 00007FF8A8E9D821, 00007FF8A8E9D836, 00007FF8A8E9D84B
SetFileCompletionNotificationModes, xrefs: 00007FF8A8E9D6BD
NtQueryVolumeInformationFile, xrefs: 00007FF8A8E9D62F
WakeConditionVariable, xrefs: 00007FF8A8E9D75E
GetModuleHandleA, xrefs: 00007FF8A8E9D7B8, 00007FF8A8E9D860
SleepConditionVariableSRW, xrefs: 00007FF8A8E9D730
WakeAllConditionVariable, xrefs: 00007FF8A8E9D747
CreateSymbolicLinkW, xrefs: 00007FF8A8E9D6D4
RtlNtStatusToDosError, xrefs: 00007FF8A8E9D5AF
kernel32.dll, xrefs: 00007FF8A8E9D694
NtQuerySystemInformation, xrefs: 00007FF8A8E9D674
NtQueryDirectoryFile, xrefs: 00007FF8A8E9D64F
GetFinalPathNameByHandleW, xrefs: 00007FF8A8E9D78C

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: AddressProc$ErrorLast$HandleModule
String ID: CancelIoEx$CancelSynchronousIo$CreateSymbolicLinkW$GetFinalPathNameByHandleW$GetModuleHandleA$GetProcAddress$GetQueuedCompletionStatusEx$InitializeConditionVariable$NtDeviceIoControlFile$NtQueryDirectoryFile$NtQueryInformationFile$NtQuerySystemInformation$NtQueryVolumeInformationFile$NtSetInformationFile$RtlNtStatusToDosError$SetFileCompletionNotificationModes$SleepConditionVariableCS$SleepConditionVariableSRW$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll$ntdll.dll
API String ID: 730103829-872772298
Opcode ID: d54ad05899902742672bbea0b712f217685da672c915a4273e1685abfca16760
Instruction ID: baf2f4f04289ead3e51978afee6f51529f8392da460e73c308789b2ec7f76934
Opcode Fuzzy Hash: d54ad05899902742672bbea0b712f217685da672c915a4273e1685abfca16760
Instruction Fuzzy Hash: 5371A074B5BB03B2EB05AB64B85407577A2FF487C0F845436C84E8A265FF7CA568C278

Function 00007FF8A8E8B9A0 Relevance: 83.4, APIs: 44, Strings: 3, Instructions: 1160
filesynchronizationregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32 ref: 00007FF8A8E8BB44
WriteFile.KERNEL32 ref: 00007FF8A8E8BB99
GetLastError.KERNEL32 ref: 00007FF8A8E8BBA3
WaitForSingleObject.KERNEL32 ref: 00007FF8A8E8BBB9
GetLastError.KERNEL32 ref: 00007FF8A8E8BBC3
CloseHandle.KERNEL32 ref: 00007FF8A8E8BBCF
CloseHandle.KERNEL32 ref: 00007FF8A8E8BBE8
CreateEventW.KERNEL32 ref: 00007FF8A8E8BDB9
WriteFile.KERNEL32 ref: 00007FF8A8E8BDE2
GetLastError.KERNEL32 ref: 00007FF8A8E8BDEC
GetLastError.KERNEL32 ref: 00007FF8A8E8BDF9
CloseHandle.KERNEL32 ref: 00007FF8A8E8BE05
WaitForSingleObject.KERNEL32 ref: 00007FF8A8E8BE26
GetLastError.KERNEL32 ref: 00007FF8A8E8BE30
CloseHandle.KERNEL32 ref: 00007FF8A8E8BE3C
CloseHandle.KERNEL32 ref: 00007FF8A8E8BE5A
WriteFile.KERNEL32 ref: 00007FF8A8E8BE78
GetLastError.KERNEL32 ref: 00007FF8A8E8BE82
CreateEventW.KERNEL32 ref: 00007FF8A8E8BEBB
RegisterWaitForSingleObject.KERNEL32 ref: 00007FF8A8E8BEF6
GetLastError.KERNEL32 ref: 00007FF8A8E8BF04
GetLastError.KERNEL32 ref: 00007FF8A8E8BF0F
GetLastError.KERNEL32 ref: 00007FF8A8E8BF36
GetLastError.KERNEL32 ref: 00007FF8A8E8BF4B
GetLastError.KERNEL32 ref: 00007FF8A8E8BF60
WriteFile.KERNEL32 ref: 00007FF8A8E8C12B
GetLastError.KERNEL32 ref: 00007FF8A8E8C135
GetLastError.KERNEL32 ref: 00007FF8A8E8C13F
GetLastError.KERNEL32 ref: 00007FF8A8E8C150
PostQueuedCompletionStatus.KERNEL32 ref: 00007FF8A8E8C176
GetLastError.KERNEL32 ref: 00007FF8A8E8C18D
GetCurrentProcess.KERNEL32 ref: 00007FF8A8E8C21C
GetCurrentThread.KERNEL32 ref: 00007FF8A8E8C225
GetCurrentProcess.KERNEL32 ref: 00007FF8A8E8C22E
DuplicateHandle.KERNEL32 ref: 00007FF8A8E8C257
ReadFile.KERNEL32 ref: 00007FF8A8E8C297
GetLastError.KERNEL32 ref: 00007FF8A8E8C2A3
ReadFile.KERNEL32 ref: 00007FF8A8E8C2FF
CloseHandle.KERNEL32 ref: 00007FF8A8E8C333
PostQueuedCompletionStatus.KERNEL32 ref: 00007FF8A8E8C382
GetLastError.KERNEL32 ref: 00007FF8A8E8C3A5
CloseHandle.KERNEL32 ref: 00007FF8A8E8C4CB

Strings

PostQueuedCompletionStatus, xrefs: 00007FF8A8E8BF3E, 00007FF8A8E8C195, 00007FF8A8E8C3AD
uv__malloc, xrefs: 00007FF8A8E8BF24
CreateEvent, xrefs: 00007FF8A8E8BF17, 00007FF8A8E8BF53, 00007FF8A8E8BF68

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$Handle$Close$File$Write$CreateCurrentEventObjectSingleWait$CompletionPostProcessQueuedReadStatus$DuplicateRegisterThread
String ID: CreateEvent$PostQueuedCompletionStatus$uv__malloc
API String ID: 139739520-319561093
Opcode ID: 111e992147172d866c60a2b781d923bea1e48a285099a6898143592ed8ec4357
Instruction ID: 9b4ca76c3a3b2c922385f34ffeee22d7257ea97f9da31697dc50afcadf5a1c97
Opcode Fuzzy Hash: 111e992147172d866c60a2b781d923bea1e48a285099a6898143592ed8ec4357
Instruction Fuzzy Hash: C0528C32A0AB82E6E7548F25E4446AD33A0FB89BD4F444136DA4D477A4DF3CE4A5C724

Function 00007FF8A8DF3580 Relevance: 72.6, APIs: 23, Strings: 18, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EBE706
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8EBE722
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EBE75C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8EBE7CB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EBE82E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EBE889
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EBE8FF
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EBE97C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EBE99B
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EBEA77
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EBEAB0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EBEB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EBEB6A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EBEBE6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EBEC05

Part of subcall function 00007FF8A8DF1C58: memcmp.VCRUNTIME140 ref: 00007FF8A8E5D35E

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EBED96
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EBEE73
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EBEF08
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EBF0E3
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EBF1E0

Part of subcall function 00007FF8A8DF2B0D: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E609DD
Part of subcall function 00007FF8A8DF2B0D: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E60A14
Part of subcall function 00007FF8A8DF2B0D: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E60A33

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EBF297
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EBF2FF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EBF35A

Strings

[p2p_channel] AddPendingConnection status invalid, xrefs: 00007FF8A8EBE95B
[p2p_channel] AddPendingConnection remote invalid, xrefs: 00007FF8A8EBE8DE
candidate:, xrefs: 00007FF8A8EBEE97, 00007FF8A8EBF204
is_unknowned_peer_address, xrefs: 00007FF8A8EBF1BF
none, xrefs: 00007FF8A8EBEA12
auth_session_id:, xrefs: 00007FF8A8EBE799
auth_from_offer:, xrefs: 00007FF8A8EBE7B8
local:, xrefs: 00007FF8A8EBE765
session_id:, xrefs: 00007FF8A8EBE72B, 00007FF8A8EBEA80, 00007FF8A8EBEE7C, 00007FF8A8EBF1E9
channel_status:, xrefs: 00007FF8A8EBE746, 00007FF8A8EBE985, 00007FF8A8EBEA9A, 00007FF8A8EBEBEF
candidate invalid, xrefs: 00007FF8A8EBEE52
[p2p_channel] AddPendingConnection no offer, xrefs: 00007FF8A8EBEBC5
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8EBE6B2, 00007FF8A8EBE8BF, 00007FF8A8EBE93C, 00007FF8A8EBEA36, 00007FF8A8EBEBA5, 00007FF8A8EBEE23, 00007FF8A8EBF190
[p2p_channel] AddPendingConnection no answer, xrefs: 00007FF8A8EBEA56
[p2p_channel] AddPendingConnection, xrefs: 00007FF8A8EBE6E2, 00007FF8A8EBEE43, 00007FF8A8EBF1B0
connection_id:, xrefs: 00007FF8A8EBE6F1, 00007FF8A8EBE8ED, 00007FF8A8EBE96A, 00007FF8A8EBEA65, 00007FF8A8EBEBD4, 00007FF8A8EBEE61, 00007FF8A8EBF1CE
is_offer_channel:, xrefs: 00007FF8A8EBE70F
remote:, xrefs: 00007FF8A8EBE77F

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$_invalid_parameter_noinfo_noreturn$V01@_$memcmp
String ID: auth_from_offer:$ auth_session_id:$ candidate invalid$ candidate:$ channel_status:$ connection_id:$ is_offer_channel:$ is_unknowned_peer_address$ local:$ remote:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] AddPendingConnection$[p2p_channel] AddPendingConnection no answer$[p2p_channel] AddPendingConnection no offer$[p2p_channel] AddPendingConnection remote invalid$[p2p_channel] AddPendingConnection status invalid$none
API String ID: 2281602837-1616360204
Opcode ID: 1703025364611823d3b0d0d2857048573dae304c93e44d0f70bfe2a95845b0c1
Instruction ID: 3d1504ffcef998cc8f525b05ee467f18c0c17cf46f4d41ffb1b95f15af0eb847
Opcode Fuzzy Hash: 1703025364611823d3b0d0d2857048573dae304c93e44d0f70bfe2a95845b0c1
Instruction Fuzzy Hash: 3B72C172A0A682E9EF249F25D8443E92361FF407D8F409135E65D07ADAEF7CE948C314

Function 00007FF8A8DF3940 Relevance: 51.6, APIs: 12, Strings: 17, Instructions: 853COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E366AF
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E366CB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E3672F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E367A0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E36802
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E36D36
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E36EB6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E36ED5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E36F0B
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E36F42
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E36FC6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E37046

Strings

invalid auth_sesssion_id:, xrefs: 00007FF8A8E3704F
auth_session_id:, xrefs: 00007FF8A8E36F14
auth_from_offer:, xrefs: 00007FF8A8E36F2E
reason_code:, xrefs: 00007FF8A8E366B8
answer_result_code:, xrefs: 00007FF8A8E3669C
session_id:, xrefs: 00007FF8A8E36642, 00007FF8A8E36EDE
channel_status:, xrefs: 00007FF8A8E36EBF
F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E36612
c, xrefs: 00007FF8A8E365E8
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E36E68, 00007FF8A8E36FF9
[p2p_channel] OnAnswerHandshakeResponse, xrefs: 00007FF8A8E36E95, 00007FF8A8E37025
connection_id:, xrefs: 00007FF8A8E36EF9
recipient:, xrefs: 00007FF8A8E3667E
is_offer_channel:, xrefs: 00007FF8A8E36EA4, 00007FF8A8E37034
sender:, xrefs: 00007FF8A8E36660
[p2p_biz_service] OnOffeAccept, xrefs: 00007FF8A8E36633
this_session_id:, xrefs: 00007FF8A8E37069

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$_invalid_parameter_noinfo_noreturn$V01@$V01@_
String ID: answer_result_code:$ auth_from_offer:$ auth_session_id:$ channel_status:$ connection_id:$ invalid auth_sesssion_id:$ is_offer_channel:$ reason_code:$ recipient:$ sender:$ session_id:$ this_session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_biz_service] OnOffeAccept$[p2p_channel] OnAnswerHandshakeResponse$c
API String ID: 1618417494-1558871939
Opcode ID: d54d52193bee6b9201780333284bb0242b55a863f06d5324a1fb068335479c8b
Instruction ID: dd74eeea487a198a2fdc4a26e5d601d2d45948a8c17063dbfd80ab36585bfe51
Opcode Fuzzy Hash: d54d52193bee6b9201780333284bb0242b55a863f06d5324a1fb068335479c8b
Instruction Fuzzy Hash: C682C072A0AB81AAEB61DF25D8802ED33A0FB447C8F444135DA9D07BA9DF7CD958D314

Function 00007FF8A8DF3A08 Relevance: 49.6, APIs: 14, Strings: 14, Instructions: 565
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E07F3E
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A8E07F7A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E07FEC
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E08006
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E080B3
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E080CD
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E081FE
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E08393
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E083E8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0842D
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E084AA
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E084C5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0852E
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E085D9

Strings

offer_crypto_id:, xrefs: 00007FF8A8E07FF5, 00007FF8A8E080BC, 00007FF8A8E08499
[p2p_crypto] NegotiateCryptoContextWithAnswer failed, xrefs: 00007FF8A8E07DE7, 00007FF8A8E07E48
try degrade with answer crypto context failed, xrefs: 00007FF8A8E081DC
[p2p_crypto] NegotiateCryptoContextWithAnswer, xrefs: 00007FF8A8E07FCB, 00007FF8A8E08083, 00007FF8A8E081CD
e_id, xrefs: 00007FF8A8E07EA9
[p2p_crypto] NegotiateCryptoContextWithAnswer degraded, xrefs: 00007FF8A8E08362
answer_encrypto_info is empty, xrefs: 00007FF8A8E07E57
offer_encrypto_starter invalid, xrefs: 00007FF8A8E07DF6
F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_shell_service.cc, xrefs: 00007FF8A8E07DC8, 00007FF8A8E07E29, 00007FF8A8E07F9F, 00007FF8A8E08057, 00007FF8A8E081AE, 00007FF8A8E08343, 00007FF8A8E0845B, 00007FF8A8E08589
answer_crypto_id:, xrefs: 00007FF8A8E07FDA, 00007FF8A8E080A1, 00007FF8A8E081EB, 00007FF8A8E08380, 00007FF8A8E084B3, 00007FF8A8E085C7
[p2p_crypto] NegotiateCryptoContextWithAnswer success, xrefs: 00007FF8A8E0848A
answer crypto context has degraded, xrefs: 00007FF8A8E08092
[p2p_crypto] NegotiateCryptoContextWithAnswer not degraded, xrefs: 00007FF8A8E085A9
InitSharedSecret with crypto context failed, xrefs: 00007FF8A8E08371, 00007FF8A8E085B8

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@$_invalid_parameter_noinfo_noreturn$atoi
String ID: InitSharedSecret with crypto context failed$ answer crypto context has degraded$ answer_crypto_id:$ answer_encrypto_info is empty$ offer_crypto_id:$ offer_encrypto_starter invalid$ try degrade with answer crypto context failed$F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_shell_service.cc$[p2p_crypto] NegotiateCryptoContextWithAnswer$[p2p_crypto] NegotiateCryptoContextWithAnswer degraded$[p2p_crypto] NegotiateCryptoContextWithAnswer failed$[p2p_crypto] NegotiateCryptoContextWithAnswer not degraded$[p2p_crypto] NegotiateCryptoContextWithAnswer success$e_id
API String ID: 2797399658-1148742941
Opcode ID: 7111f673351ed7ab201e6eefc4d6d9b13e81f17b42ea87c3426502d226e65386
Instruction ID: af465e4b82af00f9c1b5a794149a7ffb6a620b300b90e87488fea0f1a6a7e8bf
Opcode Fuzzy Hash: 7111f673351ed7ab201e6eefc4d6d9b13e81f17b42ea87c3426502d226e65386
Instruction Fuzzy Hash: 2C42E272A0AA82E1EF20DF24D8403AD2361FB847D8F415136DA6D07AD9DF7CD959C728

Function 00007FF8A8DF3ABC Relevance: 45.8, APIs: 20, Strings: 6, Instructions: 293
encryptionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32 ref: 00007FF8A8E0A5A9
GetLastError.KERNEL32 ref: 00007FF8A8E0A5E5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF8A8E0A611
CryptMsgGetParam.CRYPT32 ref: 00007FF8A8E0A649
GetLastError.KERNEL32 ref: 00007FF8A8E0A687
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF8A8E0A6B3
LocalAlloc.KERNEL32 ref: 00007FF8A8E0A6DB
GetLastError.KERNEL32 ref: 00007FF8A8E0A71B
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF8A8E0A747
CryptMsgGetParam.CRYPT32 ref: 00007FF8A8E0A77F
GetLastError.KERNEL32 ref: 00007FF8A8E0A7BD
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF8A8E0A7E9
CertFindCertificateInStore.CRYPT32 ref: 00007FF8A8E0A842
GetLastError.KERNEL32 ref: 00007FF8A8E0A882
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF8A8E0A8AE
CertFreeCertificateContext.CRYPT32 ref: 00007FF8A8E0A8E6
LocalFree.KERNEL32 ref: 00007FF8A8E0A8EF
CryptMsgClose.CRYPT32 ref: 00007FF8A8E0A8FF
CertCloseStore.CRYPT32 ref: 00007FF8A8E0A910
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0A954

Strings

[pe_verify] CryptQueryObject failed, xrefs: 00007FF8A8E0A5F1
[pe_verify] LocalAlloc failed, xrefs: 00007FF8A8E0A727
last_error:, xrefs: 00007FF8A8E0A600, 00007FF8A8E0A6A2, 00007FF8A8E0A736, 00007FF8A8E0A7D8, 00007FF8A8E0A89D
[pe_verify] CryptMsgGetParam failed, xrefs: 00007FF8A8E0A693, 00007FF8A8E0A7C9
F:\Demo\ipc_sdk_fix\src\ipc_core\pe_verifier.cc, xrefs: 00007FF8A8E0A5C9, 00007FF8A8E0A66B, 00007FF8A8E0A6FF, 00007FF8A8E0A7A1, 00007FF8A8E0A866
[pe_verify] CertFindCertificateInStore failed, xrefs: 00007FF8A8E0A88E

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@ErrorLastU?$char_traits@V01@$Crypt$Cert$CertificateCloseFreeLocalParamStore$AllocContextFindObjectQuery_invalid_parameter_noinfo_noreturn
String ID: last_error:$F:\Demo\ipc_sdk_fix\src\ipc_core\pe_verifier.cc$[pe_verify] CertFindCertificateInStore failed$[pe_verify] CryptMsgGetParam failed$[pe_verify] CryptQueryObject failed$[pe_verify] LocalAlloc failed
API String ID: 3006877746-1048816935
Opcode ID: 88408292f67c6ac2cee66c05ab1d0ba01bd9d57426dde85c95b9c679996c9ffb
Instruction ID: 0eedb414a5bc6188168b45bad52050005ed4424b88e059d2a2b9ee27e9aab7a8
Opcode Fuzzy Hash: 88408292f67c6ac2cee66c05ab1d0ba01bd9d57426dde85c95b9c679996c9ffb
Instruction Fuzzy Hash: 7BD1C532A0A646E9FB15DB20E8406B93371FF847C4F404436DA4D176A9EF3CE95AD728

Function 00007FF8A8DF1B4C Relevance: 42.7, APIs: 14, Strings: 10, Instructions: 738
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

msg_type:, xrefs: 00007FF8A8E24DF9
[ServiceInvoker], xrefs: 00007FF8A8E2445A, 00007FF8A8E24B3D, 00007FF8A8E24DBD
F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc, xrefs: 00007FF8A8E24439, 00007FF8A8E24B19, 00007FF8A8E24D97
OnIncomingPacket push request not handle, xrefs: 00007FF8A8E24B4C
rsp_mid:, xrefs: 00007FF8A8E24B97
message_type:, xrefs: 00007FF8A8E24478
rsp_uri:, xrefs: 00007FF8A8E24B79
channel_adpater_id:, xrefs: 00007FF8A8E24B5B, 00007FF8A8E24DDB
OnIncomingPacket discarded, xrefs: 00007FF8A8E24469
OnIncomingPacket drop unknown msg_type!, xrefs: 00007FF8A8E24DCC

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID:
String ID: OnIncomingPacket discarded$ OnIncomingPacket drop unknown msg_type!$ OnIncomingPacket push request not handle$ channel_adpater_id:$ message_type:$ msg_type:$ rsp_mid:$ rsp_uri:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc$[ServiceInvoker]
API String ID: 0-2503112115
Opcode ID: 4100f2e6e88584fd2ebc8a8dc527eda471f6637de1792a0d1cca6c6ecc8741e4
Instruction ID: 8b7fff204673c8d6995b34b7273830fcce4fcea6f7d0c6bf1dfd62d436f618bc
Opcode Fuzzy Hash: 4100f2e6e88584fd2ebc8a8dc527eda471f6637de1792a0d1cca6c6ecc8741e4
Instruction Fuzzy Hash: EC72B272A06AC2D6EB25DF24D8802ED33A0FB447D8F445235DA9D07A99EF78DA94C314

Function 00007FF8A8DF10AA Relevance: 42.5, APIs: 10, Strings: 14, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0919F
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A8E091DB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E09239
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E09323
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E09457
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E09502
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E095AD
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E096D5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E096EF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E09749

Strings

InitSharedSecret failed, xrefs: 00007FF8A8E0958D
[p2p_crypto] NegotiateCryptoContextWithOffer try degrade, xrefs: 00007FF8A8E09301, 00007FF8A8E09427
offer_crypto_id:, xrefs: 00007FF8A8E09228, 00007FF8A8E09310, 00007FF8A8E094EF, 00007FF8A8E096C2
result:, xrefs: 00007FF8A8E09445
crypto_id:, xrefs: 00007FF8A8E0959C
[p2p_crypto] NegotiateCryptoContextWithOffer success, xrefs: 00007FF8A8E096B3
negotiate failed, xrefs: 00007FF8A8E094E0
e_id, xrefs: 00007FF8A8E09110
to chacha20 alog, xrefs: 00007FF8A8E09436
[p2p_crypto] NegotiateCryptoContextWithOffer, xrefs: 00007FF8A8E09219, 00007FF8A8E094D1, 00007FF8A8E0957E
[p2p_crypto] NegotiateCryptoContextWithOffer failed, xrefs: 00007FF8A8E090B0
offer_encrypto_info is empty, xrefs: 00007FF8A8E090BF
F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_shell_service.cc, xrefs: 00007FF8A8E09092, 00007FF8A8E091FB, 00007FF8A8E092E2, 00007FF8A8E09402, 00007FF8A8E094B2, 00007FF8A8E09550, 00007FF8A8E09688
answer_crypto_id:, xrefs: 00007FF8A8E096DE

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$_invalid_parameter_noinfo_noreturn$V01@_atoi
String ID: InitSharedSecret failed$ answer_crypto_id:$ crypto_id:$ negotiate failed$ offer_crypto_id:$ offer_encrypto_info is empty$ result:$ to chacha20 alog$F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_shell_service.cc$[p2p_crypto] NegotiateCryptoContextWithOffer$[p2p_crypto] NegotiateCryptoContextWithOffer failed$[p2p_crypto] NegotiateCryptoContextWithOffer success$[p2p_crypto] NegotiateCryptoContextWithOffer try degrade$e_id
API String ID: 1326299942-2709944688
Opcode ID: 1c6b6d0ee1c373fd347d5eeeedb431a3177a6f9956ca73be179470c933b22052
Instruction ID: d905ec1124d1d6c4989554460c644bce4a330b8799de2549b03d6282b80ea5cf
Opcode Fuzzy Hash: 1c6b6d0ee1c373fd347d5eeeedb431a3177a6f9956ca73be179470c933b22052
Instruction Fuzzy Hash: 5022D632A06A82E5EB20EF21E8403AD33A0FB847D4F455136DA9D17699DF3CDD49C714

Function 00007FF8A8DF1500 Relevance: 35.5, APIs: 7, Strings: 13, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E31DC1
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E31DE1
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E31E01
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E31E20
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E3236F
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E3238A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E3244F

Strings

self_uid:, xrefs: 00007FF8A8E31D74
biz_meta_biz_type:, xrefs: 00007FF8A8E31DAB
biz_meta_msg_type:, xrefs: 00007FF8A8E31DCA
[p2p_biz_service] DoCreateP2POfferChannel, xrefs: 00007FF8A8E31D4B
F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc, xrefs: 00007FF8A8E32330
status:, xrefs: 00007FF8A8E32378
session_id:, xrefs: 00007FF8A8E31D5A
service_on_port:, xrefs: 00007FF8A8E3235E
F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E31D2D
[p2p_tcp_port] PrepareCandidate, xrefs: 00007FF8A8E3234F
peer_uid:, xrefs: 00007FF8A8E31D8F
option_port_timeout:, xrefs: 00007FF8A8E31E0A
option_service_on_port:, xrefs: 00007FF8A8E31DEA

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@$_invalid_parameter_noinfo_noreturn
String ID: biz_meta_biz_type:$ biz_meta_msg_type:$ option_port_timeout:$ option_service_on_port:$ peer_uid:$ self_uid:$ service_on_port:$ session_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc$[p2p_biz_service] DoCreateP2POfferChannel$[p2p_tcp_port] PrepareCandidate
API String ID: 3764696208-1445752852
Opcode ID: a02a34b799335c648d76f9ecea94d4fa80a1f2672ba2e6310c83aed186241605
Instruction ID: 9dfce0de726bb1e066b2f41f9fdd06f98ff4c0c2ad5e6f37a6fdce8380d70760
Opcode Fuzzy Hash: a02a34b799335c648d76f9ecea94d4fa80a1f2672ba2e6310c83aed186241605
Instruction Fuzzy Hash: 9D328E32A0AB81EAEB618F25D8402ED73A0FB48BD4F044136DA9D17B59DF7CD998C714

Function 00007FF8A8DF2900 Relevance: 28.5, APIs: 7, Strings: 9, Instructions: 486COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E5EEA9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E5EF37
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E5F16E
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E5F26C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E5F2A6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E5F43A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E5F456

Strings

candidate:, xrefs: 00007FF8A8E5EECD, 00007FF8A8E5F47A
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E5EE58, 00007FF8A8E5F21B, 00007FF8A8E5F3EA
connection_id:, xrefs: 00007FF8A8E5F427
[p2p_channel] DoAnswerConnectIfNeed start porting, xrefs: 00007FF8A8E5F418
is_offer_channel:, xrefs: 00007FF8A8E5EE97, 00007FF8A8E5F25A, 00007FF8A8E5F443
[p2p_channel] AddCondidate, xrefs: 00007FF8A8E5EE88
[p2p_channel] DoAnswerConnectIfNeed, xrefs: 00007FF8A8E5F24B
session_id:, xrefs: 00007FF8A8E5EEB2, 00007FF8A8E5F275, 00007FF8A8E5F45F
channel_status:, xrefs: 00007FF8A8E5F290

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@_$V01@_invalid_parameter_noinfo_noreturn
String ID: candidate:$ channel_status:$ connection_id:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] AddCondidate$[p2p_channel] DoAnswerConnectIfNeed$[p2p_channel] DoAnswerConnectIfNeed start porting
API String ID: 3536748077-4155210591
Opcode ID: 6a93ceb60bede3ff7c23c6590dcae45c5fb5e98002c30127709ac6336780e6b5
Instruction ID: 067a9fe9ffee62a738bddf44d386342a6974d86f5e07ce8b28ee139c4592855b
Opcode Fuzzy Hash: 6a93ceb60bede3ff7c23c6590dcae45c5fb5e98002c30127709ac6336780e6b5
Instruction Fuzzy Hash: FC22D272A0AA82E5EB14DF25D4403AD33A1FB48BC8F409136EA9D07799DF7CD998C714

Function 00007FF8A8DF345E Relevance: 26.5, APIs: 7, Strings: 7, Instructions: 2016COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8EAF19A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EAF1D6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EAF6B9
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8EAF6D5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EAF912
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EAF919
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EAF920

Strings

[p2p_channel] StartPortIfNeed, xrefs: 00007FF8A8EAF179, 00007FF8A8EAF697
candidate:, xrefs: 00007FF8A8EAF6FC
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8EAF14A, 00007FF8A8EAF667
connection_id:, xrefs: 00007FF8A8EAF6A6
is_offer_channel:, xrefs: 00007FF8A8EAF188, 00007FF8A8EAF6C2
session_id:, xrefs: 00007FF8A8EAF1A3, 00007FF8A8EAF6DE
channel_status:, xrefs: 00007FF8A8EAF1BF

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$_invalid_parameter_noinfo_noreturn$V01@V01@_
String ID: candidate:$ channel_status:$ connection_id:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] StartPortIfNeed
API String ID: 4014131171-1155804326
Opcode ID: 3fcc6b2a973d63dbe71842c5369e0aa1f46b9f0ab787f350f8c38b79ce21ef42
Instruction ID: c03fb5e145f83bc9dc36e0cf8308cb4189e2c12bc0e197ac5ae9707dc8e96069
Opcode Fuzzy Hash: 3fcc6b2a973d63dbe71842c5369e0aa1f46b9f0ab787f350f8c38b79ce21ef42
Instruction Fuzzy Hash: F303BF6AE25FC650E703973954132B5A314AFF77C4E40E32BFD9872B12EF64B650A218

Function 00007FF8A8E82D70 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 214COMMON

Download Yara Rule

APIs

GetConsoleTitleW.KERNEL32 ref: 00007FF8A8E82D9F
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8E82DCE
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8E82E12
GetCurrentProcess.KERNEL32 ref: 00007FF8A8E82EDD
OpenProcessToken.ADVAPI32 ref: 00007FF8A8E82EF0
GetLastError.KERNEL32 ref: 00007FF8A8E82EFA
GetUserProfileDirectoryW.USERENV ref: 00007FF8A8E82F26
GetLastError.KERNEL32 ref: 00007FF8A8E82F30
CloseHandle.KERNEL32 ref: 00007FF8A8E82F3D
CloseHandle.KERNEL32 ref: 00007FF8A8E82F59
GetUserNameW.ADVAPI32 ref: 00007FF8A8E82F71
GetLastError.KERNEL32 ref: 00007FF8A8E82F7B

Strings

uv__malloc, xrefs: 00007FF8A8E82E52
z, xrefs: 00007FF8A8E82F43

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$ByteCharCloseHandleMultiProcessUserWide$ConsoleCurrentDirectoryNameOpenProfileTitleToken
String ID: uv__malloc$z
API String ID: 3280125683-426293159
Opcode ID: 382879932540ea13ec5e886c19c508f36cd30f98ec13b2d0d8d5c173be5e6bb7
Instruction ID: 1363e4a575c88e1af3bf6d2b1347fbfb4ad42d9286c495a892b2502e22eca360
Opcode Fuzzy Hash: 382879932540ea13ec5e886c19c508f36cd30f98ec13b2d0d8d5c173be5e6bb7
Instruction Fuzzy Hash: 02516371A0EA83A2EB609B24F45437E63A0FF947D4F400236EA9D47699DF3CE454C728

Function 00007FF8A8DF2B0D Relevance: 23.5, APIs: 6, Strings: 7, Instructions: 777COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E609DD
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E60A14
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E60A33

Strings

[p2p_channel] StartAnswerHandshakeIfNeed, xrefs: 00007FF8A8E609BC, 00007FF8A8E60DC5
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E6098B, 00007FF8A8E60DA4
failed to check remote, xrefs: 00007FF8A8E60DD4
connection_id:, xrefs: 00007FF8A8E60A01, 00007FF8A8E60DE3
is_offer_channel:, xrefs: 00007FF8A8E609CB
session_id:, xrefs: 00007FF8A8E609E6, 00007FF8A8E60DFF
channel_status:, xrefs: 00007FF8A8E60A1D

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@_
String ID: channel_status:$ connection_id:$ failed to check remote$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] StartAnswerHandshakeIfNeed
API String ID: 102757981-4211974316
Opcode ID: e39d95992fb3deebb5c0f5e763d790a5bffcf68f87d40fc1b666141ad68ad8c4
Instruction ID: ffaafa6bbb7a24dd8e10b83dab06fb1bf234ada8af37c2bd7d85ff3a4a1e789e
Opcode Fuzzy Hash: e39d95992fb3deebb5c0f5e763d790a5bffcf68f87d40fc1b666141ad68ad8c4
Instruction Fuzzy Hash: E8829E32A06B82DADB61CF21D8802ED33A0FB44BC8F448136DA9D47B59DF38DA54C754

Function 00007FF8A8DF1D8E Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 218registryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF8A8E83409
RegOpenKeyExW.ADVAPI32 ref: 00007FF8A8E834EE
RegQueryValueExW.ADVAPI32 ref: 00007FF8A8E83522
RegQueryValueExW.ADVAPI32 ref: 00007FF8A8E83558
RegCloseKey.ADVAPI32 ref: 00007FF8A8E8356B
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8E8361D
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8E8366F
GetLastError.KERNEL32 ref: 00007FF8A8E836ED
RegCloseKey.ADVAPI32 ref: 00007FF8A8E836FA
GetLastError.KERNEL32 ref: 00007FF8A8E83702

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\%d, xrefs: 00007FF8A8E834A0
ProcessorNameString, xrefs: 00007FF8A8E8353F
~MHz, xrefs: 00007FF8A8E8350B

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharCloseErrorLastMultiQueryValueWide$InfoOpenSystem
String ID: HARDWARE\DESCRIPTION\System\CentralProcessor\%d$ProcessorNameString$~MHz
API String ID: 4109611629-3041064979
Opcode ID: cea3d12572632d7a99f670ad34b7e182ed85320b2227df18057707da7d1e6988
Instruction ID: 69d5a1477f95fbe2e051ae7ebfcfe2e56ba4111d3613d09daa6460eb2a11472a
Opcode Fuzzy Hash: cea3d12572632d7a99f670ad34b7e182ed85320b2227df18057707da7d1e6988
Instruction Fuzzy Hash: 8991C072A0AB8292EB14CF25E44066EB7A1FB887D4F404135EE8D47B98EF3CE455C714

Function 00007FF8A8DF4151 Relevance: 21.6, APIs: 3, Strings: 9, Instructions: 642COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E4E6E5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E4EA2F
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E4EC8A

Strings

biz_type:, xrefs: 00007FF8A8E4EC75
[p2p_channel_service] OnChannelConnected, xrefs: 00007FF8A8E4E6A5
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc, xrefs: 00007FF8A8E4E676, 00007FF8A8E4EC2C
IsOfferChannel:, xrefs: 00007FF8A8E4E6D2
c, xrefs: 00007FF8A8E4EBD8
[p2p_channel_service] CreateOfferChannel, xrefs: 00007FF8A8E4EC4B
recipient:, xrefs: 00007FF8A8E4ECAE
sender:, xrefs: 00007FF8A8E4EC93
session_id:, xrefs: 00007FF8A8E4E6B4, 00007FF8A8E4EC5A

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@V01@__invalid_parameter_noinfo_noreturn
String ID: IsOfferChannel:$ biz_type:$ recipient:$ sender:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc$[p2p_channel_service] CreateOfferChannel$[p2p_channel_service] OnChannelConnected$c
API String ID: 3722493997-2313422569
Opcode ID: 6d81b62072e9ae48e99d66927b66881beff1cf6cd3b7d99848072e159bcd032c
Instruction ID: 8a562fcaf7916770c2ec65618b0f1f853b89846eba057b1022724e89347a11fa
Opcode Fuzzy Hash: 6d81b62072e9ae48e99d66927b66881beff1cf6cd3b7d99848072e159bcd032c
Instruction Fuzzy Hash: A5029D72A06B82D6EF64DF25D8402A973A0FB84BE4F088136DA8E47794DF7DD845C718

Function 00007FF8A8DF23A6 Relevance: 21.5, APIs: 11, Strings: 1, Instructions: 463fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E9C314
MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E9C34F
GetLastError.KERNEL32 ref: 00007FF8A8E9C359
GetFileAttributesW.KERNEL32 ref: 00007FF8A8E9C399
GetShortPathNameW.KERNEL32 ref: 00007FF8A8E9C3C6
CreateFileW.KERNEL32 ref: 00007FF8A8E9C441
CreateIoCompletionPort.KERNEL32 ref: 00007FF8A8E9C47A
ReadDirectoryChangesW.KERNEL32 ref: 00007FF8A8E9C4F2
GetLastError.KERNEL32 ref: 00007FF8A8E9C500
CloseHandle.KERNEL32 ref: 00007FF8A8E9C55F
CloseHandle.KERNEL32 ref: 00007FF8A8E9C6B6

Strings

uv__malloc, xrefs: 00007FF8A8E9C5A0

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharCloseCreateErrorFileHandleLastMultiWide$AttributesChangesCompletionDirectoryNamePathPortReadShort
String ID: uv__malloc
API String ID: 1033639618-1058249677
Opcode ID: ffed3f517fe25824586efa32e3fed9ff496c48cea19ae0ab5f811b5435decff2
Instruction ID: 2660912499a23073cdee6c0683000a233f230e8014c44f8edbf183f4301344ae
Opcode Fuzzy Hash: ffed3f517fe25824586efa32e3fed9ff496c48cea19ae0ab5f811b5435decff2
Instruction Fuzzy Hash: F2B1B13260AA8291EB64EFB5D4507B87390EF84BE4F084235DEAD4B6D4DF7CD4558328

Function 00007FF8A8DF173A Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 238processCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32 ref: 00007FF8A8E8481B
GetLastError.KERNEL32 ref: 00007FF8A8E84828
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8E84914
GetLastError.KERNEL32 ref: 00007FF8A8E8491E
GetCurrentProcessId.KERNEL32 ref: 00007FF8A8E849D9
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF8A8E849EE
Process32FirstW.KERNEL32 ref: 00007FF8A8E849FE
Process32NextW.KERNEL32 ref: 00007FF8A8E84A15
CloseHandle.KERNEL32 ref: 00007FF8A8E84A27

Strings

:, xrefs: 00007FF8A8E84864
\, xrefs: 00007FF8A8E84856

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLastProcess32$ByteCharCloseCreateCurrentFirstHandleMultiNextPathProcessSnapshotTempToolhelp32Wide
String ID: :$\
API String ID: 2854115494-1166558509
Opcode ID: 74fdd4869bdc66d40e4a502682c59dd9663b12b62390e3ac15836c2cf94ff20e
Instruction ID: 4f026232840f8c80b3649f0d48fa93bdd655670a51f7bf970b244ff224bdefb0
Opcode Fuzzy Hash: 74fdd4869bdc66d40e4a502682c59dd9663b12b62390e3ac15836c2cf94ff20e
Instruction Fuzzy Hash: 5C516E31A0EB82D2EB609B34A84436E63E0FB897D8F444235EA9D47794EF3CD4558728

Function 00007FF8A8DF254A Relevance: 18.1, APIs: 4, Strings: 6, Instructions: 633COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E7307D
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E73099
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E735A3
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E735BE

Strings

[p2p_pending_handshake] Stop, xrefs: 00007FF8A8E7357F
handeshake_timeout_in_ms:, xrefs: 00007FF8A8E73086
connection_id:, xrefs: 00007FF8A8E73067, 00007FF8A8E7358E
F:\Demo\ipc_sdk_fix\src\p2p\p2p_pending_channel_handshake.cc, xrefs: 00007FF8A8E7303A, 00007FF8A8E7355D
status:, xrefs: 00007FF8A8E735AC
[p2p_pending_handshake] Start, xrefs: 00007FF8A8E73058

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: connection_id:$ handeshake_timeout_in_ms:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_pending_channel_handshake.cc$[p2p_pending_handshake] Start$[p2p_pending_handshake] Stop
API String ID: 3768306364-358125671
Opcode ID: a240d03a0ceb803bc7cfd05f0e4795d72cf141bf654f066619ab7c2b61a70c1f
Instruction ID: 58cfd780c97bb590bf70f2426b2d339ae82cd295a4742a01768b2a97486f172a
Opcode Fuzzy Hash: a240d03a0ceb803bc7cfd05f0e4795d72cf141bf654f066619ab7c2b61a70c1f
Instruction Fuzzy Hash: 26F1A136A0AA82D6EB60CF25E4403AD73A0FB88B98F598036DE8D57765DF3CD845C714

Function 00007FF8A8DF3715 Relevance: 18.1, APIs: 8, Strings: 2, Instructions: 633COMMON

Download Yara Rule

APIs

?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF8A8E1DFCF
memmove.VCRUNTIME140 ref: 00007FF8A8E1E0E4
memmove.VCRUNTIME140 ref: 00007FF8A8E1E12A
memmove.VCRUNTIME140 ref: 00007FF8A8E1E1A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E1E265
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E1E35F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E1E3AD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E1E3FB

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899 invalid status, xrefs: 00007FF8A8E1E574
bad conversion, xrefs: 00007FF8A8E1E408

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memmove$?out@?$codecvt@_Mbstatet@@Mbstatet@@@std@@
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899 invalid status$bad conversion
API String ID: 2830525963-1096839661
Opcode ID: 97cc563dab9eca2115ab7ae6afc1e4f0a380c1318879bfc38bfd2715f7de46ba
Instruction ID: d0de813e9ea23d38b8959203fa4dc6076354d4f174426b041120b4befe9aa3a6
Opcode Fuzzy Hash: 97cc563dab9eca2115ab7ae6afc1e4f0a380c1318879bfc38bfd2715f7de46ba
Instruction Fuzzy Hash: 1242F332B0A782D9EB44DB65D0442AC3BA6E715BD4F488231EE9D43B89DF3CD569C324

Function 00007FF8A8DF2EFF Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 280COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E831FD
GetLastError.KERNEL32 ref: 00007FF8A8E83207

Strings

:, xrefs: 00007FF8A8E83313
:, xrefs: 00007FF8A8E832D2
\, xrefs: 00007FF8A8E832A1

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: :$:$\
API String ID: 203985260-3089822572
Opcode ID: 42dad4bdcad33ec80dc0273610cde179253bcf040dc3e44a0258bf5488ce51c6
Instruction ID: 19657a22b5a851691f80a1a00db419e45d67d785d79f997e672f4001367d92a3
Opcode Fuzzy Hash: 42dad4bdcad33ec80dc0273610cde179253bcf040dc3e44a0258bf5488ce51c6
Instruction Fuzzy Hash: 38610732E0E682E2FB649B24E8553BE63A0FF847C4F800135DA5D47694DF7CE8598728

Function 00007FF8A8DF1965 Relevance: 14.5, APIs: 6, Strings: 2, Instructions: 515COMMON

Download Yara Rule

APIs

_wcsnicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8E9C831
_wcsnicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8E9C84D
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8E9C9FE
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8E9CA47

Strings

uv__malloc, xrefs: 00007FF8A8E9CB3E
%s\%.*s, xrefs: 00007FF8A8E9C8E2

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide_wcsnicmp
String ID: %s\%.*s$uv__malloc
API String ID: 1815299354-191251637
Opcode ID: f29bc0793b2ce63242b51648de7c1bd8d20a274ddcc8b07ebf15183568865e2d
Instruction ID: 260b48336f76b528306baa4e031b2fd9b65a7ef0aa73fa4fcab3bf81e8f02eec
Opcode Fuzzy Hash: f29bc0793b2ce63242b51648de7c1bd8d20a274ddcc8b07ebf15183568865e2d
Instruction Fuzzy Hash: 79A10432A0AA82D6EB24EF66A41027EB791FF40BD8F044135DE5E47B94DF7CE4558318

Function 00007FF8A8DF3977 Relevance: 13.6, APIs: 9, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8A8EBDC34
memset.VCRUNTIME140 ref: 00007FF8A8EBDC58
RtlCaptureContext.KERNEL32 ref: 00007FF8A8EBDC61
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8A8EBDC7B
RtlVirtualUnwind.KERNEL32 ref: 00007FF8A8EBDCBC
memset.VCRUNTIME140 ref: 00007FF8A8EBDCEF
IsDebuggerPresent.KERNEL32 ref: 00007FF8A8EBDD10
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8A8EBDD31
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8A8EBDD3C

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 34fdce6e33788d4fa8621c18774b1047a3f08ac061547959c1fb279142f90b32
Instruction ID: a0f8609b328b61ed6485f5da0d64225e1e9774904fb2ae0647301b3eb972198b
Opcode Fuzzy Hash: 34fdce6e33788d4fa8621c18774b1047a3f08ac061547959c1fb279142f90b32
Instruction Fuzzy Hash: 2631607260AB82D9EB649F60E8407ED7360FB84788F44403ADA4E47B94EF7CD558CB24

Function 00007FF8A8DF25D6 Relevance: 12.3, APIs: 8, Instructions: 326COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8E82B50: memset.VCRUNTIME140 ref: 00007FF8A8E82B87
Part of subcall function 00007FF8A8E82B50: VerSetConditionMask.KERNEL32 ref: 00007FF8A8E82BB6
Part of subcall function 00007FF8A8E82B50: VerSetConditionMask.KERNEL32 ref: 00007FF8A8E82BC7
Part of subcall function 00007FF8A8E82B50: VerSetConditionMask.KERNEL32 ref: 00007FF8A8E82BD8
Part of subcall function 00007FF8A8E82B50: VerSetConditionMask.KERNEL32 ref: 00007FF8A8E82BE9
Part of subcall function 00007FF8A8E82B50: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8E82BFC

GetAdaptersAddresses.IPHLPAPI ref: 00007FF8A8E83F9A
GetAdaptersAddresses.IPHLPAPI ref: 00007FF8A8E83FF6
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8E84052
GetLastError.KERNEL32 ref: 00007FF8A8E84121
GetLastError.KERNEL32 ref: 00007FF8A8E843DF

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ConditionMask$AdaptersAddressesErrorLast$ByteCharInfoMultiVerifyVersionWidememset
String ID:
API String ID: 3711825416-0
Opcode ID: 64a84e033d97b401e5a6afda2865e846cc9bbf1bd88cf733f3ff0d4ed8485c5a
Instruction ID: 84a1ce67877f59ccb4bd3083e24109d5d696da6b4c9671eee81c57c7ec29944d
Opcode Fuzzy Hash: 64a84e033d97b401e5a6afda2865e846cc9bbf1bd88cf733f3ff0d4ed8485c5a
Instruction Fuzzy Hash: 7AD1CE32A0AB82D2EB249F25A04076E77E4FB85BC4F458139EA8D47B84DF3CD860C754

Function 00007FF8A8E88C30 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0c3cbd29ff2ca9ded9c945625e337fbc630c28bd165c06fb0ac0aac35d6ad95
Instruction ID: 64cca552fc467f961b41e5ee997cc7224721d185af467690f70393ef8c8abde1
Opcode Fuzzy Hash: d0c3cbd29ff2ca9ded9c945625e337fbc630c28bd165c06fb0ac0aac35d6ad95
Instruction Fuzzy Hash: FB419172A096A2D6E7609F25E44433D33A0FB40BE4F504231DE6D46AD4DF3CD8A6CB54

Function 00007FF8A8DF17B2 Relevance: 9.1, APIs: 6, Instructions: 88pipeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8E8D070: GetCurrentProcessId.KERNEL32 ref: 00007FF8A8E8D088

CreateNamedPipeA.KERNEL32 ref: 00007FF8A8E8CF50
GetLastError.KERNEL32 ref: 00007FF8A8E8CF60
CreateNamedPipeA.KERNEL32 ref: 00007FF8A8E8CFAD
CreateIoCompletionPort.KERNEL32 ref: 00007FF8A8E8CFC9
GetLastError.KERNEL32 ref: 00007FF8A8E8CFD4
CloseHandle.KERNEL32 ref: 00007FF8A8E8CFE5

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Create$ErrorLastNamedPipe$CloseCompletionCurrentHandlePortProcess
String ID:
API String ID: 1126275632-0
Opcode ID: 34fb625084119cb7dd0c792b98f89dd06bbf87fdb5ac5c0ce2d4ea5cd2626d27
Instruction ID: 89440195ffc907e28338391f297c1a501035f188f3c835926214028aa8ddc91c
Opcode Fuzzy Hash: 34fb625084119cb7dd0c792b98f89dd06bbf87fdb5ac5c0ce2d4ea5cd2626d27
Instruction Fuzzy Hash: 4931C27261DA8196E3908B21B844A6E6690FB49BF4F504731EE6E43BE4DF3CD4928714

Function 00007FF8A8E821E0 Relevance: 9.1, APIs: 6, Instructions: 71networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8A8E8222E
WSAGetLastError.WS2_32 ref: 00007FF8A8E8223D
closesocket.WS2_32 ref: 00007FF8A8E8226D
setsockopt.WS2_32 ref: 00007FF8A8E822A2
bind.WS2_32 ref: 00007FF8A8E822B5
WSAGetLastError.WS2_32 ref: 00007FF8A8E822C0

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$bindclosesocketsetsockoptsocket
String ID:
API String ID: 4114952125-0
Opcode ID: 00e2a7ef8d8830d2a6f7bf6624c9a7dbee14a6f02ba4a0b742bd5a9a8b4bfdf3
Instruction ID: dd4da779cbb91d8ad7d80d75c508689eb827766f9723305b9c66886d1cef985a
Opcode Fuzzy Hash: 00e2a7ef8d8830d2a6f7bf6624c9a7dbee14a6f02ba4a0b742bd5a9a8b4bfdf3
Instruction Fuzzy Hash: C531BF32909686DAE7218F21E8042AD73A0FB54BF4F444732EE7D866D4DF7CD4918768

Function 00007FF8A8DF10C8 Relevance: 7.9, APIs: 5, Instructions: 434COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EA62C1
memmove.VCRUNTIME140 ref: 00007FF8A8EA63A1

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: abortmemmove
String ID:
API String ID: 196676193-0
Opcode ID: c85d50c1f7ab17fd6aa864ddfc997b452004d12e1855323114dca117188f2c5a
Instruction ID: 144e8a357a61e2ef068423e856268171491d5875bd7ffc397a1436f22cde313d
Opcode Fuzzy Hash: c85d50c1f7ab17fd6aa864ddfc997b452004d12e1855323114dca117188f2c5a
Instruction Fuzzy Hash: DEB1AD32F29B819AE700CB6199402AD73B5FB69788F415236DE8C57B19EF38E1A4C354

Function 00007FF8A8DF1BF4 Relevance: 4.6, APIs: 3, Instructions: 87networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8A8E88B3E
WSAGetLastError.WS2_32 ref: 00007FF8A8E88B4D
closesocket.WS2_32 ref: 00007FF8A8E88B9F

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLastclosesocketsocket
String ID:
API String ID: 1383248007-0
Opcode ID: 351d046f8eaa5e38b122a25fb67a4da03c5a66dc91cc94839c06e1321e81d7f7
Instruction ID: 327470dacad8dc92a911154967471c1deed46847748a10d486c096b5fb8f011a
Opcode Fuzzy Hash: 351d046f8eaa5e38b122a25fb67a4da03c5a66dc91cc94839c06e1321e81d7f7
Instruction Fuzzy Hash: 8E414AB6609B51C6DB548F29F88012D73A5F788BA0F645335EAAD837D4CF38C8A1C754

Function 00007FF8A8E97510 Relevance: 3.1, APIs: 2, Instructions: 135COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32 ref: 00007FF8A8E9756B
SetLastError.KERNEL32 ref: 00007FF8A8E97721

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ControlDeviceErrorLast
String ID:
API String ID: 2645620995-0
Opcode ID: 1e4ce1f5cff5c3c7eeba21d417e09929505be177e67ac1c1fca26e27889cada5
Instruction ID: 368c8dcbd99d02442a489fb46fb40e71472d9d61097ec0af3518fe47c9581c53
Opcode Fuzzy Hash: 1e4ce1f5cff5c3c7eeba21d417e09929505be177e67ac1c1fca26e27889cada5
Instruction Fuzzy Hash: 8F510371A0BA82D1EB604F94984463CB3A1EB807D9F508436DA58025E4EFBDD8A9C728

Function 00007FF8A8DF12F8 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF8A8EA4629
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EA4658

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: InfoSystemabort
String ID:
API String ID: 2206927444-0
Opcode ID: 718c78b8ddf5e21d59a75577e1635e912b9e95daaf22b6c182626bbf3a5fa590
Instruction ID: 5682aacc9040996dcbcbb06382fef44199b812183a3e8b9f8a7a2510af70aad4
Opcode Fuzzy Hash: 718c78b8ddf5e21d59a75577e1635e912b9e95daaf22b6c182626bbf3a5fa590
Instruction Fuzzy Hash: 67E04F30A2A84BB2E710AB20E84407963F4FB84795F900831D15D426A4EF3CA9698B28

Function 00007FF8A8DF2D7E Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

expand 32-byte k, xrefs: 00007FF8A8EA5B90, 00007FF8A8EA5CBB

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID:
String ID: expand 32-byte k
API String ID: 0-455776987
Opcode ID: 00cb78b3d0fef54aa61ad96a26cac6e4463020835e6a0e8829b88a032eb72064
Instruction ID: 4c534abbc5fc64a751714ae15d29b14a37f547d2cda468c58eb3cbbe6c2af517
Opcode Fuzzy Hash: 00cb78b3d0fef54aa61ad96a26cac6e4463020835e6a0e8829b88a032eb72064
Instruction Fuzzy Hash: 7FA1A463F15AD19EE711CFB894012FC7F70E796789F444266DF8A22B46EB388245C364

Function 00007FF8A8DF4543 Relevance: 1.4, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8EA38B9

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 6a61d9b5e5e2458b11a26563ec65ee96a3eab991207d4286b6f70875b4098470
Instruction ID: c1912a570cdf7d16ecfa7f1e7ecf69bcddfca1ff553bf0cfcfa685410c96d7b7
Opcode Fuzzy Hash: 6a61d9b5e5e2458b11a26563ec65ee96a3eab991207d4286b6f70875b4098470
Instruction Fuzzy Hash: EB51B32262A7C1A9DB25DF29D8002DD6B20FB967C4F940035EB9C1BB8ADF7DC509C324

Function 00007FF8A8DF320B Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a45151ed0ccb4314671678c4c1e047a64c3df101f599ee4cfbd2fd983a8c10e
Instruction ID: 3b0055e6b36ca6e7ac84b2bdbe791c3638dbca36ac59bf29c5e276d05a5e254c
Opcode Fuzzy Hash: 2a45151ed0ccb4314671678c4c1e047a64c3df101f599ee4cfbd2fd983a8c10e
Instruction Fuzzy Hash: 9B024C72D0EAC5D9F7928B3984502BC3B96EB257C0F846232CEDE52681CF3CA5A5C314

Function 00007FF8A8DF3CE7 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53f6a284a11967c15d7e5586cbeee1f5765af39e2c64a3951aab8bb4920fc7b
Instruction ID: 3fb62370ad8777673915a29629a29c5306f24b640aefbd1609a7f739d070f42c
Opcode Fuzzy Hash: f53f6a284a11967c15d7e5586cbeee1f5765af39e2c64a3951aab8bb4920fc7b
Instruction Fuzzy Hash: 39D16C8311A6D1DEE7359E3688623FD3FA0E322309F084556D7D90BA8BD56C8289E735

Function 00007FF8A8DF27F7 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062e2dcc1b7f07902ea647759aef25bf961f3203b139d20ff2ed1e828c742c1d
Instruction ID: 30be8e8464177ccd49cb6023026aec15a921c43e4b79e6760e80b2d5f95e177a
Opcode Fuzzy Hash: 062e2dcc1b7f07902ea647759aef25bf961f3203b139d20ff2ed1e828c742c1d
Instruction Fuzzy Hash: ECA18E72A19241DBE354EAB0D0667FBA291EB84791FD08035D91E837C6EF3CE815C764

Function 00007FF8A8DF361B Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979799f4f95b7ef74422197c11febd221044c42359cfad7652c14eaca9f518f5
Instruction ID: 8582692a0ec0cf175f04e4d32a302308cb58245e8f7b4456ad6e86681bb487eb
Opcode Fuzzy Hash: 979799f4f95b7ef74422197c11febd221044c42359cfad7652c14eaca9f518f5
Instruction Fuzzy Hash: 8341D42272A6C1AEDB12DB65D8012DD2F64F7927C9F940065EF8C1BB4ACF79C509C324

Function 00007FF8A8DF1136 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 148b5a57e7e861241a6810e5fb2a8a37d76b2e238dd3b6ec82490c9da1842d81
Instruction ID: 5bed6773f27f08762133f94a848bed7cb9d9b0354d1b7e7cd76524309aa3dd76
Opcode Fuzzy Hash: 148b5a57e7e861241a6810e5fb2a8a37d76b2e238dd3b6ec82490c9da1842d81
Instruction Fuzzy Hash: 1B4182227297C1AEDB25DF359C012DE6B21FB967C8F940065EE8C1BB4ACA79C509C324

Function 00007FF8A8DFD760 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7063f6897ab01cebb4a665be16789cbb64b25ccf6f7f70b633a88df4e686abc
Instruction ID: 6b63bbe6cbb448e17de7983150f00db32eb6d96368050f771f88949f7b43c786
Opcode Fuzzy Hash: f7063f6897ab01cebb4a665be16789cbb64b25ccf6f7f70b633a88df4e686abc
Instruction Fuzzy Hash: 35318EB3321A9947EE84C715D9A42A977D6E388BD1F80E4399FCD47789DA3CD151C310

Function 00007FF8A8DF44DF Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9034a23b2e112cab671c721310add336eed3490631dec0aa2e8ece5e2f4ff19e
Instruction ID: 094c14ecfc32ead8e37712949a04f3a1519bae3ddc03faa5419ecf0038730d95
Opcode Fuzzy Hash: 9034a23b2e112cab671c721310add336eed3490631dec0aa2e8ece5e2f4ff19e
Instruction Fuzzy Hash: BE414631B2A6664BEB808B5688503F97BA0FB15BC4F595032DE9C47348DF2CE815E764

Function 00007FF8A8DF125D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac37a586fe2967bd5f1f79a54a6473e279884bd5ff7754aa29324ed4c68fa3a0
Instruction ID: c9972728a975b1ffdba57ad6ecb482b7e56d1a6d63d03029888be55529b41591
Opcode Fuzzy Hash: ac37a586fe2967bd5f1f79a54a6473e279884bd5ff7754aa29324ed4c68fa3a0
Instruction Fuzzy Hash: 43216A7B524790DF8319DF25E64290FBBB4F348B987268115EF4A57A24C334E8A2CF44

Function 00007FF8A8DF3B2A Relevance: 42.4, APIs: 13, Strings: 11, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8EABB59
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EABB75
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EABC32
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EABC9E
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8EABD3C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EABD57
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EABDEE
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8EABE65
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EABE80
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8EABFDD
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EABFF7
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8EAC031
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8EAC0EF

Strings

[p2p_channel] AddAuthedConnection invalid status, xrefs: 00007FF8A8EABFBC
[p2p_channel] AddAuthedConnection, xrefs: 00007FF8A8EABB38
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8EABB08, 00007FF8A8EABCED, 00007FF8A8EABE17, 00007FF8A8EABF8C
[p2p_channel] AddAuthedConnection Abort, xrefs: 00007FF8A8EABD1B
connection_id:, xrefs: 00007FF8A8EABB62, 00007FF8A8EABD45, 00007FF8A8EABE6E, 00007FF8A8EABFE6
is_offer_channel:, xrefs: 00007FF8A8EABB47, 00007FF8A8EABD2A, 00007FF8A8EABE53, 00007FF8A8EABFCB
[p2p_channel] AddAuthedConnection Choice, xrefs: 00007FF8A8EABE44
remote:, xrefs: 00007FF8A8EABBB3
status:, xrefs: 00007FF8A8EAC01B
local:, xrefs: 00007FF8A8EABB99
session_id:, xrefs: 00007FF8A8EABB7E, 00007FF8A8EABD60, 00007FF8A8EABE89, 00007FF8A8EAC000

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@__invalid_parameter_noinfo_noreturn
String ID: connection_id:$ is_offer_channel:$ local:$ remote:$ session_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] AddAuthedConnection$[p2p_channel] AddAuthedConnection Abort$[p2p_channel] AddAuthedConnection Choice$[p2p_channel] AddAuthedConnection invalid status
API String ID: 4002110809-1925087408
Opcode ID: 77228b8f79d99775dcd703519dce3aedb95bd540b05ea37cc9e68b0ae68f859a
Instruction ID: 94e7af0d48ece98751c49f66ceeb29aab35067e89ded0a2890eb19d543bb4f70
Opcode Fuzzy Hash: 77228b8f79d99775dcd703519dce3aedb95bd540b05ea37cc9e68b0ae68f859a
Instruction Fuzzy Hash: DC02F332A0A682E5EF64DB25D8442FE2361FF84BD4F805136EA5D076A9DF7CD948C318

Function 00007FF8A8DF13DE Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E72656
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E726A9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E726FF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E7275C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E72806
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E72833
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E7284D
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E729E8
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E72A31
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E72B27
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E72B82

Strings

decode auth packet success, xrefs: 00007FF8A8E729F1
decode with invalid packet, xrefs: 00007FF8A8E7280F
connection_id:, xrefs: 00007FF8A8E72644, 00007FF8A8E727F4, 00007FF8A8E729D6
packet_size:, xrefs: 00007FF8A8E7283C
packet_type:, xrefs: 00007FF8A8E7281E
F:\Demo\ipc_sdk_fix\src\p2p\p2p_pending_channel_handshake.cc, xrefs: 00007FF8A8E72616, 00007FF8A8E727C2, 00007FF8A8E729AA
remote:, xrefs: 00007FF8A8E72679
status:, xrefs: 00007FF8A8E72693
from_offer:, xrefs: 00007FF8A8E72A1B
local:, xrefs: 00007FF8A8E7265F
session_id:, xrefs: 00007FF8A8E72A00
[p2p_pending_handshake] OnConnectionRead, xrefs: 00007FF8A8E72635, 00007FF8A8E727E5, 00007FF8A8E729C7

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$_invalid_parameter_noinfo_noreturn$V01@_
String ID: connection_id:$ decode auth packet success$ decode with invalid packet$ from_offer:$ local:$ packet_size:$ packet_type:$ remote:$ session_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_pending_channel_handshake.cc$[p2p_pending_handshake] OnConnectionRead
API String ID: 2015839659-3527542711
Opcode ID: 6f90d198b259e47af91590812918727632ef44b786c4cb9fc59662d870211f10
Instruction ID: ee785d03a0e57f1c935832786af3031cbec7ed7053a5058c828e2c257717dd2c
Opcode Fuzzy Hash: 6f90d198b259e47af91590812918727632ef44b786c4cb9fc59662d870211f10
Instruction Fuzzy Hash: 3302B272A06682E9EB65DF20D8403ED2761FF847D8F405135E65E07A99EF7CD988C314

Function 00007FF8A8DF27BB Relevance: 35.4, APIs: 9, Strings: 11, Instructions: 429
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E08A7D
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A8E08AB9
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E08B14
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E08B9D
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E08CEF
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E08DC7
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF8A8E08DE3
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E08E46
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E08EA7

Strings

F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_shell_service.cc, xrefs: 00007FF8A8E08975, 00007FF8A8E08AD5, 00007FF8A8E08B51, 00007FF8A8E08CA2, 00007FF8A8E08D79, 00007FF8A8E08E07
[p2p_crypto] NegotiateCryptoContextWithMultipoint, xrefs: 00007FF8A8E08AF4, 00007FF8A8E08B6E, 00007FF8A8E08CBE, 00007FF8A8E08D95
[p2p_crypto] NegotiateCryptoContextWithMultipoint failed, xrefs: 00007FF8A8E08994
crypto_id:, xrefs: 00007FF8A8E08B03, 00007FF8A8E08B8C, 00007FF8A8E08CDC, 00007FF8A8E08DB3, 00007FF8A8E08E32
[p2p_crypto] NewMultipointCryptoContext success, xrefs: 00007FF8A8E08E23
not support!, xrefs: 00007FF8A8E08B7D
encrypto_info_size:, xrefs: 00007FF8A8E08DD0
e_id, xrefs: 00007FF8A8E089EC
SetSharedSecret failed, xrefs: 00007FF8A8E08DA4
encrypto_info is empty, xrefs: 00007FF8A8E089A3
create crypto_context failed, xrefs: 00007FF8A8E08CCD

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$_invalid_parameter_noinfo_noreturn$V01@_atoi
String ID: SetSharedSecret failed$ create crypto_context failed$ crypto_id:$ encrypto_info is empty$ encrypto_info_size:$ not support!$F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_shell_service.cc$[p2p_crypto] NegotiateCryptoContextWithMultipoint$[p2p_crypto] NegotiateCryptoContextWithMultipoint failed$[p2p_crypto] NewMultipointCryptoContext success$e_id
API String ID: 1326299942-4061141174
Opcode ID: 0ba21d58439b611575056d7c0f4a2488a81ec12ec5de1d7b9349e71c1db0f5ee
Instruction ID: b5b477019c2388502100a1099ef402a754539a44f847fd7d2ca77d3b6be65f22
Opcode Fuzzy Hash: 0ba21d58439b611575056d7c0f4a2488a81ec12ec5de1d7b9349e71c1db0f5ee
Instruction Fuzzy Hash: EB12F672A0AB82E5EB20DF10E8402A937A0FF807D4F409135DA9D07B95DF7CD9A9C718

Function 00007FF8A8DF1122 Relevance: 33.7, APIs: 10, Strings: 9, Instructions: 402COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E347C2
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E348E4
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E34902
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E34921
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E349B0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E34A44
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E34B5E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E34BD4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E34CAC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E34D0D

Strings

answer_msg_type:, xrefs: 00007FF8A8E348ED
F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E34883, 00007FF8A8E34C0E
[p2p_biz_service] OnCreateAnswerSucces, xrefs: 00007FF8A8E348A2, 00007FF8A8E34C2D
answer_biz_type:, xrefs: 00007FF8A8E348CF
can not find task session_id:, xrefs: 00007FF8A8E34C3C
answer_result_code:, xrefs: 00007FF8A8E3490B
answer_candidates:, xrefs: 00007FF8A8E3492A
session_id:, xrefs: 00007FF8A8E348B1
start send answer and create answer channel , xrefs: 00007FF8A8E34948

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: answer_biz_type:$ answer_candidates:$ answer_msg_type:$ answer_result_code:$ can not find task session_id:$ session_id:$ start send answer and create answer channel $F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] OnCreateAnswerSucces
API String ID: 3484296013-1353677250
Opcode ID: ac7819aca18a55b0de50fdd4fedf35bd67f8008a9b19506efb9f0d5faaca443b
Instruction ID: 1e33087774f3523b136480e85f00cfc9f0864c0c4bb2626cdad650ccd7349a5b
Opcode Fuzzy Hash: ac7819aca18a55b0de50fdd4fedf35bd67f8008a9b19506efb9f0d5faaca443b
Instruction Fuzzy Hash: 8902C072A0A686A5EB249F25D8403ED23A0FF407D8F405236EA6D07BD9DF7CD949C318

Function 00007FF8A8DF3B34 Relevance: 31.9, APIs: 10, Strings: 8, Instructions: 406COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z.MSVCP140 ref: 00007FF8A8E2587C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E258B2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E25910

Strings

req_uri:, xrefs: 00007FF8A8E25885, 00007FF8A8E25AF1, 00007FF8A8E25C1D
[ServiceInvoker], xrefs: 00007FF8A8E2584B, 00007FF8A8E25AB7, 00007FF8A8E25BE3
F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc, xrefs: 00007FF8A8E25825, 00007FF8A8E25971, 00007FF8A8E25A97, 00007FF8A8E25BC2
SendResponse invalid response, xrefs: 00007FF8A8E25BF2
req_mid:, xrefs: 00007FF8A8E25869, 00007FF8A8E25AD5, 00007FF8A8E25C01
res_error_code:, xrefs: 00007FF8A8E258A0
SendResponse no connection, xrefs: 00007FF8A8E25AC6
SendResponse , xrefs: 00007FF8A8E2585A

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@V01@__invalid_parameter_noinfo_noreturn
String ID: SendResponse $ SendResponse invalid response$ SendResponse no connection$ req_mid:$ req_uri:$ res_error_code:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc$[ServiceInvoker]
API String ID: 3722493997-4010632931
Opcode ID: 3ac4c346643ebe950a78aeb7719035b4f126462850da5c42dd0c1cc5e0a42117
Instruction ID: bbc9135910ab41c276e5854169ca8203dce94053591c05fd231ff2966c421847
Opcode Fuzzy Hash: 3ac4c346643ebe950a78aeb7719035b4f126462850da5c42dd0c1cc5e0a42117
Instruction Fuzzy Hash: 5202CF72A06642A5EF24DB25D8413AD3361FF807E4F409236EA6D076D9EF7CE849C718

Function 00007FF8A8DF3B89 Relevance: 31.9, APIs: 10, Strings: 8, Instructions: 374COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E340C2
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E340DD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E34137
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E3419C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E34201
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E34384
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E343E5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E3444E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E344B0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E34544

Strings

error_code:, xrefs: 00007FF8A8E340CB, 00007FF8A8E34372
F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E34028, 00007FF8A8E342EC
[p2p_biz_service] OnCreateAnswerFailure can not find task, xrefs: 00007FF8A8E34309
[p2p_biz_service] OnCreateAnswerFailure, xrefs: 00007FF8A8E34047
recipient:, xrefs: 00007FF8A8E34092, 00007FF8A8E34354
port_number:, xrefs: 00007FF8A8E340B0
sender:, xrefs: 00007FF8A8E34074, 00007FF8A8E34336
session_id:, xrefs: 00007FF8A8E34056, 00007FF8A8E34318

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: error_code:$ port_number:$ recipient:$ sender:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] OnCreateAnswerFailure$[p2p_biz_service] OnCreateAnswerFailure can not find task
API String ID: 3484296013-4042274797
Opcode ID: d19042cb32c2937f4bb99ea6bd206a4756e60946c0eaef16544de278322656c6
Instruction ID: 1719528feeaa39b1545d921d4deb0a28344daa9197587cfcbab87ee8a4e8040c
Opcode Fuzzy Hash: d19042cb32c2937f4bb99ea6bd206a4756e60946c0eaef16544de278322656c6
Instruction Fuzzy Hash: 38F1C272B06682A5EB259F24D8843ED23A1FF507E8F005235DA6D0BAD9DF7CD949C314

Function 00007FF8A8E25986 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 303COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z.MSVCP140 ref: 00007FF8A8E259DD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E25A45
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z.MSVCP140 ref: 00007FF8A8E25AE8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E25B6B

Strings

req_uri:, xrefs: 00007FF8A8E25AF1, 00007FF8A8E25C1D
SendResponse discarded, xrefs: 00007FF8A8E259A0
[ServiceInvoker], xrefs: 00007FF8A8E25991, 00007FF8A8E25AB7, 00007FF8A8E25BE3
F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc, xrefs: 00007FF8A8E25A97, 00007FF8A8E25BC2
uri:, xrefs: 00007FF8A8E259AF
SendResponse invalid response, xrefs: 00007FF8A8E25BF2
mid:, xrefs: 00007FF8A8E259CA
req_mid:, xrefs: 00007FF8A8E25AD5, 00007FF8A8E25C01
SendResponse no connection, xrefs: 00007FF8A8E25AC6

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@__invalid_parameter_noinfo_noreturn
String ID: SendResponse discarded$ SendResponse invalid response$ SendResponse no connection$ mid:$ req_mid:$ req_uri:$ uri:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc$[ServiceInvoker]
API String ID: 2506420284-1362164627
Opcode ID: d111496d2a3bd2a8d38846af23b0515e7beb66b37c7c2bd199a4f0dc68e8c3c7
Instruction ID: 69107d22587ce71106fc71753cef7400354981ed08c213db9936c094af28b3f2
Opcode Fuzzy Hash: d111496d2a3bd2a8d38846af23b0515e7beb66b37c7c2bd199a4f0dc68e8c3c7
Instruction Fuzzy Hash: 2BD19F72A06642E5EF54DB25D8413AD2361FF807E4F409236DA6D076E9EF7CD889C318

Function 00007FF8A8DF1401 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 281COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E5FC2C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E5FC4B
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E5FC82
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E5FCB9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E5FD35
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E5FDB5

Strings

[p2p_channel] OnOfferHandshakeResponse, xrefs: 00007FF8A8E5FC0B
invalid auth_sesssion_id:, xrefs: 00007FF8A8E5FDBE
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E5FBDC, 00007FF8A8E5FD67
[p2p_channel] OnHandshakeResponse, xrefs: 00007FF8A8E5FD94
auth_session_id:, xrefs: 00007FF8A8E5FC8B
connection_id:, xrefs: 00007FF8A8E5FC6F
auth_from_offer:, xrefs: 00007FF8A8E5FCA5
is_offer_channel:, xrefs: 00007FF8A8E5FC1A, 00007FF8A8E5FDA3
session_id:, xrefs: 00007FF8A8E5FC54
this_session_id:, xrefs: 00007FF8A8E5FDD8
channel_status:, xrefs: 00007FF8A8E5FC35

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@_$V01@$_invalid_parameter_noinfo_noreturn
String ID: auth_from_offer:$ auth_session_id:$ channel_status:$ connection_id:$ invalid auth_sesssion_id:$ is_offer_channel:$ session_id:$ this_session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] OnHandshakeResponse$[p2p_channel] OnOfferHandshakeResponse
API String ID: 1564951274-3133288198
Opcode ID: c7b25dd570d1acffa11ccf7e28a395b9db0e6d22406bb71a5c13d1344c8dc5bd
Instruction ID: 5708ddb2b20dc09a81b211e29e0445331656faf6b78ae1e8ab43b490c9d8ca28
Opcode Fuzzy Hash: c7b25dd570d1acffa11ccf7e28a395b9db0e6d22406bb71a5c13d1344c8dc5bd
Instruction Fuzzy Hash: 4EC1E172A0AA42E1EF14DF25D4502BD23A0FB84BD0F44A036EA5E077A9DF3CD859C724

Function 00007FF8A8E81920 Relevance: 28.7, APIs: 19, Instructions: 180networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8A8E81950
WSAGetLastError.WS2_32 ref: 00007FF8A8E8195F
WSAGetLastError.WS2_32 ref: 00007FF8A8E81969
WSAGetLastError.WS2_32 ref: 00007FF8A8E81971
SetHandleInformation.KERNEL32 ref: 00007FF8A8E819DC
GetLastError.KERNEL32 ref: 00007FF8A8E819E6
GetLastError.KERNEL32 ref: 00007FF8A8E819F0
closesocket.WS2_32 ref: 00007FF8A8E81A3D

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$HandleInformationclosesocketsocket
String ID:
API String ID: 3961298275-0
Opcode ID: 2d93c6c8caec33849ff70ef91fe8a65bb39c4d1a51897e2aa19ccc8914a9fef8
Instruction ID: 926014b88350ca7bff0b9ed73c20be4e83b1426839ff2c0c95742d06493829e7
Opcode Fuzzy Hash: 2d93c6c8caec33849ff70ef91fe8a65bb39c4d1a51897e2aa19ccc8914a9fef8
Instruction Fuzzy Hash: A6815B32A0AB42DAE7509F25E44437D33A4FB44BE4F540235DB8D466A4EF3CE4A5C768

Function 00007FF8A8DF3922 Relevance: 28.5, APIs: 8, Strings: 8, Instructions: 492COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E7C1F3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E7C270

Strings

[p2p_tcp_listener] Start, xrefs: 00007FF8A8E7C1D1
listener_id:, xrefs: 00007FF8A8E7C1E0, 00007FF8A8E7C667, 00007FF8A8E7C816
reason:, xrefs: 00007FF8A8E7C69E, 00007FF8A8E7C84D
[p2p_tcp_listener] uv_listen failed, xrefs: 00007FF8A8E7C807
error:, xrefs: 00007FF8A8E7C683, 00007FF8A8E7C832
listener_address:, xrefs: 00007FF8A8E7C1FC
F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_listener.cc, xrefs: 00007FF8A8E7C1B3, 00007FF8A8E7C62F, 00007FF8A8E7C7DE
[p2p_tcp_listener] uv_tcp_bind failed, xrefs: 00007FF8A8E7C658

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_invalid_parameter_noinfo_noreturn
String ID: error:$ listener_address:$ listener_id:$ reason:$F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_listener.cc$[p2p_tcp_listener] Start$[p2p_tcp_listener] uv_listen failed$[p2p_tcp_listener] uv_tcp_bind failed
API String ID: 1288313053-3174604790
Opcode ID: c1fed3eccb0311f59ef6b2548482a026ced7da1157d9168f02d6bf9c51d93963
Instruction ID: 70d207754ac1920eae1d7a97881217e1efb9d4a65854a5460c82ba977948875c
Opcode Fuzzy Hash: c1fed3eccb0311f59ef6b2548482a026ced7da1157d9168f02d6bf9c51d93963
Instruction Fuzzy Hash: 9732D22260A6D1AAD711CF35C5402BC3BB0FB5A784F045176DB9C43B8ADF2CE6A8D724

Function 00007FF8A8DF1910 Relevance: 28.4, APIs: 7, Strings: 9, Instructions: 368COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E13515
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E1355A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E1359F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E135E4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E13629
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E136A7
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E136C5

Strings

uri, xrefs: 00007FF8A8E1336D
[p2p_answer_handshake] OnOnConnectionClosed, xrefs: 00007FF8A8E13687
type, xrefs: 00007FF8A8E1321D
ver, xrefs: 00007FF8A8E13177
connection_id:, xrefs: 00007FF8A8E13696
F:\Demo\ipc_sdk_fix\src\p2p\p2p_answer_channel_handshake.cc, xrefs: 00007FF8A8E13665
body, xrefs: 00007FF8A8E13418
status:, xrefs: 00007FF8A8E136B0
mid, xrefs: 00007FF8A8E132C4

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: connection_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_answer_channel_handshake.cc$[p2p_answer_handshake] OnOnConnectionClosed$body$mid$type$uri$ver
API String ID: 3484296013-3133240699
Opcode ID: d4e22db946ec3446beeb8fb0eeee68fea6c1a19c924ba1d8ddb44f567967602a
Instruction ID: 4c2b442eee1a9b9984df7cf3c555ae71377517da8b649e80becf16d0721f6550
Opcode Fuzzy Hash: d4e22db946ec3446beeb8fb0eeee68fea6c1a19c924ba1d8ddb44f567967602a
Instruction Fuzzy Hash: 3FF1BDB2B15A42A5FF44CB69D4402AC2372FB447E8F449231DA2D13AD9DFBCD894C324

Function 00007FF8A8DF2E2D Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 345COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E6389A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E638CF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E63927
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF8A8E639BA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E63C9E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E63CA5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E63CAC
?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF8A8E63D03

Strings

[p2p_tcp_port] ListNetwrokInterfaces, xrefs: 00007FF8A8E63999
count:, xrefs: 00007FF8A8E639A8
listener_id:, xrefs: 00007FF8A8E63888
[p2p_tcp_port] OnListernerSuccess, xrefs: 00007FF8A8E63879
address:, xrefs: 00007FF8A8E638A3
F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc, xrefs: 00007FF8A8E63858, 00007FF8A8E6396E
status:, xrefs: 00007FF8A8E638BD
list too long, xrefs: 00007FF8A8E63CFC

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@_Xlength_error@std@@
String ID: address:$ count:$ listener_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc$[p2p_tcp_port] ListNetwrokInterfaces$[p2p_tcp_port] OnListernerSuccess$list too long
API String ID: 3756726266-1627306030
Opcode ID: bbd06be4a0256b26711646811f98618259fa50c593b35cd3aad0b0c8aba49ffb
Instruction ID: 25546d29751df46396a381886dca405fc986b801981b0aa49624b54ba774b38a
Opcode Fuzzy Hash: bbd06be4a0256b26711646811f98618259fa50c593b35cd3aad0b0c8aba49ffb
Instruction Fuzzy Hash: F7E1D272A0A6C2E6EB248F25D8443AD3361FB447E8F045235EA6D07AD9DF7CE894C714

Function 00007FF8A8DF36F7 Relevance: 28.2, APIs: 6, Strings: 10, Instructions: 168COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E36EB6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E36ED5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E36F0B
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E36F42
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E36FC6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E37046

Strings

invalid auth_sesssion_id:, xrefs: 00007FF8A8E3704F
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E36E68, 00007FF8A8E36FF9
auth_session_id:, xrefs: 00007FF8A8E36F14
[p2p_channel] OnAnswerHandshakeResponse, xrefs: 00007FF8A8E36E95, 00007FF8A8E37025
connection_id:, xrefs: 00007FF8A8E36EF9
auth_from_offer:, xrefs: 00007FF8A8E36F2E
is_offer_channel:, xrefs: 00007FF8A8E36EA4, 00007FF8A8E37034
session_id:, xrefs: 00007FF8A8E36EDE
this_session_id:, xrefs: 00007FF8A8E37069
channel_status:, xrefs: 00007FF8A8E36EBF

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@_$V01@$_invalid_parameter_noinfo_noreturn
String ID: auth_from_offer:$ auth_session_id:$ channel_status:$ connection_id:$ invalid auth_sesssion_id:$ is_offer_channel:$ session_id:$ this_session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] OnAnswerHandshakeResponse
API String ID: 1564951274-1353241953
Opcode ID: 3c85c6cb239f94a7f1dc2dbd0b4acb91a1c78361ed9a467aa6512cf034f7ce88
Instruction ID: b143f194cb7ba97bd8d4143c0edef0838c2ee17aca87186ddf5f620bf0024608
Opcode Fuzzy Hash: 3c85c6cb239f94a7f1dc2dbd0b4acb91a1c78361ed9a467aa6512cf034f7ce88
Instruction Fuzzy Hash: 4661B371B0A542E0EA25EB12E8112FA2361FF847C4F405136D95D077AAEF7CE91DD728

Function 00007FF8A8DF3DAA Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 369COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z.MSVCP140 ref: 00007FF8A8E6D77C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF8A8E6D798
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z.MSVCP140 ref: 00007FF8A8E6D80D
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF8A8E6D829
memmove.VCRUNTIME140 ref: 00007FF8A8E6D92C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E6D99A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z.MSVCP140 ref: 00007FF8A8E6DA06
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF8A8E6DA22
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E6DB93

Strings

[p2p_decodec] decode with invalid packet length, xrefs: 00007FF8A8E6D759
[p2p_decodec] decode with invalid packet length exceeded, xrefs: 00007FF8A8E6D7EA
packet_length:, xrefs: 00007FF8A8E6D785, 00007FF8A8E6D816, 00007FF8A8E6DA0F
F:\Demo\ipc_sdk_fix\src\p2p\idl\p2p_packet_decodec.cc, xrefs: 00007FF8A8E6D73A, 00007FF8A8E6D7CB, 00007FF8A8E6D9C6
packet_type:, xrefs: 00007FF8A8E6D768, 00007FF8A8E6D7F9, 00007FF8A8E6D9F2
[p2p_decodec] packet decrypt failed, xrefs: 00007FF8A8E6D9E3

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@$_invalid_parameter_noinfo_noreturn$memmove
String ID: packet_length:$ packet_type:$F:\Demo\ipc_sdk_fix\src\p2p\idl\p2p_packet_decodec.cc$[p2p_decodec] decode with invalid packet length$[p2p_decodec] decode with invalid packet length exceeded$[p2p_decodec] packet decrypt failed
API String ID: 1167396416-874617133
Opcode ID: 9cb64b50f7d2c0f388172f6e69f9522e4568135f72fcdb33f816da21e93d9582
Instruction ID: ca3fe2b728090c87b867099b3356ccf102895156aaa372d8b89614b85b1adfdb
Opcode Fuzzy Hash: 9cb64b50f7d2c0f388172f6e69f9522e4568135f72fcdb33f816da21e93d9582
Instruction Fuzzy Hash: BAF1FE32B0AA82E5EB149B25D8043BC2761FF807E4F904235EA6D476D9DF7DE855C328

Function 00007FF8A8DF2F59 Relevance: 26.6, APIs: 7, Strings: 8, Instructions: 333COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E35CD3
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E35DEE
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E35E0C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E35E9A

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E35D8E, 00007FF8A8E3601D
[p2p_biz_service] OnCreateOfferSucces, xrefs: 00007FF8A8E35DAC, 00007FF8A8E3603B
offer_msg_type:, xrefs: 00007FF8A8E35DF7
offer_biz_type:, xrefs: 00007FF8A8E35DD9
offer_candidates:, xrefs: 00007FF8A8E35E15
start send offer, xrefs: 00007FF8A8E35E33
can not find task session_id:, xrefs: 00007FF8A8E3604A
session_id:, xrefs: 00007FF8A8E35DBB

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_invalid_parameter_noinfo_noreturn
String ID: can not find task session_id:$ offer_biz_type:$ offer_candidates:$ offer_msg_type:$ session_id:$ start send offer$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] OnCreateOfferSucces
API String ID: 1288313053-3366964473
Opcode ID: cdc49e3c334f5ae82492034a9e9bde6a80e7e0d28d33cef1927723fa2a5fa5f9
Instruction ID: 626c73e1d14affbf97fc047cb490347aaa9bb5df7dfb3bc6b7f5c46e807dea01
Opcode Fuzzy Hash: cdc49e3c334f5ae82492034a9e9bde6a80e7e0d28d33cef1927723fa2a5fa5f9
Instruction Fuzzy Hash: BFE1C272A0A682A6EB249F24D8443ED3360FB457D8F404236E6AD07BD9DF7CD949C718

Function 00007FF8A8DF14A1 Relevance: 25.0, APIs: 6, Strings: 8, Instructions: 472COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E5F26C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E5F2A6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E5F43A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E5F456
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E5F5F3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E5F5FA

Strings

candidate:, xrefs: 00007FF8A8E5F47A
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E5F21B, 00007FF8A8E5F3EA
connection_id:, xrefs: 00007FF8A8E5F427
[p2p_channel] DoAnswerConnectIfNeed start porting, xrefs: 00007FF8A8E5F418
is_offer_channel:, xrefs: 00007FF8A8E5F25A, 00007FF8A8E5F443
[p2p_channel] DoAnswerConnectIfNeed, xrefs: 00007FF8A8E5F24B
session_id:, xrefs: 00007FF8A8E5F275, 00007FF8A8E5F45F
channel_status:, xrefs: 00007FF8A8E5F290

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@V01@__invalid_parameter_noinfo_noreturn
String ID: candidate:$ channel_status:$ connection_id:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] DoAnswerConnectIfNeed$[p2p_channel] DoAnswerConnectIfNeed start porting
API String ID: 3722493997-3796700357
Opcode ID: 32faff5102a49910cf453980bba87b91b5dd7722bbc7fe9de7f62e30c437d4b3
Instruction ID: 0762def133bd7bf49dfef5fe6ba3434cb430607c38ec1ef596546ee118df1c69
Opcode Fuzzy Hash: 32faff5102a49910cf453980bba87b91b5dd7722bbc7fe9de7f62e30c437d4b3
Instruction Fuzzy Hash: FB22BF72A0AB85E5EB14CF29D4402AC3BA1FB84BC8F549036DB9D073A5DF78D9A4C354

Function 00007FF8A8DF19E2 Relevance: 24.8, APIs: 8, Strings: 6, Instructions: 281COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E59778
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E59793
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E59825
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E59880
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E59921
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E59983
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E59A2F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E59A8A

Strings

F:\Demo\ipc_sdk_fix\src\p2p\net\connection_manager.cc, xrefs: 00007FF8A8E59738
result_code:, xrefs: 00007FF8A8E59781
connection_id:, xrefs: 00007FF8A8E59766
[p2p_connection_manager] OnConnectResult, xrefs: 00007FF8A8E59757
remote:, xrefs: 00007FF8A8E597B6
local:, xrefs: 00007FF8A8E5979C

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: connection_id:$ local:$ remote:$ result_code:$F:\Demo\ipc_sdk_fix\src\p2p\net\connection_manager.cc$[p2p_connection_manager] OnConnectResult
API String ID: 3484296013-3587437943
Opcode ID: 20f4e70451b37b935ba8c6223d8bacabccea1d1525163d84ab51640da1fb7a44
Instruction ID: 9eccb8aeab8c9a992c6643757041b39f50197f242b3b11e1cdc1e1cf6766d7a6
Opcode Fuzzy Hash: 20f4e70451b37b935ba8c6223d8bacabccea1d1525163d84ab51640da1fb7a44
Instruction Fuzzy Hash: 30B1B4B2B16686A5EF18AB25E8443ED2351FF85BE8F005231EA6D076D9DF7CD884C314

Function 00007FF8A8DF15DC Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 186synchronizationCOMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32 ref: 00007FF8A8E87216
WaitForSingleObject.KERNEL32 ref: 00007FF8A8E87241
LeaveCriticalSection.KERNEL32 ref: 00007FF8A8E8726C

Strings

WaitForSingleObject, xrefs: 00007FF8A8E8728C, 00007FF8A8E872F2, 00007FF8A8E87334
ReleaseSemaphore, xrefs: 00007FF8A8E87376

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait
String ID: ReleaseSemaphore$WaitForSingleObject
API String ID: 501323975-4124537571
Opcode ID: 7e89016c9d37bf9316090b470ff27d9c6df6ae988d332e5e44aaecbec2ad38fc
Instruction ID: 282d68d0f33f98a6b517b3ca9d7c250436b6e25d3cbbcc84baef92e121dad12d
Opcode Fuzzy Hash: 7e89016c9d37bf9316090b470ff27d9c6df6ae988d332e5e44aaecbec2ad38fc
Instruction Fuzzy Hash: FB41A671F1E903E2EB445B35EC8407D22A1FF94BD0F944532D51E462A4EF3CE8A68724

Function 00007FF8A8DF40B1 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 154COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E798DE
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E798FA
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E79916
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E79932
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E7994E
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E7996D

Strings

connected:, xrefs: 00007FF8A8E798E7
shutdowning:, xrefs: 00007FF8A8E79957
[p2p_tcp_client] OnKeepAliveTimer, xrefs: 00007FF8A8E798BD
F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_client.cc, xrefs: 00007FF8A8E7989B
closed:, xrefs: 00007FF8A8E7991F
connection_id:, xrefs: 00007FF8A8E798CC
closing:, xrefs: 00007FF8A8E79903
disconnected:, xrefs: 00007FF8A8E7993B

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@_$V01@
String ID: closed:$ closing:$ connected:$ connection_id:$ disconnected:$ shutdowning:$F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_client.cc$[p2p_tcp_client] OnKeepAliveTimer
API String ID: 1078673242-3100694170
Opcode ID: a35359979a06c9ef47fdea55d7234565fe27945ebe683f529c7cf4879555a44d
Instruction ID: ca667ec619461fb7d542fc8fb63e29f22bbd5d586d52bb7453fb8766d19a97e9
Opcode Fuzzy Hash: a35359979a06c9ef47fdea55d7234565fe27945ebe683f529c7cf4879555a44d
Instruction Fuzzy Hash: 00719232A0AA42EAEB61AF21D8103B837A0FF85BD4F149136CA5D07395DF7CD955C728

Function 00007FF8A8DF1F41 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 289COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z.MSVCP140 ref: 00007FF8A8E1B012
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E1B076
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z.MSVCP140 ref: 00007FF8A8E1B148
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E1B1A6

Strings

SendRequest discarded, xrefs: 00007FF8A8E1B108
F:\Demo\ipc_sdk_fix\src\ipc_core\service_host.cc, xrefs: 00007FF8A8E1AFA1, 00007FF8A8E1B0D9
[ServiceHost], xrefs: 00007FF8A8E1AFC3, 00007FF8A8E1B0F9
uri:, xrefs: 00007FF8A8E1AFE1, 00007FF8A8E1B117
mid:, xrefs: 00007FF8A8E1AFFF, 00007FF8A8E1B135
SendRequest, xrefs: 00007FF8A8E1AFD2
", xrefs: 00007FF8A8E1AF90

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@__invalid_parameter_noinfo_noreturn
String ID: SendRequest$ SendRequest discarded$ mid:$ uri:$"$F:\Demo\ipc_sdk_fix\src\ipc_core\service_host.cc$[ServiceHost]
API String ID: 2506420284-3153958601
Opcode ID: 56053da5da8213ef598afc0fd01a32dd3fe5a94be0df6dc455acfa18e09ad3e8
Instruction ID: fd7f4e2918c99190188edb7b0976fb6a7eddedcdc2e2f2815cc2ef2c4eaf7df9
Opcode Fuzzy Hash: 56053da5da8213ef598afc0fd01a32dd3fe5a94be0df6dc455acfa18e09ad3e8
Instruction Fuzzy Hash: 89C1C172A06682E5EB60DF25D4403AD2361FF85BE4F408235E66D076D9DF7CD899C324

Function 00007FF8A8DF359E Relevance: 23.0, APIs: 4, Strings: 9, Instructions: 238COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E09B81
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E09BE3
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E09BFE
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E09C7C

Strings

[p2p_crypto] NewCryptoContext create crypto_context failed, xrefs: 00007FF8A8E09C5B
F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_shell_service.cc, xrefs: 00007FF8A8E099DF, 00007FF8A8E09B43, 00007FF8A8E09BA5, 00007FF8A8E09C3E
selected_crypto_id:, xrefs: 00007FF8A8E09B6F, 00007FF8A8E09BEC, 00007FF8A8E09C6A
crypto_id:, xrefs: 00007FF8A8E09BD1
[p2p_crypto] processor, xrefs: 00007FF8A8E099FD
[p2p_crypto] NewCryptoContext success, xrefs: 00007FF8A8E09BC2
[p2p_crypto] NewCryptoContext InitKeyPair failed, xrefs: 00007FF8A8E09B60
instructions set, xrefs: 00007FF8A8E09A1B
without aes_ni, xrefs: 00007FF8A8E09A0C

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: crypto_id:$ instructions set$ selected_crypto_id:$ without aes_ni$F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_shell_service.cc$[p2p_crypto] NewCryptoContext InitKeyPair failed$[p2p_crypto] NewCryptoContext create crypto_context failed$[p2p_crypto] NewCryptoContext success$[p2p_crypto] processor
API String ID: 3768306364-1549088558
Opcode ID: 811754a687f545fafc47c7d8f5d21dfa257d8f6f082e36b06bc363af4741cc19
Instruction ID: dcf52da54a4642690db7bc89bcc7a31acbbb27c3a7b502242f024bfd1c44d7c8
Opcode Fuzzy Hash: 811754a687f545fafc47c7d8f5d21dfa257d8f6f082e36b06bc363af4741cc19
Instruction Fuzzy Hash: D5A1D132A0A642E1EA20AF11E8402B937F0FF907D4F559536DA9E07295DF7CEC59C728

Function 00007FF8A8DF2FF9 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 234COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E3730C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E37327
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E3737B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E373D1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E3742A

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E37278
[p2p_biz_service] OnOfferReject, xrefs: 00007FF8A8E37297
c, xrefs: 00007FF8A8E37251
recipient:, xrefs: 00007FF8A8E372DC
reason_code:, xrefs: 00007FF8A8E37315
answer_result_code:, xrefs: 00007FF8A8E372FA
sender:, xrefs: 00007FF8A8E372C1
session_id:, xrefs: 00007FF8A8E372A6

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: answer_result_code:$ reason_code:$ recipient:$ sender:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] OnOfferReject$c
API String ID: 3484296013-1205808524
Opcode ID: f84f644a170e810f2bfd1a6bf24d3d947dae32cce6154735b5392efdd13b2727
Instruction ID: 036a7e139a9d3a763e6731a600442deef4bcf320f475e6d32509eff4274e9ec1
Opcode Fuzzy Hash: f84f644a170e810f2bfd1a6bf24d3d947dae32cce6154735b5392efdd13b2727
Instruction Fuzzy Hash: AAA18E72A16A82A5EB249F24D8403ED3361FF407D4F405235EA6D07AE9EF7CD949C314

Function 00007FF8A8DF34E0 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 231networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8A8E9E116
socket.WS2_32 ref: 00007FF8A8E9E17B
getsockopt.WS2_32 ref: 00007FF8A8E9E1AF
closesocket.WS2_32 ref: 00007FF8A8E9E1D4
WSAGetLastError.WS2_32 ref: 00007FF8A8E9E202
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E9E215
WSAGetLastError.WS2_32 ref: 00007FF8A8E9E22B
WSAGetLastError.WS2_32 ref: 00007FF8A8E9E240
WSASetLastError.WS2_32 ref: 00007FF8A8E9E399

Part of subcall function 00007FF8A8DF1645: htons.WS2_32 ref: 00007FF8A8E7F19D
Part of subcall function 00007FF8A8DF1645: memmove.VCRUNTIME140 ref: 00007FF8A8E7F1DE
Part of subcall function 00007FF8A8DF1645: atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A8E7F1F1

Strings

WSAStartup, xrefs: 00007FF8A8E9E21C
getsockopt, xrefs: 00007FF8A8E9E233
socket, xrefs: 00007FF8A8E9E248
0.0.0.0, xrefs: 00007FF8A8E9E12D

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$Startupabortatoiclosesocketgetsockopthtonsmemmovesocket
String ID: 0.0.0.0$WSAStartup$getsockopt$socket
API String ID: 3321236552-1631034825
Opcode ID: 7434cdc1a48eaf7934b32be717ea4f154a2cb5307c264e257630bc011391277e
Instruction ID: 1a68e3734f253f187a80c1f7a0f86eb60a2d30662c35e0768a2bbb0ed15fbbe1
Opcode Fuzzy Hash: 7434cdc1a48eaf7934b32be717ea4f154a2cb5307c264e257630bc011391277e
Instruction Fuzzy Hash: 9661AE31A19B83E6EB209B25E84436AB3A1FF847D0F544135DB9D43794DFBCE8158B28

Function 00007FF8A8DF1FC3 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 193COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E39A58
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E39A8E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E39B1A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E39B72
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E39BC3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E39C1E

Strings

[p2p_channel] OnConnectSuccess, xrefs: 00007FF8A8E39A37
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E39A07
connection_id:, xrefs: 00007FF8A8E39A7C
is_offer_channel:, xrefs: 00007FF8A8E39A46
remote:, xrefs: 00007FF8A8E39AB1
local:, xrefs: 00007FF8A8E39A97
session_id:, xrefs: 00007FF8A8E39A61

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@V01@_
String ID: connection_id:$ is_offer_channel:$ local:$ remote:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] OnConnectSuccess
API String ID: 2390122597-2000316983
Opcode ID: ba219cf84ac9eaa6bb50337223e1d161f6513b64c3263c70b536112d0f6673a3
Instruction ID: 103fa4aa6afecaedebc1309eac0b0aae6d482a294d55f909b424ccb0dba9443f
Opcode Fuzzy Hash: ba219cf84ac9eaa6bb50337223e1d161f6513b64c3263c70b536112d0f6673a3
Instruction Fuzzy Hash: 2681D671A0A682B4EF24AB25D8443ED2351FF457E8F405231EA6D07AE9DF7CD948C318

Function 00007FF8A8DF160E Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 168COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E24EF2
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E24F2C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E24F46
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E25082
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E250BC
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E250D6

Strings

[p2p_channel] EraseConnecitonId Connect closed, xrefs: 00007FF8A8E25061
[p2p_channel] EraseConnecitonId, xrefs: 00007FF8A8E24ED1
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E24E9F, 00007FF8A8E25030
connection_id:, xrefs: 00007FF8A8E24F35, 00007FF8A8E250C5
is_offer_channel:, xrefs: 00007FF8A8E24EE0, 00007FF8A8E25070
session_id:, xrefs: 00007FF8A8E24EFB, 00007FF8A8E2508B
channel_status:, xrefs: 00007FF8A8E24F16, 00007FF8A8E250A6

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@_
String ID: channel_status:$ connection_id:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] EraseConnecitonId$[p2p_channel] EraseConnecitonId Connect closed
API String ID: 102757981-2350571781
Opcode ID: 84081f0bf10ae3279a60ceacb3a9c550006372f862771cebfb57b7da199a3cac
Instruction ID: cffbd7a463668e5686505503f46be1cf681431dca253b6907d839395c7fff2c6
Opcode Fuzzy Hash: 84081f0bf10ae3279a60ceacb3a9c550006372f862771cebfb57b7da199a3cac
Instruction Fuzzy Hash: 8B71BE71A0A642E1EF55DB11D8443B927A1FB84BC8F40503AD95E073A6EF7CD959C328

Function 00007FF8A8DF243C Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 125COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E19D5F
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E19D95
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E19DB4
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E19DEA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E19E4B

Strings

error_code:, xrefs: 00007FF8A8E19DD7
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E19D0B
connection_id:, xrefs: 00007FF8A8E19D83
address:, xrefs: 00007FF8A8E19DBD
is_offer_channel:, xrefs: 00007FF8A8E19D4D
session_id:, xrefs: 00007FF8A8E19D68
[p2p_channel] OnConnectFailure, xrefs: 00007FF8A8E19D3E
channel_status:, xrefs: 00007FF8A8E19D9E

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@__invalid_parameter_noinfo_noreturn
String ID: address:$ channel_status:$ connection_id:$ error_code:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] OnConnectFailure
API String ID: 4002110809-4060888424
Opcode ID: be7ed180029159055981427a7bcc856f944e607ba77e48c8d492d9ce97a839f7
Instruction ID: 196e09ff1ccb99cb05e794b4e746e1524d3e2e4a74743a06d9c9b0e0be2d5ed2
Opcode Fuzzy Hash: be7ed180029159055981427a7bcc856f944e607ba77e48c8d492d9ce97a839f7
Instruction Fuzzy Hash: 1E51F331B0A542E1EA25EB11E8043BA23A0FF88BD4F405135ED6D07799DF7CD959D718

Function 00007FF8A8DF2E64 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 301COMMON

Download Yara Rule

APIs

_Mtx_lock.MSVCP140 ref: 00007FF8A8E58039
?_Throw_C_error@std@@YAXH@Z.MSVCP140 ref: 00007FF8A8E580C9
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E581F9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E5828B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E582E6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E58391
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E583EC

Strings

[p2p_connection_manager] CloseConnection, xrefs: 00007FF8A8E581D8
F:\Demo\ipc_sdk_fix\src\p2p\net\connection_manager.cc, xrefs: 00007FF8A8E581B9
connection_id:, xrefs: 00007FF8A8E581E7
remote:, xrefs: 00007FF8A8E5821C
local:, xrefs: 00007FF8A8E58202

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@C_error@std@@D@std@@@std@@Mtx_lockThrow_U?$char_traits@V01@
String ID: connection_id:$ local:$ remote:$F:\Demo\ipc_sdk_fix\src\p2p\net\connection_manager.cc$[p2p_connection_manager] CloseConnection
API String ID: 3109526221-3043054649
Opcode ID: 747679a36df6926332554393741109563a9db68291b8e93d7a41b99bde5b60d2
Instruction ID: 1af1fca36538ddfef38c89b725887dda6a09ec72b0f7698ab05f18003f70634c
Opcode Fuzzy Hash: 747679a36df6926332554393741109563a9db68291b8e93d7a41b99bde5b60d2
Instruction Fuzzy Hash: 54B1F472A0A6C2A5EF289B25D4403BD2751FB85BE8F005231DA6D07BD9DF7CD894C318

Function 00007FF8A8DF37BA Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 264COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E4EC8A

Strings

biz_type:, xrefs: 00007FF8A8E4EC75
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc, xrefs: 00007FF8A8E4EC2C
c, xrefs: 00007FF8A8E4EBD8
[p2p_channel_service] CreateOfferChannel, xrefs: 00007FF8A8E4EC4B
recipient:, xrefs: 00007FF8A8E4ECAE
sender:, xrefs: 00007FF8A8E4EC93
session_id:, xrefs: 00007FF8A8E4EC5A

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: biz_type:$ recipient:$ sender:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc$[p2p_channel_service] CreateOfferChannel$c
API String ID: 3768306364-1541304771
Opcode ID: 1e86e159f3bd5d58351ab809dced6a1412629c4ffe80f22aca0c26e353275c68
Instruction ID: 4b570cdbc57112a55bd1556bdd6d0647a74326a712d16e8d2ebbda405dab5cac
Opcode Fuzzy Hash: 1e86e159f3bd5d58351ab809dced6a1412629c4ffe80f22aca0c26e353275c68
Instruction Fuzzy Hash: 4BB19072A06682A6EB24EF25D8403AC2361FB447E8F444236DA6D07BD9DF7DE855C318

Function 00007FF8A8DF294B Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 261COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E4DA3A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E4DACF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E4DB42
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E4DB9B

Strings

biz_type:, xrefs: 00007FF8A8E4DA25
[p2p_channel_service] CreateAnswerChannel, xrefs: 00007FF8A8E4D9FB
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc, xrefs: 00007FF8A8E4D9DC
recipient:, xrefs: 00007FF8A8E4DA5E
c, xrefs: 00007FF8A8E4D988
sender:, xrefs: 00007FF8A8E4DA43
session_id:, xrefs: 00007FF8A8E4DA0A

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: biz_type:$ recipient:$ sender:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc$[p2p_channel_service] CreateAnswerChannel$c
API String ID: 3484296013-2979579438
Opcode ID: 273e86e0bb18666f00321b4bfc81af4696347661d1825aa848025339b28b6e36
Instruction ID: 13c7680355f88410c1073c2397a28697a67e9aa0a64ac222d41eb9d2231b8b64
Opcode Fuzzy Hash: 273e86e0bb18666f00321b4bfc81af4696347661d1825aa848025339b28b6e36
Instruction Fuzzy Hash: DCB1D172B0AA82A6EB24DF25D8443AD2761FB447E8F004236DA6D47BD9DF7CD849C314

Function 00007FF8A8DF2A59 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 230COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E33447
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E334E5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E33552
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E336BB

Strings

error_code:, xrefs: 00007FF8A8E33435
F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E333E9, 00007FF8A8E335DF
offer:, xrefs: 00007FF8A8E33450
answer:, xrefs: 00007FF8A8E3346E
[p2p_biz_service] OnCreateAnswerChannelFailure, xrefs: 00007FF8A8E33408, 00007FF8A8E335FB
can not find task session_id:, xrefs: 00007FF8A8E3360A
s, xrefs: 00007FF8A8E333D7
session_id:, xrefs: 00007FF8A8E33417

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: answer:$ can not find task session_id:$ error_code:$ offer:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] OnCreateAnswerChannelFailure$s
API String ID: 3484296013-1715764536
Opcode ID: 0519d3c96eba0a516f893cef604793bb22d833391145bb952f2b081e6e2c3c09
Instruction ID: 91a0112f2f265f5572dbff72c54f676868e5ad9a6949c99a3e17c0afe266ae47
Opcode Fuzzy Hash: 0519d3c96eba0a516f893cef604793bb22d833391145bb952f2b081e6e2c3c09
Instruction Fuzzy Hash: 42A1C272B0A682A5EB21DF25D8403EC2320FB847D4F405236EA6D07AE9DF7CD949C714

Function 00007FF8A8E10D60 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8DF3F2B: memmove.VCRUNTIME140 ref: 00007FF8A8E1525E
Part of subcall function 00007FF8A8DF3F2B: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E152F2

Part of subcall function 00007FF8A8DF1235: memmove.VCRUNTIME140 ref: 00007FF8A8E14DDE
Part of subcall function 00007FF8A8DF1235: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E14E72

Part of subcall function 00007FF8A8DF44A3: memmove.VCRUNTIME140 ref: 00007FF8A8E14FF8

Part of subcall function 00007FF8A8DF2A5E: memmove.VCRUNTIME140 ref: 00007FF8A8E1547E
Part of subcall function 00007FF8A8DF2A5E: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E15502

Part of subcall function 00007FF8A8DF27E8: memmove.VCRUNTIME140 ref: 00007FF8A8E1568E
Part of subcall function 00007FF8A8DF27E8: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E15712

Part of subcall function 00007FF8A8DF2BE9: memmove.VCRUNTIME140 ref: 00007FF8A8E1589E
Part of subcall function 00007FF8A8DF2BE9: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E15932

Part of subcall function 00007FF8A8DF397C: memmove.VCRUNTIME140 ref: 00007FF8A8E15ABE
Part of subcall function 00007FF8A8DF397C: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E15B42

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8E10F92
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8E1100D
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8E1101B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8E11068
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8E11094

Strings

uri, xrefs: 00007FF8A8E10E49
type, xrefs: 00007FF8A8E10DEF
ver, xrefs: 00007FF8A8E10DC6
error_msg, xrefs: 00007FF8A8E10ED0
error_code, xrefs: 00007FF8A8E10EA3
body, xrefs: 00007FF8A8E10E76
mid, xrefs: 00007FF8A8E10E1C

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: memmove$_invalid_parameter_noinfo_noreturn$free$realloc
String ID: body$error_code$error_msg$mid$type$uri$ver
API String ID: 3798712100-2949913962
Opcode ID: 2e133679f809e4f66b016e08ad43ed8153a8ef90e45e883ec1f533d7e05cd908
Instruction ID: f11571851ea791410ba3549c32e60759c50061e3239d3118e8d7273e5c5a1995
Opcode Fuzzy Hash: 2e133679f809e4f66b016e08ad43ed8153a8ef90e45e883ec1f533d7e05cd908
Instruction Fuzzy Hash: 78B15C32A1AF41E5EB50CF20E4801AD73A5FB88798F445236EA8D13B68EF38D259C754

Function 00007FF8A8DF41A6 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 189COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E09E9E
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E09F8B
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E0A031
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E0A0D5

Strings

[p2p_crypto] NewMultipointCryptoContext not support, xrefs: 00007FF8A8E09E7E
F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_shell_service.cc, xrefs: 00007FF8A8E09E5F, 00007FF8A8E09F3C, 00007FF8A8E09FE2, 00007FF8A8E0A095
crypto_id:, xrefs: 00007FF8A8E09E8D, 00007FF8A8E09F79, 00007FF8A8E0A01F, 00007FF8A8E0A0C3
[p2p_crypto] NewMultipointCryptoContext success, xrefs: 00007FF8A8E0A0B4
InitKeyPairAndSharedSecret failed!, xrefs: 00007FF8A8E0A010
[p2p_crypto] NewMultipointCryptoContext , xrefs: 00007FF8A8E0A001
[p2p_crypto] NewMultipointCryptoContext, xrefs: 00007FF8A8E09F5B
create crypto_context failed, xrefs: 00007FF8A8E09F6A

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: InitKeyPairAndSharedSecret failed!$ create crypto_context failed$ crypto_id:$F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_shell_service.cc$[p2p_crypto] NewMultipointCryptoContext$[p2p_crypto] NewMultipointCryptoContext $[p2p_crypto] NewMultipointCryptoContext not support$[p2p_crypto] NewMultipointCryptoContext success
API String ID: 3768306364-2762816721
Opcode ID: 6425ef47f56e4ebe394804827205f1bd849f4e7e37b35b02e3b4e0aeb5e6ed65
Instruction ID: 599f8a75c99bc09eb86abcf54629484881dff75e7114791e3b7217fa98f7c598
Opcode Fuzzy Hash: 6425ef47f56e4ebe394804827205f1bd849f4e7e37b35b02e3b4e0aeb5e6ed65
Instruction Fuzzy Hash: 4781D332A0A642E1EB11EF11E4402B937A0FF907C4F449035EA9E176A5DF7CED69C768

Function 00007FF8A8DF40E3 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169fileCOMMON

Download Yara Rule

APIs

_umask.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF8A8E96F31
_umask.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF8A8E96F3B
CreateFileW.KERNEL32 ref: 00007FF8A8E9709A
GetLastError.KERNEL32 ref: 00007FF8A8E970A9
GetLastError.KERNEL32 ref: 00007FF8A8E970DB
_open_osfhandle.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A8E97101
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E9710B
GetLastError.KERNEL32 ref: 00007FF8A8E97129
GetLastError.KERNEL32 ref: 00007FF8A8E97133
CloseHandle.KERNEL32 ref: 00007FF8A8E97163
__doserrno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E9717A

Strings

W, xrefs: 00007FF8A8E97052

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$_umask$CloseCreateFileHandle__doserrno_errno_open_osfhandle
String ID: W
API String ID: 434331954-655174618
Opcode ID: 81cc73babcd7bdfcdd2c49d6f5a902e48048fa6de9620787a4e374924e6625c2
Instruction ID: 83330b5cf962238a79791e131d21f2f1532d504989aa82c834e2e6613f3570a9
Opcode Fuzzy Hash: 81cc73babcd7bdfcdd2c49d6f5a902e48048fa6de9620787a4e374924e6625c2
Instruction Fuzzy Hash: B961E332F0EE42D2F7644FA5A80037DB291EB817E0F184236C56E863E4DF7DA8549728

Function 00007FF8A8DF43A4 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8DF3ABC: CryptQueryObject.CRYPT32 ref: 00007FF8A8E0A5A9
Part of subcall function 00007FF8A8DF3ABC: GetLastError.KERNEL32 ref: 00007FF8A8E0A5E5
Part of subcall function 00007FF8A8DF3ABC: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF8A8E0A611
Part of subcall function 00007FF8A8DF3ABC: CryptMsgClose.CRYPT32 ref: 00007FF8A8E0A8FF
Part of subcall function 00007FF8A8DF3ABC: CertCloseStore.CRYPT32 ref: 00007FF8A8E0A910

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF8A8E0AC76
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF8A8E0AD10
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF8A8E0AD2B
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF8A8E0AD46
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0AD96
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0ADEA

Strings

[pe_verifier] IsFileSignedByAlibaba sign_info, xrefs: 00007FF8A8E0ACEF
issuer_name:, xrefs: 00007FF8A8E0AD19
pe_path:, xrefs: 00007FF8A8E0AC64, 00007FF8A8E0ACFE
subject_name:, xrefs: 00007FF8A8E0AD34
[pe_verifier] IsFileSignedByAlibaba get sign_info failed, xrefs: 00007FF8A8E0AC55
F:\Demo\ipc_sdk_fix\src\ipc_core\pe_verifier.cc, xrefs: 00007FF8A8E0AC2C, 00007FF8A8E0ACAA

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@$CloseCrypt_invalid_parameter_noinfo_noreturn$CertErrorLastObjectQueryStore
String ID: issuer_name:$ pe_path:$ subject_name:$F:\Demo\ipc_sdk_fix\src\ipc_core\pe_verifier.cc$[pe_verifier] IsFileSignedByAlibaba get sign_info failed$[pe_verifier] IsFileSignedByAlibaba sign_info
API String ID: 1932818468-240090530
Opcode ID: 0122b29e6304cd481cac0ab987ec9dff400d90a1f9b6e37dd62bd58238ef6e74
Instruction ID: 39934268522ef856130615457058a1896c26e513b36e12ae6320493b3c09279c
Opcode Fuzzy Hash: 0122b29e6304cd481cac0ab987ec9dff400d90a1f9b6e37dd62bd58238ef6e74
Instruction Fuzzy Hash: DB71F172A0A646E6EB14DF20E8443AD33A1FB447DCF401535EA5D07AA9DF7CE899C318

Function 00007FF8A8E8B3A0 Relevance: 21.1, APIs: 14, Instructions: 112pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32 ref: 00007FF8A8E8B3F2
GetLastError.KERNEL32 ref: 00007FF8A8E8B402
GetLastError.KERNEL32 ref: 00007FF8A8E8B40C
GetLastError.KERNEL32 ref: 00007FF8A8E8B414
CloseHandle.KERNEL32 ref: 00007FF8A8E8B47B
GetLastError.KERNEL32 ref: 00007FF8A8E8B489
GetLastError.KERNEL32 ref: 00007FF8A8E8B493
ConnectNamedPipe.KERNEL32 ref: 00007FF8A8E8B4B3
GetLastError.KERNEL32 ref: 00007FF8A8E8B4BD
GetLastError.KERNEL32 ref: 00007FF8A8E8B4CA
CloseHandle.KERNEL32 ref: 00007FF8A8E8B4E0
GetLastError.KERNEL32 ref: 00007FF8A8E8B4EE
GetLastError.KERNEL32 ref: 00007FF8A8E8B4F8
GetLastError.KERNEL32 ref: 00007FF8A8E8B500

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$CloseHandleNamedPipe$ConnectCreate
String ID:
API String ID: 3093179469-0
Opcode ID: d79ec41a4d5efe1647ba207ad4c38ba4f8ce7a782c8738ce6df24d3694967b34
Instruction ID: 91895e3d383d63644089dd5583935b86958b28c8038cdaa55e8826954bcbda46
Opcode Fuzzy Hash: d79ec41a4d5efe1647ba207ad4c38ba4f8ce7a782c8738ce6df24d3694967b34
Instruction Fuzzy Hash: 33511A32A0AF42D6E7509F25E84462D33A4FB85FA4F540235CA6D46BE4EF3DE4A1C264

Function 00007FF8A8DF3B39 Relevance: 19.7, APIs: 5, Strings: 6, Instructions: 424COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E4D13B
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E4D155
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E4D2AB
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF8A8E4D2DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF8A8E4D2E4

Strings

error_code:, xrefs: 00007FF8A8E4D144
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc, xrefs: 00007FF8A8E4D0ED, 00007FF8A8E4D3D6
[p2p_channel_service] CloseOfferChannel, xrefs: 00007FF8A8E4D3F8
[p2p_channel_service] OnPortCandidateFailure, xrefs: 00007FF8A8E4D11B
server_port:, xrefs: 00007FF8A8E4D12A
session_id:, xrefs: 00007FF8A8E4D407

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@Xbad_function_call@std@@$_invalid_parameter_noinfo_noreturn
String ID: error_code:$ server_port:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc$[p2p_channel_service] CloseOfferChannel$[p2p_channel_service] OnPortCandidateFailure
API String ID: 4035538703-4210915621
Opcode ID: c3544a2277bc73b2c0c003a8192733cf91ac99ba9c68b5dcd75c2334e0f8f305
Instruction ID: 8afe5aa87ac09594696b7afd319ff4ff1d10421482bfc257fa7a20495276f729
Opcode Fuzzy Hash: c3544a2277bc73b2c0c003a8192733cf91ac99ba9c68b5dcd75c2334e0f8f305
Instruction Fuzzy Hash: EAA1BB32B0AA82E2EB64DF11D4403AD27A0FB88BC4F444032DA5D47799DF7DE959C318

Function 00007FF8A8DF113B Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 350COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0C6E5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z.MSVCP140 ref: 00007FF8A8E0C7D4

Strings

req_uri:, xrefs: 00007FF8A8E0C7A3
GetService req_uri is incorrect format, xrefs: 00007FF8A8E0C785
F:\Demo\ipc_sdk_fix\src\ipc_core\service_dispatcher.cc, xrefs: 00007FF8A8E0C754
please define like service_name.api_name, xrefs: 00007FF8A8E0C794
req_mid:, xrefs: 00007FF8A8E0C7C1
[ServiceDispatcher], xrefs: 00007FF8A8E0C776

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@__invalid_parameter_noinfo_noreturn
String ID: GetService req_uri is incorrect format$ please define like service_name.api_name$ req_mid:$ req_uri:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_dispatcher.cc$[ServiceDispatcher]
API String ID: 2506420284-3173863149
Opcode ID: ccb6b15ddf563ed345f0a8b58f999920f511381f6d0fbc4affc81c7d56c84c08
Instruction ID: adbf57d55b0e1184d3ea0af20cfad7b67d662a36176c088b442ba7e5f9dc11f0
Opcode Fuzzy Hash: ccb6b15ddf563ed345f0a8b58f999920f511381f6d0fbc4affc81c7d56c84c08
Instruction Fuzzy Hash: F5D12372B0AA82E1EF148F25E4443AD2361EB44BE4F005635EAAD07BD9DF7CD494D318

Function 00007FF8A8DF3049 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 277COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z.MSVCP140 ref: 00007FF8A8E252C2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E25326

Strings

[ServiceInvoker], xrefs: 00007FF8A8E25273
F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc, xrefs: 00007FF8A8E25251, 00007FF8A8E25389
", xrefs: 00007FF8A8E25240
uri:, xrefs: 00007FF8A8E25291
mid:, xrefs: 00007FF8A8E252AF
SendRequest, xrefs: 00007FF8A8E25282

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@__invalid_parameter_noinfo_noreturn
String ID: SendRequest$ mid:$ uri:$"$F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc$[ServiceInvoker]
API String ID: 2506420284-913330243
Opcode ID: 3876ae2d2df92d4fd6efa51237c9acaea7f6c3bde5d177089a839fe527d3fdb4
Instruction ID: f52b9a46016d78928e764c808e61db4ee9fa58a130ea6c90f9b398e2763b0fe2
Opcode Fuzzy Hash: 3876ae2d2df92d4fd6efa51237c9acaea7f6c3bde5d177089a839fe527d3fdb4
Instruction Fuzzy Hash: 96C1C272A0AA82A5EF54DF24D4403AD2761FF417E4F508235EAAD076D9EF7CD889C314

Function 00007FF8A8DF28F6 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 226COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E60082
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E6013B
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E601FB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E6029D

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E6001E, 00007FF8A8E600D7, 00007FF8A8E60197
invalid args, xrefs: 00007FF8A8E60060
invalid status, xrefs: 00007FF8A8E60119
[p2p_channel] SendPacket, xrefs: 00007FF8A8E60051, 00007FF8A8E6010A, 00007FF8A8E601CA
is_offer_channel:, xrefs: 00007FF8A8E6006F, 00007FF8A8E60128, 00007FF8A8E601E8
invalid connection_id, xrefs: 00007FF8A8E601D9
session_id:, xrefs: 00007FF8A8E6008B, 00007FF8A8E60144, 00007FF8A8E60204

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_$_invalid_parameter_noinfo_noreturn
String ID: invalid args$ invalid connection_id$ invalid status$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] SendPacket
API String ID: 934332566-3557453562
Opcode ID: 1427cfdb0484cae0075dd9040da5dbe04923c55ffae4fe326cda8ca662b62453
Instruction ID: 523f6dbe67848035982f542f43a7aed26c0cfad6f5cc375ff529a4af48f3c2f8
Opcode Fuzzy Hash: 1427cfdb0484cae0075dd9040da5dbe04923c55ffae4fe326cda8ca662b62453
Instruction Fuzzy Hash: F5A1AE72B0A642E5EA14DF21D8402BD2361FF84BC4F405035EA5D1779ADF7CE91AD728

Function 00007FF8A8DF2612 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 95COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E11A1C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E11A3B
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E11A71
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E11A8C

Strings

error_code:, xrefs: 00007FF8A8E11A7A
[p2p_channel] OnHandshakeFailure, xrefs: 00007FF8A8E119FB
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E119CB
connection_id:, xrefs: 00007FF8A8E11A5F
is_offer_channel:, xrefs: 00007FF8A8E11A0A
session_id:, xrefs: 00007FF8A8E11A44
channel_status:, xrefs: 00007FF8A8E11A25

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@_
String ID: channel_status:$ connection_id:$ error_code:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] OnHandshakeFailure
API String ID: 102757981-3390710865
Opcode ID: d90629356ee9542d11c72e798e54706ab6db3778392c4481ebc66d8da66986b3
Instruction ID: 5a40b7015cf71678b48d35e8243dd668c8d6caec6315981ca73ce949a820a456
Opcode Fuzzy Hash: d90629356ee9542d11c72e798e54706ab6db3778392c4481ebc66d8da66986b3
Instruction Fuzzy Hash: 1341BD31A0A542E1EA16EB12E8442B937A0FF84BC8F409036DD5E07765EF7CE95DD718

Function 00007FF8A8E8F190 Relevance: 18.1, APIs: 12, Instructions: 134registryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF8A8E8F224
DuplicateHandle.KERNEL32 ref: 00007FF8A8E8F24E
GetLastError.KERNEL32 ref: 00007FF8A8E8F25F
GetLastError.KERNEL32 ref: 00007FF8A8E8F269
RegisterWaitForSingleObject.KERNEL32 ref: 00007FF8A8E8F3B3
GetLastError.KERNEL32 ref: 00007FF8A8E8F3C8
GetLastError.KERNEL32 ref: 00007FF8A8E8F3D2

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$CurrentDuplicateHandleObjectProcessRegisterSingleWait
String ID:
API String ID: 2531045433-0
Opcode ID: a73216f243b6ca64fbd43e239694ce13bbf0c91cb4c3c5c33c60cffc787fa2f0
Instruction ID: ca6a75a84a2eb1916cfdf82b3748d954438fc92971f9369b4152d466f8add13c
Opcode Fuzzy Hash: a73216f243b6ca64fbd43e239694ce13bbf0c91cb4c3c5c33c60cffc787fa2f0
Instruction Fuzzy Hash: 01617936A09B86D6E7149F21E4403AD73A4FB48B94F544235DB8D43BA5EF3CE4A0C364

Function 00007FF8A8DF2A2C Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 383COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E3A015
_Mtx_lock.MSVCP140 ref: 00007FF8A8E3A037
_Mtx_unlock.MSVCP140 ref: 00007FF8A8E3A16C
?_Throw_C_error@std@@YAXH@Z.MSVCP140 ref: 00007FF8A8E3A193
_Mtx_lock.MSVCP140 ref: 00007FF8A8E3A2B4

Strings

biz_type:, xrefs: 00007FF8A8E3A004
F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E39F72, 00007FF8A8E39FD3, 00007FF8A8E3A272
[p2p_biz_service] RegisterHandler, xrefs: 00007FF8A8E39FF5
[p2p_biz_service] RemoveAllHandler, xrefs: 00007FF8A8E3A294
[p2p_biz_service] RegisterHandler with invalid handler, xrefs: 00007FF8A8E39F94

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Mtx_lock$??6?$basic_ostream@C_error@std@@D@std@@@std@@Mtx_unlockThrow_U?$char_traits@V01@
String ID: biz_type:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] RegisterHandler$[p2p_biz_service] RegisterHandler with invalid handler$[p2p_biz_service] RemoveAllHandler
API String ID: 2218313198-1419475889
Opcode ID: ed9f8f9eae7db315d760499c00b592d36fd5000368fb6934f9da1ff4ea22b6ad
Instruction ID: 159b7aee9771f619c66243bd358d8306a8dda1e69b96b511f0371886d0442e9e
Opcode Fuzzy Hash: ed9f8f9eae7db315d760499c00b592d36fd5000368fb6934f9da1ff4ea22b6ad
Instruction Fuzzy Hash: 1991B372A0AB42E6EB21DF15D4402B977A0FB85BC4F448036DA8D03795DF7CD9A9C718

Function 00007FF8A8DF2BC1 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 304COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E04A05
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E04A21
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E04B09
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E04BCF

Strings

dingtalk, xrefs: 00007FF8A8E04AAE
[IPCServiceHostBizHandler], xrefs: 00007FF8A8E049D6, 00007FF8A8E04BA0
F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_service_host_biz_handler.cc, xrefs: 00007FF8A8E049B7, 00007FF8A8E04B83
port_number:, xrefs: 00007FF8A8E049F4, 00007FF8A8E04BBE
StartWithPort, xrefs: 00007FF8A8E049E5, 00007FF8A8E04BAF
is_channel_creating:, xrefs: 00007FF8A8E04A0E

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@__invalid_parameter_noinfo_noreturn
String ID: StartWithPort$ is_channel_creating:$ port_number:$F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_service_host_biz_handler.cc$[IPCServiceHostBizHandler]$dingtalk
API String ID: 4002110809-1777706062
Opcode ID: d1e42c54606f6ac91e19930eb59b55330dab82699d7b9e2c9859274404c55ea1
Instruction ID: 3c717bbd4c0727aab7c3af2feed8c153802a037af229a80d2e785278d1c4dbb6
Opcode Fuzzy Hash: d1e42c54606f6ac91e19930eb59b55330dab82699d7b9e2c9859274404c55ea1
Instruction Fuzzy Hash: BBB1F372A0A682E5EB20DF25D4403ED37A1FB847C8F405136EA9D07A99DF7CD988C718

Function 00007FF8A8DF13F2 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 291COMMON

Download Yara Rule

APIs

_Mtx_lock.MSVCP140 ref: 00007FF8A8E3A2B4
?_Throw_C_error@std@@YAXH@Z.MSVCP140 ref: 00007FF8A8E3A304
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E3A3B6
_Mtx_lock.MSVCP140 ref: 00007FF8A8E3A3DB
_Mtx_unlock.MSVCP140 ref: 00007FF8A8E3A474
?_Throw_C_error@std@@YAXH@Z.MSVCP140 ref: 00007FF8A8E3A494

Strings

biz_type:, xrefs: 00007FF8A8E3A3A5
F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E3A272, 00007FF8A8E3A374
[p2p_biz_service] RemoveHandler, xrefs: 00007FF8A8E3A396
[p2p_biz_service] RemoveAllHandler, xrefs: 00007FF8A8E3A294

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: C_error@std@@Mtx_lockThrow_$??6?$basic_ostream@D@std@@@std@@Mtx_unlockU?$char_traits@V01@
String ID: biz_type:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] RemoveAllHandler$[p2p_biz_service] RemoveHandler
API String ID: 3578093728-2054882105
Opcode ID: 9e55fb7df2e707cbcffc87243d0ff8d0c312e98024d9ff7230cdf1887f61f1ab
Instruction ID: bfa0b56762950c5e28299f5da6261bdbbe6f0260b4c6968582aa0e4b8a425308
Opcode Fuzzy Hash: 9e55fb7df2e707cbcffc87243d0ff8d0c312e98024d9ff7230cdf1887f61f1ab
Instruction Fuzzy Hash: E761B132A0AA42E2EB21DB51E4443BD77A1FB847C4F544036DA8D437A1DF7CE9A9C314

Function 00007FF8A8DF3C1A Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 274COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF8A8E83891
GetLastError.KERNEL32 ref: 00007FF8A8E8389D
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8E839A7
GetLastError.KERNEL32 ref: 00007FF8A8E839B1
GetModuleFileNameW.KERNEL32 ref: 00007FF8A8E83AB8
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8E83AF7
GetLastError.KERNEL32 ref: 00007FF8A8E83B03

Strings

:, xrefs: 00007FF8A8E838F5
\, xrefs: 00007FF8A8E838E8

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWide$CurrentDirectoryFileModuleName
String ID: :$\
API String ID: 3932150588-1166558509
Opcode ID: 0b990cd117deaeac0bd8297f74fd3407c53bfc5c7a630533590cbcd98cd464f2
Instruction ID: 76a43d6c2ffa32f88eb75351ae3df027c525a4f59f2ac779406c6e0cd8a691b4
Opcode Fuzzy Hash: 0b990cd117deaeac0bd8297f74fd3407c53bfc5c7a630533590cbcd98cd464f2
Instruction Fuzzy Hash: 3161D631B0EB82D2EB649B65B45033D62A0EF44BD4F444235EA9E87BD8DF3CD8518718

Function 00007FF8A8DF2004 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 228COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z.MSVCP140 ref: 00007FF8A8E013DC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0144D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E014A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E01524

Strings

req_uri:, xrefs: 00007FF8A8E013AE
cross connection?, xrefs: 00007FF8A8E0139F
[InvokeTask], xrefs: 00007FF8A8E01390
F:\Demo\ipc_sdk_fix\src\ipc_core\invoke_task.cc, xrefs: 00007FF8A8E0136D
req_mid:, xrefs: 00007FF8A8E013C9
rsp_body:, xrefs: 00007FF8A8E013E5

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_
String ID: cross connection?$ req_mid:$ req_uri:$ rsp_body:$F:\Demo\ipc_sdk_fix\src\ipc_core\invoke_task.cc$[InvokeTask]
API String ID: 561262822-3989995580
Opcode ID: 4a93c18b819044f45daa82de4da1c5086095faa2bc63044ef5979962eb289fd7
Instruction ID: 158fe81f26cb800f1d117fa627821a58c43992b1f179e7225e6ec0a6e8e1c89a
Opcode Fuzzy Hash: 4a93c18b819044f45daa82de4da1c5086095faa2bc63044ef5979962eb289fd7
Instruction Fuzzy Hash: C3A1C472A06A42E6EB249F29D4403AD2371FB44BE4F144635DA9E0B7E9DF7CE885C314

Function 00007FF8A8DF1131 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 201COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E581F9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E5828B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E582E6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E58391
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E583EC

Strings

[p2p_connection_manager] CloseConnection, xrefs: 00007FF8A8E581D8
F:\Demo\ipc_sdk_fix\src\p2p\net\connection_manager.cc, xrefs: 00007FF8A8E581B9
connection_id:, xrefs: 00007FF8A8E581E7
remote:, xrefs: 00007FF8A8E5821C
local:, xrefs: 00007FF8A8E58202

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: connection_id:$ local:$ remote:$F:\Demo\ipc_sdk_fix\src\p2p\net\connection_manager.cc$[p2p_connection_manager] CloseConnection
API String ID: 3484296013-3043054649
Opcode ID: 11d0b410707aa6c8d0901cce46d68df18c609f5eed704a9b74445becf6a1aa62
Instruction ID: a8743cfa05e9a31bb8beb82df9427a92eca44a2bf845ecbf3406080cff800151
Opcode Fuzzy Hash: 11d0b410707aa6c8d0901cce46d68df18c609f5eed704a9b74445becf6a1aa62
Instruction Fuzzy Hash: FE81C572A06A82A5EF289F25D8443AD2351FB857E8F005231DA6D076D9DF7CD994C318

Function 00007FF8A8E8B5D0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 201registryfileCOMMON

Download Yara Rule

APIs

QueueUserWorkItem.KERNEL32 ref: 00007FF8A8E8B605
ReadFile.KERNEL32 ref: 00007FF8A8E8B64C
GetLastError.KERNEL32 ref: 00007FF8A8E8B656
CreateEventW.KERNEL32 ref: 00007FF8A8E8B681
RegisterWaitForSingleObject.KERNEL32 ref: 00007FF8A8E8B6BD
GetLastError.KERNEL32 ref: 00007FF8A8E8B6C7
GetLastError.KERNEL32 ref: 00007FF8A8E8B6D1
GetLastError.KERNEL32 ref: 00007FF8A8E8B6D9
GetLastError.KERNEL32 ref: 00007FF8A8E8B740

Strings

CreateEvent, xrefs: 00007FF8A8E8B748

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$CreateEventFileItemObjectQueueReadRegisterSingleUserWaitWork
String ID: CreateEvent
API String ID: 564436049-2692171526
Opcode ID: b177225abd8e18cfc5a41d3f59c5a66137840bf1aa73fe6301ad2c2a1d04cfd4
Instruction ID: f6366ffb34423c95d1309ec9ab4a3788373e3e33f8289d21d2c6191585f19e2a
Opcode Fuzzy Hash: b177225abd8e18cfc5a41d3f59c5a66137840bf1aa73fe6301ad2c2a1d04cfd4
Instruction Fuzzy Hash: 7D413B32A0AB42E2EB158B25E54476D33A0FF44BD4F540236DB5D47AA0EF7DE4A4C724

Function 00007FF8A8DF11B8 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 195COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8E10B38
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8E10BB3
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8E10BC1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8E10C0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8E10C3D

Strings

uri, xrefs: 00007FF8A8E10A49
type, xrefs: 00007FF8A8E109EF
ver, xrefs: 00007FF8A8E109C6
body, xrefs: 00007FF8A8E10A76
mid, xrefs: 00007FF8A8E10A1C

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: free$realloc
String ID: body$mid$type$uri$ver
API String ID: 3347955621-321945743
Opcode ID: 881a170f0fc7232502444e7e5dee61f28128431eacbd476ea06c433824fa0d57
Instruction ID: 7a6ea276c4b839f88e228ea6fc1603735c56d0b02ab0b4d0bba3b5473463c0ff
Opcode Fuzzy Hash: 881a170f0fc7232502444e7e5dee61f28128431eacbd476ea06c433824fa0d57
Instruction Fuzzy Hash: 3AA17F32B1AB41E5EB50CF20E4802AD73A5FB88798F545236EA8D13B68DF38D159C754

Function 00007FF8A8DF1311 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 175COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E04A05
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E04A21
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E04B09
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E04BCF

Strings

dingtalk, xrefs: 00007FF8A8E04AAE
[IPCServiceHostBizHandler], xrefs: 00007FF8A8E049D6, 00007FF8A8E04BA0
F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_service_host_biz_handler.cc, xrefs: 00007FF8A8E049B7, 00007FF8A8E04B83
port_number:, xrefs: 00007FF8A8E049F4, 00007FF8A8E04BBE
StartWithPort, xrefs: 00007FF8A8E049E5, 00007FF8A8E04BAF
is_channel_creating:, xrefs: 00007FF8A8E04A0E

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@__invalid_parameter_noinfo_noreturn
String ID: StartWithPort$ is_channel_creating:$ port_number:$F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_service_host_biz_handler.cc$[IPCServiceHostBizHandler]$dingtalk
API String ID: 4002110809-1777706062
Opcode ID: de38c76b63ce021b7902ad0a2d3f8db43987c5f40cd0b85c8667bf7a72475e06
Instruction ID: 469623b93dea23d10d70cdbaea9328366ec0c98dd637d203862ba1f7a14be895
Opcode Fuzzy Hash: de38c76b63ce021b7902ad0a2d3f8db43987c5f40cd0b85c8667bf7a72475e06
Instruction Fuzzy Hash: 0B81C172A0A682E5EB20DF24D8403EC27A1FB407CCF405136EA5D47AA9DF7CD998C718

Function 00007FF8A8DF3346 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 104COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E25F4B
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E25F80
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E25F9B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E25FF6

Strings

error_code:, xrefs: 00007FF8A8E25F89
listener_id:, xrefs: 00007FF8A8E25F3A
[p2p_tcp_port] OnListernerFailure, xrefs: 00007FF8A8E25F2B
address:, xrefs: 00007FF8A8E25F54
F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc, xrefs: 00007FF8A8E25F0C
status:, xrefs: 00007FF8A8E25F6E

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@$_invalid_parameter_noinfo_noreturn
String ID: address:$ error_code:$ listener_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc$[p2p_tcp_port] OnListernerFailure
API String ID: 3764696208-2975873875
Opcode ID: d8b36df92fb518768c3218ee744d8a1a7324be6385b8746c31ea49a04232c8b1
Instruction ID: 85bc0615e175399ba7103829e194e02ccf993c7e5175192c4ed582e1d1619b1b
Opcode Fuzzy Hash: d8b36df92fb518768c3218ee744d8a1a7324be6385b8746c31ea49a04232c8b1
Instruction Fuzzy Hash: AC41E372B0A542A1EE259B11E8013BA63A0FF887D4F001235D95E077E9EF7CE959C718

Function 00007FF8A8DF455C Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 310COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E186B6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E18733
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E187A1

Strings

F:\Demo\ipc_sdk_fix\src\ipc_core\service_host.cc, xrefs: 00007FF8A8E18662, 00007FF8A8E187DB
OnChannelAccepted, xrefs: 00007FF8A8E18692
[ServiceHost], xrefs: 00007FF8A8E18683, 00007FF8A8E187FB
channel_adpater_id:, xrefs: 00007FF8A8E186A1
channel_address:, xrefs: 00007FF8A8E186BF
OnChannelAccepted discarded, xrefs: 00007FF8A8E1880A

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: OnChannelAccepted$ OnChannelAccepted discarded$ channel_address:$ channel_adpater_id:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_host.cc$[ServiceHost]
API String ID: 3484296013-1904241140
Opcode ID: 2d4e9af6c6be1757220fa552e8e82b8da431d303acf9f8e6be6c63733c225862
Instruction ID: e94ea2976968fccede813254d667819f2a07796d159dcbb47da01f9318706995
Opcode Fuzzy Hash: 2d4e9af6c6be1757220fa552e8e82b8da431d303acf9f8e6be6c63733c225862
Instruction Fuzzy Hash: A7D10032A0AA92E6EB64DB24D8403BD6360FF94BD4F448131DA9D07B99DF3CD859C724

Function 00007FF8A8DF3152 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 291COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E23463
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E235F9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E236AA

Strings

[ServiceInvoker], xrefs: 00007FF8A8E23430, 00007FF8A8E234CE
ction, xrefs: 00007FF8A8E23588, 00007FF8A8E23639
F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc, xrefs: 00007FF8A8E2340F, 00007FF8A8E234AE
channel_adpater_id:, xrefs: 00007FF8A8E2344E
OnChannelClosed, xrefs: 00007FF8A8E2343F
OnChannelClosed discarded, xrefs: 00007FF8A8E234DD

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: OnChannelClosed$ OnChannelClosed discarded$ channel_adpater_id:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc$[ServiceInvoker]$ction
API String ID: 3484296013-1690518763
Opcode ID: 54137190229e3b376905ce5b0972e18f15d7f0d36e5eb9051cf5afdb85a80ed7
Instruction ID: 2a64bee197719ec68294f6011319e3bc33ceb6e7286bc552a565eaa32161718a
Opcode Fuzzy Hash: 54137190229e3b376905ce5b0972e18f15d7f0d36e5eb9051cf5afdb85a80ed7
Instruction Fuzzy Hash: 11D19D32A0AA81D6EF20CF25D8403AD6360FB85BD4F048136DA9D477A9EF7CD959CB14

Function 00007FF8A8DF1F05 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 279COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z.MSVCP140 ref: 00007FF8A8E0DC61
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E0DC7C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0DCD5

Strings

req_uri:, xrefs: 00007FF8A8E0DC30
F:\Demo\ipc_sdk_fix\src\ipc_core\service_dispatcher.cc, xrefs: 00007FF8A8E0DBEB
rsp_error_code:, xrefs: 00007FF8A8E0DC6A
req_mid:, xrefs: 00007FF8A8E0DC4E
ProcessRequestFeautre, xrefs: 00007FF8A8E0DC21
[ServiceDispatcher], xrefs: 00007FF8A8E0DC12

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@V01@__invalid_parameter_noinfo_noreturn
String ID: ProcessRequestFeautre$ req_mid:$ req_uri:$ rsp_error_code:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_dispatcher.cc$[ServiceDispatcher]
API String ID: 3722493997-2022644638
Opcode ID: b1a33ca298ffdc6ff9e13a36438628883c852fa0887c5cf3c5829d1ce18b1915
Instruction ID: 335c749c7519bc7f907cbf89f788f7ef2a4a1725f56a985b0fddd5b376f538b0
Opcode Fuzzy Hash: b1a33ca298ffdc6ff9e13a36438628883c852fa0887c5cf3c5829d1ce18b1915
Instruction Fuzzy Hash: 68C1CE32B0AA82E2EA209F25D8402BD6770FB84BD4F045631DA9D47B99DF7CD865C718

Function 00007FF8A8DF1AAA Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 273COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E23EEF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E23F6C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E23FDA

Strings

[ServiceInvoker], xrefs: 00007FF8A8E23EBC, 00007FF8A8E24034
F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc, xrefs: 00007FF8A8E23E9B, 00007FF8A8E24014
OnChannelConnectSuccess, xrefs: 00007FF8A8E23ECB
channel_adpater_id:, xrefs: 00007FF8A8E23EDA
OnChannelConnectSuccess discarded, xrefs: 00007FF8A8E24043
channel_address:, xrefs: 00007FF8A8E23EF8

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: OnChannelConnectSuccess$ OnChannelConnectSuccess discarded$ channel_address:$ channel_adpater_id:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc$[ServiceInvoker]
API String ID: 3484296013-2494189111
Opcode ID: b930a2f4d033cc9cbdded9da43b329ff5d462b3f636187a47d7c77d3b78c1dfe
Instruction ID: 0c1e080f74a3f4f355f741ab589666e71461d587272d77d230507838efd26f15
Opcode Fuzzy Hash: b930a2f4d033cc9cbdded9da43b329ff5d462b3f636187a47d7c77d3b78c1dfe
Instruction Fuzzy Hash: 15C1C332A0AA82E5EF24DB24D8403BD6360FF85BD4F044136DA9D07AA9EF7CD949C714

Function 00007FF8A8DF247D Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 247COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E33BB1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E33C20
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E33CD6

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E33B14, 00007FF8A8E33D11
can not find task session_id:, xrefs: 00007FF8A8E33D3C
[p2p_biz_service] OnCreateAnswerChannelTimeout, xrefs: 00007FF8A8E33B33, 00007FF8A8E33D2D
session_id:, xrefs: 00007FF8A8E33B42

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: can not find task session_id:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] OnCreateAnswerChannelTimeout
API String ID: 3668304517-2880064192
Opcode ID: f945d73d91529197321e37bb269580b172dba5c28d116f3d7b3e9952f823b2d5
Instruction ID: 7ad4072419cb9edce74f733476c0416dc9409e91cba3cb63cf0ba5ba00dc99d6
Opcode Fuzzy Hash: f945d73d91529197321e37bb269580b172dba5c28d116f3d7b3e9952f823b2d5
Instruction Fuzzy Hash: CAA1E372B1A682A5EF249F25E8407ED2321EF847E4F405232DA6D07ADADF7CD945C318

Function 00007FF8A8DF43BD Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 237COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E3FF0E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E3FFF3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E400DE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E4012F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E4016E

Strings

e_id, xrefs: 00007FF8A8E3FE8E
e_s_s, xrefs: 00007FF8A8E3FF7B

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: e_id$e_s_s
API String ID: 3668304517-904654206
Opcode ID: d01a7a0c266ff961bc1bc5fb36819c66ab1519a7f0d663f56fbf3ce3dcb93431
Instruction ID: 9ed60b0874bda3e4a403095b123145712a834c0400744eb1127419b7c8524382
Opcode Fuzzy Hash: d01a7a0c266ff961bc1bc5fb36819c66ab1519a7f0d663f56fbf3ce3dcb93431
Instruction Fuzzy Hash: 7BA16E72F09A82A5FB10CBB4D4443AC2362EB057E8F504231DA6D17AD9CF7CD49AD318

Function 00007FF8A8DF112C Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 234COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E355C1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E35630
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E356B4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E35789
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E357F2

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E35524, 00007FF8A8E356EF
can not find task session_id:, xrefs: 00007FF8A8E3571A
session_id:, xrefs: 00007FF8A8E35552
[p2p_biz_service] OnCreateOfferChannelTimeout, xrefs: 00007FF8A8E35543, 00007FF8A8E3570B

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: can not find task session_id:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] OnCreateOfferChannelTimeout
API String ID: 3668304517-2196671353
Opcode ID: 1e9bfa68f37a706e288186577840d0242f87163c46bcef6680b57f2f3d2d23d0
Instruction ID: 2dba9751db65e07b6a680af7667be7c941b1f62cc267644d2a1faf7c189d34cd
Opcode Fuzzy Hash: 1e9bfa68f37a706e288186577840d0242f87163c46bcef6680b57f2f3d2d23d0
Instruction Fuzzy Hash: B5A1B272B06682A5EF249B25D8843ED2321EF447E4F404235DA6D07BE9DF7CD985C718

Function 00007FF8A8DF2A31 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 227COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E31034
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E3104F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E310AB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E31234

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E30FD9
offer_session_id:, xrefs: 00007FF8A8E31007
[p2p_biz_service] CreateFailiedAnswer, xrefs: 00007FF8A8E30FF8
reason_code:, xrefs: 00007FF8A8E3103D
answer_result_code:, xrefs: 00007FF8A8E31022

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_invalid_parameter_noinfo_noreturn
String ID: answer_result_code:$ offer_session_id:$ reason_code:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] CreateFailiedAnswer
API String ID: 1288313053-1367783755
Opcode ID: f78c09fcc6428fa924715483114cde0de3411f81e036e6d1f6bf12e74c0f82bb
Instruction ID: 3304ae589fd6d7da0d2fee5bfc24ff1065821f5435beba392aabfb8db2a71f0b
Opcode Fuzzy Hash: f78c09fcc6428fa924715483114cde0de3411f81e036e6d1f6bf12e74c0f82bb
Instruction Fuzzy Hash: CCA1A172A06682AAEB14CF25D4403ED2761FB447E8F40523AF66E03AD9EF7CD884C754

Function 00007FF8A8E946C0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_wcsnicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8E9476C
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8E947CF
wcsrchr.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,?,00007FF8A8E94555,?,?,00000000,00000000), ref: 00007FF8A8E947F0
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8E94812
wcsrchr.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,?,00007FF8A8E94555,?,?,00000000,00000000), ref: 00007FF8A8E9482C
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8E94850
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8E94889
GetFileAttributesW.KERNEL32 ref: 00007FF8A8E9489B

Strings

\/:, xrefs: 00007FF8A8E947E9, 00007FF8A8E94825

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: wcsncpy_s$wcsrchr$AttributesFile_wcsnicmp
String ID: \/:
API String ID: 420626202-1324871449
Opcode ID: 010da84df761f81fccd8756ad1d715bb8e2e035ce91a75c9faf10ca7f1048007
Instruction ID: 3d98eeaebfdde4de8eddd38ecbd56638114a4be46ad61065ad01628a14e84c10
Opcode Fuzzy Hash: 010da84df761f81fccd8756ad1d715bb8e2e035ce91a75c9faf10ca7f1048007
Instruction Fuzzy Hash: CA51B631E0A986E0EB249F55A405679B2E0FB45BECF488231DE6D073D4EFBCE4568358

Function 00007FF8A8DF1EBA Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 136COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E4E55C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E4E593
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF8A8E4E5AE

Strings

[p2p_channel] OnConnectionRead decode failed, xrefs: 00007FF8A8E4E53B
buffer_size:, xrefs: 00007FF8A8E4E59C
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E4E503
connection_id:, xrefs: 00007FF8A8E4E580
is_offer_channel:, xrefs: 00007FF8A8E4E54A
session_id:, xrefs: 00007FF8A8E4E565

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@_$V01@
String ID: buffer_size:$ connection_id:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] OnConnectionRead decode failed
API String ID: 1078673242-3916206650
Opcode ID: cf4b66bceab333d068c6605c6459ada3d240c5c9cb74145a2791f22e280fcd46
Instruction ID: 9ae780d797a55c2c4b99a797ab03c29c37dd24b40433e67bbc350e5c5e5565f6
Opcode Fuzzy Hash: cf4b66bceab333d068c6605c6459ada3d240c5c9cb74145a2791f22e280fcd46
Instruction Fuzzy Hash: 9651C572A1AB82E6EB21DF21E8402BA73A0FB847C4F405136EA8D07769DF3CD559C714

Function 00007FF8A8DF2374 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 132COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E3314B
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E331A4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E33200

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E330FB
[p2p_channel] SetChooicedAnswer, xrefs: 00007FF8A8E3312A
is_offer_channel:, xrefs: 00007FF8A8E33139
status:, xrefs: 00007FF8A8E3318E
session_id:, xrefs: 00007FF8A8E33154
answer_sender:, xrefs: 00007FF8A8E3316F

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@V01@__invalid_parameter_noinfo_noreturn
String ID: answer_sender:$ is_offer_channel:$ session_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] SetChooicedAnswer
API String ID: 3722493997-3650649652
Opcode ID: 3d9779ffa33d67f45539b89bddf553607a7bb1a90a96ed13bfbcae0a419db671
Instruction ID: 6add5376b4b1ef4d26cee820cc45c7a659f0138b6dc1968c5f6c9fb83549fe30
Opcode Fuzzy Hash: 3d9779ffa33d67f45539b89bddf553607a7bb1a90a96ed13bfbcae0a419db671
Instruction Fuzzy Hash: BF51D431B0AA42E0EE25AB12E8146BA3360FF84BC0F405135ED6D07795DF7CE959D728

Function 00007FF8A8DF3FDD Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 124COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E51AA3
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E51ABE
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E51AF4

Strings

[p2p_channel_service] OnPortConnectionIncoming, xrefs: 00007FF8A8E51A83
auth_session_id:, xrefs: 00007FF8A8E51AC7
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc, xrefs: 00007FF8A8E51A54
connection_id:, xrefs: 00007FF8A8E51AAC
auth_from_offer:, xrefs: 00007FF8A8E51AE1
server_port:, xrefs: 00007FF8A8E51A92

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@_
String ID: auth_from_offer:$ auth_session_id:$ connection_id:$ server_port:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc$[p2p_channel_service] OnPortConnectionIncoming
API String ID: 102757981-286564243
Opcode ID: 11cfd3e5d3bc801c3af9763dd2b55e7f909f11f4cccd536dfbbf16fc4621726f
Instruction ID: 686bfa0bec73cbd32793c8b7816f279fa0e55359423ed572c4e425ce7968100b
Opcode Fuzzy Hash: 11cfd3e5d3bc801c3af9763dd2b55e7f909f11f4cccd536dfbbf16fc4621726f
Instruction Fuzzy Hash: D151C5B1B0A642F1EB699B21D4042B927A1FB44FC4F445036CE8E07796EF7CE969C318

Function 00007FF8A8E0FC2C Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E0FCE5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E0FD04
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E0FD3A

Strings

[p2p_channel] OnHandshakeSuccess, xrefs: 00007FF8A8E0FCC4
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E0FC94
connection_id:, xrefs: 00007FF8A8E0FD28
is_offer_channel:, xrefs: 00007FF8A8E0FCD3
session_id:, xrefs: 00007FF8A8E0FD0D
channel_status:, xrefs: 00007FF8A8E0FCEE

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@_
String ID: channel_status:$ connection_id:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] OnHandshakeSuccess
API String ID: 102757981-2122318128
Opcode ID: e8c372e58f1d79d60f6f58edce6210440722b2e7f81e7ed969cb36ef71907d8f
Instruction ID: b5a1a08032bb68cb666749d6fa2e9decf39eaf1d4ae9415b7998228e7ef5ed1b
Opcode Fuzzy Hash: e8c372e58f1d79d60f6f58edce6210440722b2e7f81e7ed969cb36ef71907d8f
Instruction Fuzzy Hash: 3931EE72A0A602E2EB16EF16D8502A933A0FF80BC0F818036DE5D07765EF7CD959D714

Function 00007FF8A8DF2D51 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 82COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E0FCE5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E0FD04
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E0FD3A

Strings

[p2p_channel] OnHandshakeSuccess, xrefs: 00007FF8A8E0FCC4
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E0FC94
connection_id:, xrefs: 00007FF8A8E0FD28
is_offer_channel:, xrefs: 00007FF8A8E0FCD3
session_id:, xrefs: 00007FF8A8E0FD0D
channel_status:, xrefs: 00007FF8A8E0FCEE

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@_
String ID: channel_status:$ connection_id:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] OnHandshakeSuccess
API String ID: 102757981-2122318128
Opcode ID: fbc93b183f94ddef7b7402cdd3d3253e4d98671bbfa3167ac56a9725e9865336
Instruction ID: 7b3a21446378e6f7c4ebadbb94b4a5aee94783965ba8ba4fe9404208ed33e40c
Opcode Fuzzy Hash: fbc93b183f94ddef7b7402cdd3d3253e4d98671bbfa3167ac56a9725e9865336
Instruction Fuzzy Hash: B831CE31A0A602E1EA25EB12E8506E937A0FB84BC0F41903ADD5D07765EF7CE959D318

Function 00007FF8A8DF3751 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 82COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E23770
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E2378A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E237C0

Strings

listener_id:, xrefs: 00007FF8A8E2375E
auth_session_id:, xrefs: 00007FF8A8E23793
connection_id:, xrefs: 00007FF8A8E23779
auth_from_offer:, xrefs: 00007FF8A8E237AD
F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc, xrefs: 00007FF8A8E2372D
[p2p_tcp_port] OnHandshakeResponse, xrefs: 00007FF8A8E2374F

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@_
String ID: auth_from_offer:$ auth_session_id:$ connection_id:$ listener_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc$[p2p_tcp_port] OnHandshakeResponse
API String ID: 102757981-3115693648
Opcode ID: a344418e3b3eb184b3411b6ebdd98c63ba668bf83848ca169e5e87b30cd0533c
Instruction ID: 1c56be83d2543d204ce25270c57aac5cb1d4384ae8f006fc4ae9c071b3f49ede
Opcode Fuzzy Hash: a344418e3b3eb184b3411b6ebdd98c63ba668bf83848ca169e5e87b30cd0533c
Instruction Fuzzy Hash: F831CD72B0A642E5EF259B22D8102A927A0EF84FC0F459036DA4D0776ADF7CD919C764

Function 00007FF8A8DF2293 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E62503
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E62539
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E62558

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E624B0
[p2p_channel] OnOnConnectionClosed, xrefs: 00007FF8A8E624E2
connection_id:, xrefs: 00007FF8A8E62527
is_offer_channel:, xrefs: 00007FF8A8E624F1
session_id:, xrefs: 00007FF8A8E6250C
channel_status:, xrefs: 00007FF8A8E62542

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@_
String ID: channel_status:$ connection_id:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] OnOnConnectionClosed
API String ID: 102757981-2066013403
Opcode ID: a2f85c9fd3db7b83476cb14243432654315b019f72ece37771d08426f7420d4d
Instruction ID: 86bcf6c9b5bcfefd05874041882d36647c60ec5c140172804b90f3cdfcc63b92
Opcode Fuzzy Hash: a2f85c9fd3db7b83476cb14243432654315b019f72ece37771d08426f7420d4d
Instruction Fuzzy Hash: BF31D131A0A606F1EA22EB12E8102EA37A0FF847C4F40103AE95D07669EF7CE95DD714

Function 00007FF8A8DF270C Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E0AA25
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E0AA5B
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E0AA7A

Strings

[p2p_channel] OnConnectionDisconnected, xrefs: 00007FF8A8E0AA04
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E0A9D2
connection_id:, xrefs: 00007FF8A8E0AA49
is_offer_channel:, xrefs: 00007FF8A8E0AA13
session_id:, xrefs: 00007FF8A8E0AA2E
channel_status:, xrefs: 00007FF8A8E0AA64

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@_
String ID: channel_status:$ connection_id:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] OnConnectionDisconnected
API String ID: 102757981-2035820093
Opcode ID: f42ab6d3e7e3e626b58d9e16d15b0aa912515c4710ff8332b3e9452924b1690e
Instruction ID: 0c0670cbc73808e3f24e8dac99cfb34b3b910e64e1a5e01c4061351616677070
Opcode Fuzzy Hash: f42ab6d3e7e3e626b58d9e16d15b0aa912515c4710ff8332b3e9452924b1690e
Instruction Fuzzy Hash: 9D31CF32A0A606F5EA22EF12E8002EA33A0FF847C4F40503AE95D07695EF7CD95DD714

Function 00007FF8A8E12CD0 Relevance: 15.4, APIs: 10, Instructions: 411COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8E12DB8
memmove.VCRUNTIME140 ref: 00007FF8A8E12DC6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E12DFF
memmove.VCRUNTIME140 ref: 00007FF8A8E12E09
memmove.VCRUNTIME140 ref: 00007FF8A8E12E17
memmove.VCRUNTIME140 ref: 00007FF8A8E12F99
memset.VCRUNTIME140 ref: 00007FF8A8E12FA7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E12FE0
memmove.VCRUNTIME140 ref: 00007FF8A8E12FEA
memset.VCRUNTIME140 ref: 00007FF8A8E12FF8

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: memmove$_invalid_parameter_noinfo_noreturnmemset
String ID:
API String ID: 1392643149-0
Opcode ID: 9319d8eccc778590344b2d2f593d9654078f62bb5929652cb7d2660f73336884
Instruction ID: 1aaa50d305246a5db2eb30de70d7a44fd769571c4dfde841c1b1e2161553a23f
Opcode Fuzzy Hash: 9319d8eccc778590344b2d2f593d9654078f62bb5929652cb7d2660f73336884
Instruction Fuzzy Hash: 3671E631B1E786E5EE14DB12A9043AD6351FB18BD0F584531EE5D0BB89DFBCD0619328

Function 00007FF8A8DF10DC Relevance: 15.4, APIs: 10, Instructions: 363COMMON

Download Yara Rule

APIs

GetNumberOfConsoleInputEvents.KERNEL32 ref: 00007FF8A8E8DCBA
GetLastError.KERNEL32 ref: 00007FF8A8E8DCEE

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ConsoleErrorEventsInputLastNumber
String ID:
API String ID: 3553264647-0
Opcode ID: 59c2813e7daa1cab0c57a2a85504da05eac18a55ed55c8ffa51ce7bf98231d04
Instruction ID: 8beaf9aa7bb4e17aef4c58563e97d2f284204fa9a6b1a36e295e5b6528a0ed2f
Opcode Fuzzy Hash: 59c2813e7daa1cab0c57a2a85504da05eac18a55ed55c8ffa51ce7bf98231d04
Instruction Fuzzy Hash: BFF16332B0A683E6EB645F65C4043BD27A1EB45B88F844135DE4D876E8DF3C9895C728

Function 00007FF8A8DF4494 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 352pipeCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E8A362
MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E8A3A1
CreateNamedPipeW.KERNEL32 ref: 00007FF8A8E8A3DE
GetLastError.KERNEL32 ref: 00007FF8A8E8A400
GetLastError.KERNEL32 ref: 00007FF8A8E8A43F
CloseHandle.KERNEL32 ref: 00007FF8A8E8A470
CloseHandle.KERNEL32 ref: 00007FF8A8E8A5E2

Strings

uv__malloc, xrefs: 00007FF8A8E8A4CD

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharCloseErrorHandleLastMultiWide$CreateNamedPipe
String ID: uv__malloc
API String ID: 3666698400-1058249677
Opcode ID: 4b5b51c4fa789f832360b7c1e0f74453f13eaa2f0bac6089b47868dfe41828d0
Instruction ID: 7edb295dee46c506d7ffa4a5ac130f5d0135df36d8fb4c1300030afd2356b250
Opcode Fuzzy Hash: 4b5b51c4fa789f832360b7c1e0f74453f13eaa2f0bac6089b47868dfe41828d0
Instruction Fuzzy Hash: 77817132A0AA8292EB549F29A0442AC7291FB48BF4F580335DABD477D5CF3CD4628725

Function 00007FF8A8E284C0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 333COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF8A8E28571
_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E286D4
_Thrd_detach.MSVCP140 ref: 00007FF8A8E286FB
?_Throw_C_error@std@@YAXH@Z.MSVCP140 ref: 00007FF8A8E28717
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF8A8E2872A
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF8A8E28735

Strings

F:\Demo\ipc_sdk_fix\src\p2p\net\event_loop.cc, xrefs: 00007FF8A8E285DB
[p2p_loop] EventLoop start, xrefs: 00007FF8A8E285FD

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Throw_$Cpp_error@std@@$C_error@std@@Thrd_detachXbad_function_call@std@@_beginthreadex
String ID: F:\Demo\ipc_sdk_fix\src\p2p\net\event_loop.cc$[p2p_loop] EventLoop start
API String ID: 2864724034-3613579832
Opcode ID: 31f9cd19c9c4956d2e6e70e467b590d85e0c3da35457361b6b502ddb2dbb4fe2
Instruction ID: 60268caf6085e668f1822a5d5c47d53ada420bc21d9d184c4691716d59107f4d
Opcode Fuzzy Hash: 31f9cd19c9c4956d2e6e70e467b590d85e0c3da35457361b6b502ddb2dbb4fe2
Instruction Fuzzy Hash: 0B71A132A0E7C1E1EB559B21E4403EAA360FB887C4F484035EA9D07B9ADF7CD965C714

Function 00007FF8A8DF3355 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 257COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E71A3A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E71A59
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E71A75

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_offer_channel_handshake.cc, xrefs: 00007FF8A8E719F6
handeshake_timeout_in_ms:, xrefs: 00007FF8A8E71A62
connection_id:, xrefs: 00007FF8A8E71A43
is_offer_channel:, xrefs: 00007FF8A8E71A23
[p2p_offer_handshake] Start, xrefs: 00007FF8A8E71A14

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@_
String ID: connection_id:$ handeshake_timeout_in_ms:$ is_offer_channel:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_offer_channel_handshake.cc$[p2p_offer_handshake] Start
API String ID: 102757981-3121120160
Opcode ID: 3117924dead68abee225ab794fa3bea5aac6dbc751b452ad6aea8ab16a7f3512
Instruction ID: 8952f2256b863a9338cadd8214730ae3edc8f8c0bad80f170fe3326424cba1bf
Opcode Fuzzy Hash: 3117924dead68abee225ab794fa3bea5aac6dbc751b452ad6aea8ab16a7f3512
Instruction Fuzzy Hash: CEB16B32606B92D6DB509F25D8803AC73A4FB89FD8F098036CA8E47764EF38D995C754

Function 00007FF8A8DF4408 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 226COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E09940
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E09B81

Strings

F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_shell_service.cc, xrefs: 00007FF8A8E099DF, 00007FF8A8E09B43
selected_crypto_id:, xrefs: 00007FF8A8E09B6F
[p2p_crypto] processor, xrefs: 00007FF8A8E099FD
[p2p_crypto] NewCryptoContext InitKeyPair failed, xrefs: 00007FF8A8E09B60
instructions set, xrefs: 00007FF8A8E09A1B
without aes_ni, xrefs: 00007FF8A8E09A0C

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_invalid_parameter_noinfo_noreturn
String ID: instructions set$ selected_crypto_id:$ without aes_ni$F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_shell_service.cc$[p2p_crypto] NewCryptoContext InitKeyPair failed$[p2p_crypto] processor
API String ID: 1288313053-1332869673
Opcode ID: 4636181cce4e3208beb3cbfcc79c925c410b166af299f90f08dd0c892e276c16
Instruction ID: c02df78ecc5cc368aee7f13810da8d26e6ffe13abcf2276dc7de079f25a99641
Opcode Fuzzy Hash: 4636181cce4e3208beb3cbfcc79c925c410b166af299f90f08dd0c892e276c16
Instruction Fuzzy Hash: C481E032A0AA42E1EB14DF21E4402A937B0FB84BD4F558531EA9D07799DF7CDC59C728

Function 00007FF8A8DF4052 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF8A8E62743
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E62800
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E62855

Strings

[p2p_channel_service] AddAnswerCandidate, xrefs: 00007FF8A8E62706
candidates:, xrefs: 00007FF8A8E6274C
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc, xrefs: 00007FF8A8E626E7
candidate_size:, xrefs: 00007FF8A8E6272F
session_id:, xrefs: 00007FF8A8E62715

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_
String ID: candidate_size:$ candidates:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc$[p2p_channel_service] AddAnswerCandidate
API String ID: 561262822-913131044
Opcode ID: bf677ec49a6908e870efeb6ee5d5409194f45673d5a98bf3812d089b8c0c751b
Instruction ID: 2a9a9f629610aff2b54303bec1bb6c23b3d52f348cb8e3b0bc3ba2b8163bc5f9
Opcode Fuzzy Hash: bf677ec49a6908e870efeb6ee5d5409194f45673d5a98bf3812d089b8c0c751b
Instruction Fuzzy Hash: AF91C172A0AA86E1EB248F25D8403ADB3A1FB88BD4F148135DE9D07799DF3CE855C714

Function 00007FF8A8DF2CCA Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 223COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF8A8E4C4B3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E4C570
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E4C5C5

Strings

[p2p_channel_service] AddOfferCandidate, xrefs: 00007FF8A8E4C476
candidates:, xrefs: 00007FF8A8E4C4BC
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc, xrefs: 00007FF8A8E4C457
candidate_size:, xrefs: 00007FF8A8E4C49F
session_id:, xrefs: 00007FF8A8E4C485

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_
String ID: candidate_size:$ candidates:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc$[p2p_channel_service] AddOfferCandidate
API String ID: 561262822-3545473831
Opcode ID: f9d658fac08578e9a402d7eeab571e9795d2515e159c4f1041ec3d76d8880989
Instruction ID: dec9be6bfdb3baa674cef58204f6cda4f8dd45fe364471955558acd59316428f
Opcode Fuzzy Hash: f9d658fac08578e9a402d7eeab571e9795d2515e159c4f1041ec3d76d8880989
Instruction Fuzzy Hash: 1491D172A0AB82A1EB249F25E4403AD73A0FB88BD4F148135DE9D077A9DF3DD895C714

Function 00007FF8A8DF2879 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 210COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E239CD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E23B4B

Strings

error_code:, xrefs: 00007FF8A8E239BB
[ServiceInvoker], xrefs: 00007FF8A8E2399D, 00007FF8A8E23A3A
ction, xrefs: 00007FF8A8E23AEC
F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc, xrefs: 00007FF8A8E2397E, 00007FF8A8E23A19
OnChannelConnectFailure, xrefs: 00007FF8A8E239AC
OnChannelConnectFailure discarded, xrefs: 00007FF8A8E23A49

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_invalid_parameter_noinfo_noreturn
String ID: OnChannelConnectFailure$ OnChannelConnectFailure discarded$ error_code:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_invoker.cc$[ServiceInvoker]$ction
API String ID: 1288313053-3824672909
Opcode ID: 02852f61a0ab6b0dfbdc2aeaefc36e37fd3684cf89f4ad9d5af060036a984cb9
Instruction ID: d845c5e4a2333175e693ae5267f04b53dddd1f22548f96616d399b9d84f8df42
Opcode Fuzzy Hash: 02852f61a0ab6b0dfbdc2aeaefc36e37fd3684cf89f4ad9d5af060036a984cb9
Instruction Fuzzy Hash: 4DA1C432A0AA82E5EB20DF24D4403BC3761FB857D4F444136DA9D07AA9DF7CD959CB24

Function 00007FF8A8DF11E0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E517CB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E51805
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E51970

Strings

[p2p_channel] SetOffer, xrefs: 00007FF8A8E517AA
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E5177B
is_offer_channel:, xrefs: 00007FF8A8E517B9
status:, xrefs: 00007FF8A8E517EF
session_id:, xrefs: 00007FF8A8E517D4

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@V01@__invalid_parameter_noinfo_noreturn
String ID: is_offer_channel:$ session_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] SetOffer
API String ID: 3722493997-2812650445
Opcode ID: e6aad19fc9a99547a784acb9334854d8bf6dd277f31864d130f66749e6361d1b
Instruction ID: 22ca3df905ae4303e2fe75784b14d03dbf4d96c0c31ff5829bc7aed468c6c485
Opcode Fuzzy Hash: e6aad19fc9a99547a784acb9334854d8bf6dd277f31864d130f66749e6361d1b
Instruction Fuzzy Hash: 2D61DF72B0A642A1EE25EB15D4403BD2360FF85BC4F405135EA9E07BAAEF7CD959C324

Function 00007FF8A8DF1E1F Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 152COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E62C72
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E62CAC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E62DC0

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E62C22
is_offer_channel:, xrefs: 00007FF8A8E62C60
status:, xrefs: 00007FF8A8E62C96
[p2p_channel] SetAnswer, xrefs: 00007FF8A8E62C51
session_id:, xrefs: 00007FF8A8E62C7B

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@V01@__invalid_parameter_noinfo_noreturn
String ID: is_offer_channel:$ session_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] SetAnswer
API String ID: 3722493997-4276591271
Opcode ID: 6305ab6b272f7fd939266b8f965db638820948a7c99864aa7cf17ad8e8323d5b
Instruction ID: 0c7e7827aff546c1c121e17d07f44e4d160639b609e68ec0cb55af42701f2c04
Opcode Fuzzy Hash: 6305ab6b272f7fd939266b8f965db638820948a7c99864aa7cf17ad8e8323d5b
Instruction Fuzzy Hash: 1E51D132A0AA42A1EE25EB12E4403AD6361FF84BC4F404131EE9D07799DF7CE949D328

Function 00007FF8A8DF1FF0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 110networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF8A8E9E5D5
WSASetLastError.WS2_32 ref: 00007FF8A8E9E5E2
WSASetLastError.WS2_32 ref: 00007FF8A8E9E646
WSASetLastError.WS2_32 ref: 00007FF8A8E9E658
WSASetLastError.WS2_32 ref: 00007FF8A8E9E667

Strings

(, xrefs: 00007FF8A8E9E578

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID: (
API String ID: 1452528299-3887548279
Opcode ID: 3066bf9b67426fa9c36f1e59a4b1e91db13d65cb15206c5190a5028b319559f8
Instruction ID: 738ddb2c6f6b30a46623c54c928076ff415c7437822571b7f05b25427daf4644
Opcode Fuzzy Hash: 3066bf9b67426fa9c36f1e59a4b1e91db13d65cb15206c5190a5028b319559f8
Instruction Fuzzy Hash: 0C41AD31A0DB82D6E7745F64F41432AB2A0FB48B90F044539D79E83799DFBCE8648B18

Function 00007FF8A8DF2AF4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 92COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E7971D
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E79739
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E79755

Strings

connected:, xrefs: 00007FF8A8E79742
connecting:, xrefs: 00007FF8A8E79726
F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_client.cc, xrefs: 00007FF8A8E796DA
connection_id:, xrefs: 00007FF8A8E7970B
[p2p_tcp_client] OnConnectTimeout, xrefs: 00007FF8A8E796FC

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@_$V01@
String ID: connected:$ connecting:$ connection_id:$F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_client.cc$[p2p_tcp_client] OnConnectTimeout
API String ID: 1078673242-2696627028
Opcode ID: 68ea701cc7bd940b1db1fc69adbd1077dcb84a9b7688e149474e1c2792a7cdbf
Instruction ID: 35d4f680a8fe387d475da6bec39f7402a8910c0429d048c5fa5eab3cf30dc45c
Opcode Fuzzy Hash: 68ea701cc7bd940b1db1fc69adbd1077dcb84a9b7688e149474e1c2792a7cdbf
Instruction Fuzzy Hash: 0141AC32A0A682E6EB21DF21D4403A827A1FB84BC4F554136DA9D07799CF3CD95AC764

Function 00007FF8A8DF2B85 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E71ED8
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E71EF6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E71F11

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_offer_channel_handshake.cc, xrefs: 00007FF8A8E71E91
connection_id:, xrefs: 00007FF8A8E71EE1
is_offer_channel:, xrefs: 00007FF8A8E71EC2
status:, xrefs: 00007FF8A8E71EFF
[p2p_offer_handshake] Stop, xrefs: 00007FF8A8E71EB3

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@_
String ID: connection_id:$ is_offer_channel:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_offer_channel_handshake.cc$[p2p_offer_handshake] Stop
API String ID: 102757981-4163479935
Opcode ID: 0092b6f553f602ffc6c7b2d9b72671ff23b723986f7aa545a2e1553829038e22
Instruction ID: 06b35645132ebb4f6371af201b2fe97a6ab91fed132e0b1defcb99e2f851a1a3
Opcode Fuzzy Hash: 0092b6f553f602ffc6c7b2d9b72671ff23b723986f7aa545a2e1553829038e22
Instruction Fuzzy Hash: C331B232A0A643E2EB259B21D8513BC23A0FF84BC4F444036D95D476AAEF3CD949D764

Function 00007FF8A8DF2F19 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E6C298
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E6C2B2
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E6C2CC

Strings

error_code:, xrefs: 00007FF8A8E6C2BB
listener_id:, xrefs: 00007FF8A8E6C286
[p2p_tcp_port] OnHandshakeFailure, xrefs: 00007FF8A8E6C277
connection_id:, xrefs: 00007FF8A8E6C2A1
F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc, xrefs: 00007FF8A8E6C255

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: connection_id:$ error_code:$ listener_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc$[p2p_tcp_port] OnHandshakeFailure
API String ID: 3768306364-360505646
Opcode ID: 96044e5904c7c8fefd3ff8f7c8669486dc4b5954c83bdd34cf86f15501b8bba0
Instruction ID: 357581b497048575a0620b6fad55811e2659cccaae8b91cccf7c50efdec6461d
Opcode Fuzzy Hash: 96044e5904c7c8fefd3ff8f7c8669486dc4b5954c83bdd34cf86f15501b8bba0
Instruction Fuzzy Hash: A231AF32A0AA42E6EB15DF11E8012A937A0FBC4BC0F419136DA5D43765EF7CE91AC714

Function 00007FF8A8DF4403 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 66COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E718A2
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E718BC
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E718DA

Strings

[p2p_offer_handshake] OnOnConnectionClosed, xrefs: 00007FF8A8E7187D
F:\Demo\ipc_sdk_fix\src\p2p\p2p_offer_channel_handshake.cc, xrefs: 00007FF8A8E7185B
connection_id:, xrefs: 00007FF8A8E718AB
is_offer_channel:, xrefs: 00007FF8A8E7188C
status:, xrefs: 00007FF8A8E718C5

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@$V01@_
String ID: connection_id:$ is_offer_channel:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_offer_channel_handshake.cc$[p2p_offer_handshake] OnOnConnectionClosed
API String ID: 102757981-3424745954
Opcode ID: 641861fe93856c932e7e3d82d5e38f1ad5169913506847f908166bb39ea93da4
Instruction ID: abf430b15e45ede11091fe55f764e748a868f450ed8a213cc0d757a0a5deb4ea
Opcode Fuzzy Hash: 641861fe93856c932e7e3d82d5e38f1ad5169913506847f908166bb39ea93da4
Instruction Fuzzy Hash: 6231A432A0A682E2FB219F15E8403E937A1FB84BC4F404136DA9D07769EF3CD959CB14

Function 00007FF8A8E86DD0 Relevance: 13.6, APIs: 9, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8A8E86E04
LeaveCriticalSection.KERNEL32 ref: 00007FF8A8E86E11
WaitForMultipleObjects.KERNEL32 ref: 00007FF8A8E86E2E
EnterCriticalSection.KERNEL32 ref: 00007FF8A8E86E3A
LeaveCriticalSection.KERNEL32 ref: 00007FF8A8E86E55
ResetEvent.KERNEL32 ref: 00007FF8A8E86E5F
LeaveCriticalSection.KERNEL32 ref: 00007FF8A8E86E89
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E86EAB
TlsAlloc.KERNEL32 ref: 00007FF8A8E86EF9

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$AllocEventMultipleObjectsResetWaitabort
String ID:
API String ID: 3257358133-0
Opcode ID: 863d43beba8b20204d87980aea65fffb1d1095bc696363263c00c9a4a5abf283
Instruction ID: 44f943bbe42cb54b6c71fc69aaefa28d3ccc80294e881b20fd46803363115afe
Opcode Fuzzy Hash: 863d43beba8b20204d87980aea65fffb1d1095bc696363263c00c9a4a5abf283
Instruction Fuzzy Hash: 71218E32A09A5292EB14DB35E88802D7361FB88BD0F514132EA5E437A4EF3DD996C714

Function 00007FF8A8E81C90 Relevance: 13.6, APIs: 9, Instructions: 122networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32 ref: 00007FF8A8E81D25

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Recv
String ID:
API String ID: 4192927123-0
Opcode ID: 47cfe101990dcbf14d3b14ad1360765cf4a445514ddc9154869aea4399f2ece7
Instruction ID: 0f9049e8e11f22e7375dffcf2035de687aa09812f98f293b1e92163b60d51013
Opcode Fuzzy Hash: 47cfe101990dcbf14d3b14ad1360765cf4a445514ddc9154869aea4399f2ece7
Instruction Fuzzy Hash: FA515C32A09B42DAE750DF65E44426D73B8FB04B94F640236DB8D437A5EF39E4A0C7A4

Function 00007FF8A8DF33FA Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 293COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E8A7E4
MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E8A820
GetLastError.KERNEL32 ref: 00007FF8A8E8A848
QueueUserWorkItem.KERNEL32 ref: 00007FF8A8E8A868
GetLastError.KERNEL32 ref: 00007FF8A8E8A8DA
CloseHandle.KERNEL32 ref: 00007FF8A8E8A903

Part of subcall function 00007FF8A8E898E0: CreateFileW.KERNEL32 ref: 00007FF8A8E89914

Strings

uv__malloc, xrefs: 00007FF8A8E8A9A3

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide$CloseCreateFileHandleItemQueueUserWork
String ID: uv__malloc
API String ID: 1603554176-1058249677
Opcode ID: eaee1c6c95aac265cc7994ed9c523abad7fe60e0a25ad1e7ac1b6f559b70dde5
Instruction ID: ddb1ae064f19e7f20df62ac6aa80d47dde9ec2fbf2457b87e894f5440292fa80
Opcode Fuzzy Hash: eaee1c6c95aac265cc7994ed9c523abad7fe60e0a25ad1e7ac1b6f559b70dde5
Instruction Fuzzy Hash: 4D61513260AB46D6E7208F26E44056D73A4FB48BE4F544635DBAD477A0DF38E462C724

Function 00007FF8A8DF44F3 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 253COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0DEB8
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E0DF4F

Strings

error_code:, xrefs: 00007FF8A8E0DF3E
error_msg:, xrefs: 00007FF8A8E0DF58
F:\Demo\ipc_sdk_fix\src\ipc_core\service_dispatcher.cc, xrefs: 00007FF8A8E0DEFE
[ServiceDispatcher], xrefs: 00007FF8A8E0DF20
ProcessWithError, xrefs: 00007FF8A8E0DF2F

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_invalid_parameter_noinfo_noreturn
String ID: ProcessWithError$ error_code:$ error_msg:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_dispatcher.cc$[ServiceDispatcher]
API String ID: 1288313053-1481858631
Opcode ID: 85e3f92a49e99de0b813c28b3fbd7c96622441fbd1ddb4b3cae97015a5920772
Instruction ID: fe6961a82ff38937aa49dbb9b87eccb0576ad0abebf2080a8d8f0a66ea628af0
Opcode Fuzzy Hash: 85e3f92a49e99de0b813c28b3fbd7c96622441fbd1ddb4b3cae97015a5920772
Instruction Fuzzy Hash: 7AB1C132A0AB81E2EB159B25E0403AD7BB1FB45BD8F044535DA8D07799CF3CD8A5C358

Function 00007FF8A8DF3913 Relevance: 12.5, APIs: 8, Instructions: 461COMMON

Download Yara Rule

APIs

_Mtx_lock.MSVCP140 ref: 00007FF8A8E455C8
_Mtx_unlock.MSVCP140 ref: 00007FF8A8E455E5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E45775
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF8A8E457BC
?_Throw_C_error@std@@YAXH@Z.MSVCP140 ref: 00007FF8A8E457C4
_Mtx_lock.MSVCP140 ref: 00007FF8A8E45882
_Mtx_unlock.MSVCP140 ref: 00007FF8A8E4591F
?_Throw_C_error@std@@YAXH@Z.MSVCP140 ref: 00007FF8A8E4593C

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: C_error@std@@Mtx_lockMtx_unlockThrow_$Xbad_function_call@std@@_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4168631804-0
Opcode ID: 725138640a6abafdfa69e5b37e3e932620653dab95d96fc8864c0ca53efe9cce
Instruction ID: a50f99ef897a27c41902c3ad2668c17858818197caed8739363b63bde08d8f97
Opcode Fuzzy Hash: 725138640a6abafdfa69e5b37e3e932620653dab95d96fc8864c0ca53efe9cce
Instruction Fuzzy Hash: 8BB17872B06B46EAEF04DBA5D5902AC63A5EB48BC8F044536DF5E13B98DF38D461C314

Function 00007FF8A8DF1456 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 205COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E5DB18
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E5DB52

Strings

[p2p_channel] Shutdown, xrefs: 00007FF8A8E5DAF7
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E5DAC7
is_offer_channel:, xrefs: 00007FF8A8E5DB06
status:, xrefs: 00007FF8A8E5DB3C
session_id:, xrefs: 00007FF8A8E5DB21

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@V01@_
String ID: is_offer_channel:$ session_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] Shutdown
API String ID: 2174223929-317867943
Opcode ID: 6a473a3c5d62b510d7d57ef9345b24da61a0fc2c6cb762a65a59396a35bfba93
Instruction ID: 39e95d60c60fb504dc6af76dfca2a38271993f417025524f1a4f7067f457d733
Opcode Fuzzy Hash: 6a473a3c5d62b510d7d57ef9345b24da61a0fc2c6cb762a65a59396a35bfba93
Instruction Fuzzy Hash: D7A1BCB2B0AB41E5EB59CB25D0443A87BA1FB88BD8F059135CA1D87395CF7CD8A5C314

Function 00007FF8A8DF1258 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E84B37
GetLastError.KERNEL32 ref: 00007FF8A8E84B44
MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E84B81
SetConsoleTitleW.KERNEL32 ref: 00007FF8A8E84B9C
EnterCriticalSection.KERNEL32 ref: 00007FF8A8E84BAD
LeaveCriticalSection.KERNEL32 ref: 00007FF8A8E84BD5

Strings

uv__malloc, xrefs: 00007FF8A8E84BFE

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharCriticalMultiSectionWide$ConsoleEnterErrorLastLeaveTitle
String ID: uv__malloc
API String ID: 404336161-1058249677
Opcode ID: acca80b4a1d4da722e8969b82f1e5e12abc44a88de099f35a51ca64445f9cc16
Instruction ID: 872012560abfd7f0c511bb6e9d84b6c833f7e2b43d186eac24a2d19717aacb82
Opcode Fuzzy Hash: acca80b4a1d4da722e8969b82f1e5e12abc44a88de099f35a51ca64445f9cc16
Instruction Fuzzy Hash: AC21A231E0EB43A6F714AB76A450179A7A1FF84BC4F444035DA5D877A5EF3CE8648328

Function 00007FF8A8DF2C07 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 145COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E34FDD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E35137

Strings

error_code:, xrefs: 00007FF8A8E34FCC
F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E34F7F, 00007FF8A8E3504F
[p2p_biz_service] OnCreateOfferChannelFailure, xrefs: 00007FF8A8E34F9E, 00007FF8A8E3506F
can not find task session_id:, xrefs: 00007FF8A8E3507E
session_id:, xrefs: 00007FF8A8E34FAD

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_invalid_parameter_noinfo_noreturn
String ID: can not find task session_id:$ error_code:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] OnCreateOfferChannelFailure
API String ID: 1288313053-3209137205
Opcode ID: ab2ba3f74cee1d9884fd71492fe7509912d9accfb662ad90c8c2ddde548e243c
Instruction ID: 5bd851cb4c5b61aa1da794957532e6d8254602d167729e3891fe1d495d0aefbe
Opcode Fuzzy Hash: ab2ba3f74cee1d9884fd71492fe7509912d9accfb662ad90c8c2ddde548e243c
Instruction Fuzzy Hash: A151B072B0A682E1EE209B15D8453BD2360EF817D4F405236EA5E077E9DF7CD949CB14

Function 00007FF8A8DF10B4 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 141COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E35A34
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E35B6B

Strings

error_code:, xrefs: 00007FF8A8E35A22
F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E359D5, 00007FF8A8E35A86
[p2p_biz_service] OnCreateOfferFailure, xrefs: 00007FF8A8E359F4, 00007FF8A8E35AA5
can not find task session_id:, xrefs: 00007FF8A8E35AB4
session_id:, xrefs: 00007FF8A8E35A03

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_invalid_parameter_noinfo_noreturn
String ID: can not find task session_id:$ error_code:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] OnCreateOfferFailure
API String ID: 1288313053-2028272428
Opcode ID: d4244bd268e4449ad45e9d3b03891283fb7fbff30bfe0fd0344e37ec19f0e5ce
Instruction ID: 93de5e47ff48048e5bfb8173bc7a620bb019ce88cbb2ff97b05c6c548a39f7d5
Opcode Fuzzy Hash: d4244bd268e4449ad45e9d3b03891283fb7fbff30bfe0fd0344e37ec19f0e5ce
Instruction Fuzzy Hash: 9351D172B0A682A1EA209B15D8843BE6360FF847D4F405136EA9E077A9DF7CD849D718

Function 00007FF8A8DF2DF1 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 119COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E7BDAB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E7BE23
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E7BE8F

Strings

client_address:, xrefs: 00007FF8A8E7BDB4
listener_id:, xrefs: 00007FF8A8E7BD99
[p2p_tcp_listener] OnAcceptTcpClient, xrefs: 00007FF8A8E7BD8A
F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_listener.cc, xrefs: 00007FF8A8E7BD6B

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: client_address:$ listener_id:$F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_listener.cc$[p2p_tcp_listener] OnAcceptTcpClient
API String ID: 3484296013-3338592154
Opcode ID: d513ea1571afd83e5483d2ca2555aaa216abf7537c2b838399f238e6260ba48e
Instruction ID: 935e94b7e83cb0a878cf60163f91786dcdf9e48bcc1050e43f0333eb46f1af7d
Opcode Fuzzy Hash: d513ea1571afd83e5483d2ca2555aaa216abf7537c2b838399f238e6260ba48e
Instruction Fuzzy Hash: B941D672A0A686A1EB359B25E4453AE6351EFC4BE4F004231DA6D077EADF7CD449C314

Function 00007FF8A8DF17F3 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z.MSVCP140 ref: 00007FF8A8E0CCB9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0CD14

Strings

request_uri:, xrefs: 00007FF8A8E0CC87
request_mid:, xrefs: 00007FF8A8E0CCA6
F:\Demo\ipc_sdk_fix\src\ipc_core\service_dispatcher.cc, xrefs: 00007FF8A8E0CC47
OnProcessTimeout the request not response in long time, xrefs: 00007FF8A8E0CC78
[ServiceDispatcher], xrefs: 00007FF8A8E0CC69

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@__invalid_parameter_noinfo_noreturn
String ID: OnProcessTimeout the request not response in long time$ request_mid:$ request_uri:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_dispatcher.cc$[ServiceDispatcher]
API String ID: 2506420284-2914017521
Opcode ID: 7458b377f6a56050abbe1639b1d3ef6b58f5ef2317bb30e67d7638510fea922d
Instruction ID: d365a27e87badf56edfde565a41d556416c94d78fa76e3a96ce574eebc4f8a24
Opcode Fuzzy Hash: 7458b377f6a56050abbe1639b1d3ef6b58f5ef2317bb30e67d7638510fea922d
Instruction Fuzzy Hash: EC4103B2B0AA82E1EF208B15D4403A96761FF84BD4F405536DA9C077E9CF7CD995C718

Function 00007FF8A8DF1A7D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_get_osfhandle.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A8E8EBB7
DuplicateHandle.KERNEL32 ref: 00007FF8A8E8EC03
GetConsoleScreenBufferInfo.KERNEL32 ref: 00007FF8A8E8EC22
GetLastError.KERNEL32 ref: 00007FF8A8E8EC2C

Strings

, xrefs: 00007FF8A8E8EC78

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: BufferConsoleDuplicateErrorHandleInfoLastScreen_get_osfhandle
String ID:
API String ID: 771073996-3916222277
Opcode ID: 890c3d69678f03148acb10bd28975046b39569f5f38e53f8c66e54230b6b9214
Instruction ID: 4e8e5390ed73dd273008c2e39a8eba5b0a06ba29e0a3c03d766027e72dfabb99
Opcode Fuzzy Hash: 890c3d69678f03148acb10bd28975046b39569f5f38e53f8c66e54230b6b9214
Instruction Fuzzy Hash: E6517E3290AB82D6E710DF34E8402AD33A4FB45BA8F540235DEAC577A8DF38D4A5C764

Function 00007FF8A8DF173F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A8E845F8
GetLastError.KERNEL32 ref: 00007FF8A8E84609
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8E84730
GetLastError.KERNEL32 ref: 00007FF8A8E8473A

Strings

USERPROFILE, xrefs: 00007FF8A8E845F1

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$ByteCharEnvironmentMultiVariableWide
String ID: USERPROFILE
API String ID: 1285860569-2419442777
Opcode ID: b4e88fe1b9a41d51ba2f5578b6ddaef0d1b68650db12886ab41669f026686d51
Instruction ID: eb503c30c6a65da2409a61278367163422926f0055636b84f6adbe9e9dbf676a
Opcode Fuzzy Hash: b4e88fe1b9a41d51ba2f5578b6ddaef0d1b68650db12886ab41669f026686d51
Instruction Fuzzy Hash: EA418D35A0EB82E1EB609F35A44436D72D0FF44794F844236DA6D876D4EF3CE4649728

Function 00007FF8A8DF344A Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 95COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E79C21
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z.MSVCP140 ref: 00007FF8A8E79C3C

Strings

F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_client.cc, xrefs: 00007FF8A8E79BD3
connection_id:, xrefs: 00007FF8A8E79C0F
nread:, xrefs: 00007FF8A8E79C2A
[p2p_tcp_client] OnRead, xrefs: 00007FF8A8E79C00
nread_desc:, xrefs: 00007FF8A8E79C45

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@V01@_
String ID: connection_id:$ nread:$ nread_desc:$F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_client.cc$[p2p_tcp_client] OnRead
API String ID: 2174223929-1289017584
Opcode ID: e51875a9b5ffe705f6546afb0eccc7540a0acdfae9d64f3603617ae1368362bb
Instruction ID: cdcabca8b6501270800590a07ec709951ec176c86efb45a598bcf9565bfd82ff
Opcode Fuzzy Hash: e51875a9b5ffe705f6546afb0eccc7540a0acdfae9d64f3603617ae1368362bb
Instruction Fuzzy Hash: D4319E22B0A542A5FE26AB15D4103B967A0EF84BC4F044035DE4E177A6EF3DE94AD328

Function 00007FF8A8E02AB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E02B39
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E02B53

Strings

error_code:, xrefs: 00007FF8A8E02B42
[IPCServiceHostBizHandler], xrefs: 00007FF8A8E02B0A
F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_service_host_biz_handler.cc, xrefs: 00007FF8A8E02AE8, 00007FF8A8E02BAA
StartWithPort failure, xrefs: 00007FF8A8E02B19
port_number:, xrefs: 00007FF8A8E02B28

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: StartWithPort failure$ error_code:$ port_number:$F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_service_host_biz_handler.cc$[IPCServiceHostBizHandler]
API String ID: 3768306364-882206633
Opcode ID: 3769ba440555f3767ea9deb19306a186774db24c33150faf1dd3933b9f96e99f
Instruction ID: 7681d3d9b527ece230af7fa084e24338db6220c95bd6e438663c22db69f7fc4b
Opcode Fuzzy Hash: 3769ba440555f3767ea9deb19306a186774db24c33150faf1dd3933b9f96e99f
Instruction Fuzzy Hash: C941A032A0A603E6EB22DF11D4412A937B0FB94BC4F458536DA9D073A6DF7CE919C714

Function 00007FF8A8E10254 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E102FC
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E10336

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E102AB
[p2p_channel] OnPortTimeout, xrefs: 00007FF8A8E102DB
is_offer_channel:, xrefs: 00007FF8A8E102EA
session_id:, xrefs: 00007FF8A8E10305
channel_status:, xrefs: 00007FF8A8E10320

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@V01@_
String ID: channel_status:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] OnPortTimeout
API String ID: 2174223929-2115121396
Opcode ID: be310591123e0a80f8ecdf9aa4cc98210e508ef15c5fa84b1efd3e28fee5bb5c
Instruction ID: f2a68b94079c4c3fd2b07d851a038ea1f0a5d21b6de3085e6e809cc7d6ca4a91
Opcode Fuzzy Hash: be310591123e0a80f8ecdf9aa4cc98210e508ef15c5fa84b1efd3e28fee5bb5c
Instruction Fuzzy Hash: 8B310332A0A642EAEB56DF12E4546E937A0FB80BC0F418036DA4C07755EF3CD919C714

Function 00007FF8A8DF3C3D Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 70COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E102FC
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E10336

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E102AB
[p2p_channel] OnPortTimeout, xrefs: 00007FF8A8E102DB
is_offer_channel:, xrefs: 00007FF8A8E102EA
session_id:, xrefs: 00007FF8A8E10305
channel_status:, xrefs: 00007FF8A8E10320

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@V01@_
String ID: channel_status:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] OnPortTimeout
API String ID: 2174223929-2115121396
Opcode ID: a90c464fb8b944278414fb6d8db249a538dc59854436c584fafe48f591369144
Instruction ID: 6973efcc4b8ff301feef2009fd26f44a3fd8eb1145890f1b501ce08019523829
Opcode Fuzzy Hash: a90c464fb8b944278414fb6d8db249a538dc59854436c584fafe48f591369144
Instruction Fuzzy Hash: BE31F132A0AA42E6EA65EF12E4446E933A0FF84BC4F418036DE4C0B765DF7CDA59D714

Function 00007FF8A8DF1758 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 66COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E61FDA
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E62014

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc, xrefs: 00007FF8A8E61F89
[p2p_channel] NotifyConnected Choice, xrefs: 00007FF8A8E61FB9
best_connection_id_:, xrefs: 00007FF8A8E61FFE
is_offer_channel:, xrefs: 00007FF8A8E61FC8
session_id:, xrefs: 00007FF8A8E61FE3

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@V01@_
String ID: best_connection_id_:$ is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel.cc$[p2p_channel] NotifyConnected Choice
API String ID: 2174223929-3999181277
Opcode ID: 4c0e4dbf6132cf7a23bde8804de30562e13547e43e54e0a61cbd02c680fc1491
Instruction ID: 96a38b3662c944a822645233f1e9c3591d9b9522b568f79eac2ae72e280244bf
Opcode Fuzzy Hash: 4c0e4dbf6132cf7a23bde8804de30562e13547e43e54e0a61cbd02c680fc1491
Instruction Fuzzy Hash: 9721E131A0AA02E0EA25EB12E8146F933A0FF84BC0F418036D95D077A6DF7CE959D714

Function 00007FF8A8DF22C5 Relevance: 12.2, APIs: 8, Instructions: 213networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00007FF8A8E8921A
setsockopt.WS2_32 ref: 00007FF8A8E892A4
WSAGetLastError.WS2_32 ref: 00007FF8A8E892AF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E892DA
setsockopt.WS2_32 ref: 00007FF8A8E8937A
WSAGetLastError.WS2_32 ref: 00007FF8A8E89384

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLastsetsockopt$aborthtonl
String ID:
API String ID: 3432098490-0
Opcode ID: a0466477c93e2976a461f370833315476f7380441b9bd30f558defecd38b88b3
Instruction ID: 3c2c2d127d8dec89bbd7bb1186bd2daf49bb98349a0a4750fd8028aba2318c1a
Opcode Fuzzy Hash: a0466477c93e2976a461f370833315476f7380441b9bd30f558defecd38b88b3
Instruction Fuzzy Hash: CE51C331E2D682D6FB10DB35A44437E73A1EF85784F904235EA4D826A4EF3CD855CB28

Function 00007FF8A8E9CD30 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 399COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF8A8E9CDB1
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8E9CDD3

Strings

uv__malloc, xrefs: 00007FF8A8E9CE7A

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CurrentDirectory_wcsdup
String ID: uv__malloc
API String ID: 1996952656-1058249677
Opcode ID: 529a0629354de2c7e768d89e8e3a998b529030a3fb070971a5d0bddaab9fbeb4
Instruction ID: 9ff52256c59f5cddb5d2e5255ec860011ed29d37b3433991a399d75ed1e8bf43
Opcode Fuzzy Hash: 529a0629354de2c7e768d89e8e3a998b529030a3fb070971a5d0bddaab9fbeb4
Instruction Fuzzy Hash: FB818832A0AB82E1EB149FA995403B8B760FB58BD4F049234DF6D43295EF78E5A58314

Function 00007FF8A8DF24F0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 321COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E05A34
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E05AD8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E05C03

Strings

[p2p] create offer channel success, xrefs: 00007FF8A8E05B81
F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_service_invoker_biz_handler.cc, xrefs: 00007FF8A8E05B62
session_id:, xrefs: 00007FF8A8E05B90

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: session_id:$F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_service_invoker_biz_handler.cc$[p2p] create offer channel success
API String ID: 3668304517-3239129713
Opcode ID: 025cb17ced05f9131bad53cc8149e3e86511b916a32cf77549cc3d518458b7fc
Instruction ID: 7fa639f2ea63f9a79f7a4c41f992d820245512f6db9bd9dce39b6bed9768b528
Opcode Fuzzy Hash: 025cb17ced05f9131bad53cc8149e3e86511b916a32cf77549cc3d518458b7fc
Instruction Fuzzy Hash: 7C91ED72A0AA81E1EF14CB29E0843BD2370EB84BD8F504531DA9D0779ADF7CD895C714

Function 00007FF8A8DF1285 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 255COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E0DF4F

Strings

error_code:, xrefs: 00007FF8A8E0DF3E
error_msg:, xrefs: 00007FF8A8E0DF58
F:\Demo\ipc_sdk_fix\src\ipc_core\service_dispatcher.cc, xrefs: 00007FF8A8E0DEFE
[ServiceDispatcher], xrefs: 00007FF8A8E0DF20
ProcessWithError, xrefs: 00007FF8A8E0DF2F

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: ProcessWithError$ error_code:$ error_msg:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_dispatcher.cc$[ServiceDispatcher]
API String ID: 3768306364-1481858631
Opcode ID: 38b521240d3abc1e6bb98a94358e23e8fec10612a6595572bc175d8c2b300298
Instruction ID: 2ad537776d91dec80b92d0188206c5e9fbad7fa0e225833dd93c7a736de1f309
Opcode Fuzzy Hash: 38b521240d3abc1e6bb98a94358e23e8fec10612a6595572bc175d8c2b300298
Instruction Fuzzy Hash: 89B1E432A0AB82E2EB649B15E4403A977B0FB89BD4F088539DE8D07795CF3CD855C758

Function 00007FF8A8DF187F Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 200COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E4F415
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E4F60D

Strings

IsOfferChannel:, xrefs: 00007FF8A8E4F402
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc, xrefs: 00007FF8A8E4F3A7
[p2p_channel_service] OnChannelClosed, xrefs: 00007FF8A8E4F3D4
session_id:, xrefs: 00007FF8A8E4F3E3

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@__invalid_parameter_noinfo_noreturn
String ID: IsOfferChannel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc$[p2p_channel_service] OnChannelClosed
API String ID: 2506420284-2279400858
Opcode ID: e381acc589870a05f1d9aefcc1b08f91138d19cd9b605e5cdbda5adb13115486
Instruction ID: 4a1fe60170aec2109d6145902a9f45b14d6103b846e47b4b31fe54ef1533e3af
Opcode Fuzzy Hash: e381acc589870a05f1d9aefcc1b08f91138d19cd9b605e5cdbda5adb13115486
Instruction Fuzzy Hash: D581A132A09A86E2EB25DF21E4402AE6361FB48FD4F445032DB9D07B99DF7DE859C314

Function 00007FF8A8DF1CA8 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z.MSVCP140 ref: 00007FF8A8E62F10
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E63104

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc, xrefs: 00007FF8A8E62EA1
[p2p_channel_service] CloseChannel, xrefs: 00007FF8A8E62ED0
is_offer_channel:, xrefs: 00007FF8A8E62EFD
session_id:, xrefs: 00007FF8A8E62EDF

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@__invalid_parameter_noinfo_noreturn
String ID: is_offer_channel:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc$[p2p_channel_service] CloseChannel
API String ID: 2506420284-1107017043
Opcode ID: df486fbdc7404276d812ad335d294c18c3651bb7b7deca675d6ec669947274f2
Instruction ID: dd93ed9e7e2dff1f246199003439502396102ae5111f783d4104cf380a64687b
Opcode Fuzzy Hash: df486fbdc7404276d812ad335d294c18c3651bb7b7deca675d6ec669947274f2
Instruction Fuzzy Hash: 9181B33260AB81A5EB24DF24D8403ED7361FB487C8F409135DA9D07AA9EF7CE699C714

Function 00007FF8A8DF21E9 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E501E3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E503A9

Strings

enable_fix_ipc_crash_1128, xrefs: 00007FF8A8E50347
listener_id:, xrefs: 00007FF8A8E501D1
F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_listener.cc, xrefs: 00007FF8A8E501A3
[p2p_tcp_listener] Stop, xrefs: 00007FF8A8E501C2

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_invalid_parameter_noinfo_noreturn
String ID: listener_id:$F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_listener.cc$[p2p_tcp_listener] Stop$enable_fix_ipc_crash_1128
API String ID: 1288313053-1977421095
Opcode ID: 2296e8629329c27c21dea810955febfa2f13a70146ae0ea2c72514b75fa61d02
Instruction ID: 492489078f9caa2b2cebc13ba73af5b057e022e3c50b51d979eeb835622b3ceb
Opcode Fuzzy Hash: 2296e8629329c27c21dea810955febfa2f13a70146ae0ea2c72514b75fa61d02
Instruction Fuzzy Hash: 3771C072A0AB81E6EB648F21D9403AC33A0FB457E4F009235EA6D07B95DF7CE959C314

Function 00007FF8A8DF298C Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E40BD0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E40C7E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E40CE4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E40D3C

Strings

e_id, xrefs: 00007FF8A8E40B55
e_p_k, xrefs: 00007FF8A8E40C0A

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: e_id$e_p_k
API String ID: 3668304517-616680305
Opcode ID: a8ad7dbc5e599b0ad9c5ff62322b98e923268516f6f7e47f23841ac5925bb072
Instruction ID: 6c08f45c5d49fd0a6f1d257764a538084247d1f4a330e96aacc8fd0bd461c348
Opcode Fuzzy Hash: a8ad7dbc5e599b0ad9c5ff62322b98e923268516f6f7e47f23841ac5925bb072
Instruction Fuzzy Hash: 86618F72F19A42AAFB00DBB4D4443EC2371EB047E8F400235DA6D27AD9DF78955AD358

Function 00007FF8A8DF218A Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E41640
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E416EE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E41754
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E417AC

Strings

e_id, xrefs: 00007FF8A8E415C5
e_p_k, xrefs: 00007FF8A8E4167A

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: e_id$e_p_k
API String ID: 3668304517-616680305
Opcode ID: 5d594529338888f853e660450bd84c93312501939656591e9867cab575de28c6
Instruction ID: e0ca3cca4797b58717644294ba2895b6678567c3971805c10316ec5bed069e16
Opcode Fuzzy Hash: 5d594529338888f853e660450bd84c93312501939656591e9867cab575de28c6
Instruction Fuzzy Hash: FF618172F59A42A9FB00DBB4D4443EC2372EB057E8F400235DA6D27AD9DF78949AD318

Function 00007FF8A8DF2AA4 Relevance: 10.7, APIs: 7, Instructions: 153networkCOMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00007FF8A8E80DE9
WSAGetLastError.WS2_32 ref: 00007FF8A8E80DF4
closesocket.WS2_32 ref: 00007FF8A8E80E7C
UnregisterWait.KERNEL32 ref: 00007FF8A8E80ED9
CloseHandle.KERNEL32 ref: 00007FF8A8E80EF6
UnregisterWait.KERNEL32 ref: 00007FF8A8E80F44
CloseHandle.KERNEL32 ref: 00007FF8A8E80F61

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CloseHandleUnregisterWait$ErrorLastclosesocketshutdown
String ID:
API String ID: 1892040934-0
Opcode ID: 895f1b10051fa56e78857eb4bc54147f57ae2e8e43989d78cfe78995a1dd2981
Instruction ID: b10c97bde0e426e670456422aaa7148950f039943482fdd5955d7031fe35fc72
Opcode Fuzzy Hash: 895f1b10051fa56e78857eb4bc54147f57ae2e8e43989d78cfe78995a1dd2981
Instruction Fuzzy Hash: 8C714F32A0AA82D6EB558F25D05426C33A1FB49FB8F584235DEAD473D4CF38D8A1C764

Function 00007FF8A8DF11EF Relevance: 10.6, APIs: 7, Instructions: 142COMMON

Download Yara Rule

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF8A8E3E575
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF8A8E3E591
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF8A8E3E5C5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E3E63A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E3E64E
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF8A8E3E713
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF8A8E3E71D

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@??6?$basic_ostream@D@std@@@1@@V01@V?$basic_streambuf@_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2113449081-0
Opcode ID: 2d3b7a891eb1e3a4ed3560058448651f8da63ed2003b4e695d00279b0531d6c4
Instruction ID: 1625675bf63fccf88d1378d40d0748684d6a9cfa527c4f7c573c3180657e727e
Opcode Fuzzy Hash: 2d3b7a891eb1e3a4ed3560058448651f8da63ed2003b4e695d00279b0531d6c4
Instruction Fuzzy Hash: D1617C72A1AB82E6EB10CF65E4802AE7760FB84BD4F504136DA4D13B58DF3CD956CB44

Function 00007FF8A8DF2176 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 141COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E353F9

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E35257, 00007FF8A8E35311
[p2p_biz_service] OnCreateOfferChannelSuccess , xrefs: 00007FF8A8E35331
[p2p_biz_service] OnCreateOfferChannelSuccess, xrefs: 00007FF8A8E35276
can not find task session_id:, xrefs: 00007FF8A8E35340
session_id:, xrefs: 00007FF8A8E35285

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: can not find task session_id:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] OnCreateOfferChannelSuccess$[p2p_biz_service] OnCreateOfferChannelSuccess
API String ID: 3668304517-837040497
Opcode ID: bb612034a3d022bd66f4600d340e84705a2f425a3cf0559dd523b2e45f63d829
Instruction ID: 0764f3ed1535a49675ecff31d251ffa20d05e476dd57eeb656e1f8e3799bb191
Opcode Fuzzy Hash: bb612034a3d022bd66f4600d340e84705a2f425a3cf0559dd523b2e45f63d829
Instruction Fuzzy Hash: 3751C171B1A682A1EE24DB15E4843AD6321FF807D4F405236DA9E07BA9DF7CD84AC714

Function 00007FF8A8DFDBF0 Relevance: 10.6, APIs: 7, Instructions: 135COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF8A8DFDC8B
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF8A8DFDCE6
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF8A8DFDD08
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF8A8DFDD29
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF8A8DFDD71
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF8A8DFDD78
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF8A8DFDD84

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: c27ea9acda252501af370a1c59a84440012a5e8cc3e6ec8cb3ab845bd2409f9c
Instruction ID: b1e693483aa7b8bf167ac8c033ac7e52348fe50b317ec5ec5a7dc3c5c4021692
Opcode Fuzzy Hash: c27ea9acda252501af370a1c59a84440012a5e8cc3e6ec8cb3ab845bd2409f9c
Instruction Fuzzy Hash: 8551AA3260A74192EB209F19E5902386B60FB85FD5F15C532CE6E877A0CFBDD846D318

Function 00007FF8A8DF2E37 Relevance: 10.6, APIs: 7, Instructions: 134COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF8A8E00DB7
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF8A8E00E0E
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF8A8E00E38
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF8A8E00E73
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF8A8E00EA7
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF8A8E00EAE
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF8A8E00EBA

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: c16f40aad10de4241cca1555acd006f60aabed336f6537d8bbeeafc05d2cf496
Instruction ID: a7dade0b1de06237474eb9524018d391bf8db53be49072cdafef90d1cd79c6b4
Opcode Fuzzy Hash: c16f40aad10de4241cca1555acd006f60aabed336f6537d8bbeeafc05d2cf496
Instruction Fuzzy Hash: 22515432A49A45D2EF208B1AE590239A770EB85FD1F158936CF4F577A0CF3DE5528328

Function 00007FF8A8DF4183 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E50C55
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E50D08

Strings

enable_fix_ipc_crash_1128, xrefs: 00007FF8A8E50C98
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc, xrefs: 00007FF8A8E50C09
[p2p_channel_service] OnPortClosed, xrefs: 00007FF8A8E50C35
server_port:, xrefs: 00007FF8A8E50C44

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_invalid_parameter_noinfo_noreturn
String ID: server_port:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc$[p2p_channel_service] OnPortClosed$enable_fix_ipc_crash_1128
API String ID: 1288313053-847124544
Opcode ID: 7af632c0cf7fbc55719820654eb37635b62a8c1e9cd800d473dc5e3b388f7b5c
Instruction ID: c50b7f7a28a0c580177bd8bc95d977b75d163d1d3e52e9284c847f236edeb0b8
Opcode Fuzzy Hash: 7af632c0cf7fbc55719820654eb37635b62a8c1e9cd800d473dc5e3b388f7b5c
Instruction Fuzzy Hash: 8C5104B2E09A82E1EB29CB15E4543E92761FB88BD4F401131DA6C077D9DF7CE998C314

Function 00007FF8A8DF3508 Relevance: 10.6, APIs: 7, Instructions: 127COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF8A8E29B93
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF8A8E29C0A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF8A8E29C30
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF8A8E29C5B
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF8A8E29C9C
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF8A8E29CA3
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF8A8E29CAF

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 2331969452-0
Opcode ID: 82278131e255e556153498e9f0a8661215902a7b046e364ff9df4a7f8448fa5e
Instruction ID: 579d0068e766d6f46e7310cfaf024b59a5f3adbc471e686ad47d436cb4ba926f
Opcode Fuzzy Hash: 82278131e255e556153498e9f0a8661215902a7b046e364ff9df4a7f8448fa5e
Instruction Fuzzy Hash: CF518E3260AA41D2EF209F5AE490678A7A0FF84FD5F119636CE4E477A0DF39C856C718

Function 00007FF8A8DF2BA3 Relevance: 10.6, APIs: 7, Instructions: 101networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF8A8E9E399
WSASetLastError.WS2_32 ref: 00007FF8A8E9E3A6
WSASetLastError.WS2_32 ref: 00007FF8A8E9E407
WSASetLastError.WS2_32 ref: 00007FF8A8E9E419
WSASetLastError.WS2_32 ref: 00007FF8A8E9E428

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: e892c71aa2e84246bec08cab1186e3acb29764d05ea452712c74ba07214d1eda
Instruction ID: 40376f905956e874f382e32c755bfa97f50b6a3bdb66177cc0dda8974c5dbb01
Opcode Fuzzy Hash: e892c71aa2e84246bec08cab1186e3acb29764d05ea452712c74ba07214d1eda
Instruction Fuzzy Hash: CB416D31A09A82D7E7649F65E44432DB3A0FB48B90F144539D79E87794DFBCE8908B14

Function 00007FF8A8DF2B9E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8A8E91DDB
WSAGetLastError.WS2_32 ref: 00007FF8A8E91DE6
WSAIoctl.WS2_32 ref: 00007FF8A8E91E36
getsockopt.WS2_32 ref: 00007FF8A8E91EA7
WSAGetLastError.WS2_32 ref: 00007FF8A8E91EB1

Strings

, xrefs: 00007FF8A8E91E3C

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$Ioctlgetsockoptioctlsocket
String ID:
API String ID: 1455146299-3916222277
Opcode ID: 5c5f2dfabd663d7c186282f32a53a3a5765ca34893a2bc2d3ee51e6f663e3b79
Instruction ID: c7f27f36c46d0a824c0ffde8b3b09653088cbaf69165e8a9d26502086f59322e
Opcode Fuzzy Hash: 5c5f2dfabd663d7c186282f32a53a3a5765ca34893a2bc2d3ee51e6f663e3b79
Instruction Fuzzy Hash: 7641C132619B82D6E7108F70E8443ADB3A8FB44BA8F500235DA9C43B98DF7CD459C714

Function 00007FF8A8DF42BE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

wcspbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8E942FA
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8E94312
wcspbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8E9432B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8E9434F

Strings

", xrefs: 00007FF8A8E942F3

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: wcsncpy_swcspbrk
String ID: "
API String ID: 622993510-3282986335
Opcode ID: aa104f9aa74b176c5dbd618d907352af3c8b721cd6bb3c205ddba0d1b0cda0ef
Instruction ID: 7f1e7202a2175af77ca4f4bf5c0f6d66d787fb31b0392d792c512e00cf5611a2
Opcode Fuzzy Hash: aa104f9aa74b176c5dbd618d907352af3c8b721cd6bb3c205ddba0d1b0cda0ef
Instruction Fuzzy Hash: E8316B32A0AB42E1EB158F61E5002B9B3A1FB54BD8F549131CA1E03798EFBCD565C398

Function 00007FF8A8E894A0 Relevance: 10.6, APIs: 7, Instructions: 82networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8A8E894F3
WSAGetLastError.WS2_32 ref: 00007FF8A8E894FE

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLastioctlsocket
String ID:
API String ID: 1021210092-0
Opcode ID: 70fde51375b36e90c76aca8390338905a4285b5b6e726838664f5c8dc0169482
Instruction ID: a500da40aecf9d20a61163a5041a7b0e1a8a39112c61db9e925d88a887f58f34
Opcode Fuzzy Hash: 70fde51375b36e90c76aca8390338905a4285b5b6e726838664f5c8dc0169482
Instruction Fuzzy Hash: 52319031E0EA42E6EB609B24E9447BD23A1FF44BD4F900231EA5D46AE4DF3CD8598734

Function 00007FF8A8DF11C7 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E7BB75
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E7BC00

Strings

[p2p_tcp_listener] uv_close emited, xrefs: 00007FF8A8E7BBDF
[p2p_tcp_listener] CloseInner, xrefs: 00007FF8A8E7BB54
listener_id:, xrefs: 00007FF8A8E7BB63, 00007FF8A8E7BBEE
F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_listener.cc, xrefs: 00007FF8A8E7BB32, 00007FF8A8E7BBBF

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: listener_id:$F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_listener.cc$[p2p_tcp_listener] CloseInner$[p2p_tcp_listener] uv_close emited
API String ID: 3768306364-3241148269
Opcode ID: 04a153c9ad721c6e6dccddcfa01a6a6f5f4f41fca8f7a7d1a1950d6eed5f5410
Instruction ID: 610bb7c038243ae0ccb5bf80b50cf1017ad646c1b8c1b9bdf3c8fa183c8882cc
Opcode Fuzzy Hash: 04a153c9ad721c6e6dccddcfa01a6a6f5f4f41fca8f7a7d1a1950d6eed5f5410
Instruction Fuzzy Hash: C7318F31A1A643E2EB21DB21E8416B97360FF853C0F805136DA9D436AAEF7CE909C714

Function 00007FF8A8DF1717 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E18923
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E1893E

Strings

connection_id:, xrefs: 00007FF8A8E1890E
F:\Demo\ipc_sdk_fix\src\p2p\p2p_answer_channel_handshake.cc, xrefs: 00007FF8A8E188DD
[p2p_answer_handshake] Stop, xrefs: 00007FF8A8E188FF
status:, xrefs: 00007FF8A8E1892C

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: connection_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_answer_channel_handshake.cc$[p2p_answer_handshake] Stop
API String ID: 3768306364-944459459
Opcode ID: 798e992350cb8dc45078ba544a7dfb9474b1527fa22a0ef1dbc7df8eb2707867
Instruction ID: fac5f96d7f353b1937dcbd129806e2f7f7e2a5cbfc5f19f284856ba0fb1bd047
Opcode Fuzzy Hash: 798e992350cb8dc45078ba544a7dfb9474b1527fa22a0ef1dbc7df8eb2707867
Instruction Fuzzy Hash: BB319F32A0A583E2EB65DB21D8503BD6360FF80BC4F444032DA4D476AADF7CE859C764

Function 00007FF8A8E12335 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 63COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E123B5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E123D0

Strings

connection_id:, xrefs: 00007FF8A8E123A0
F:\Demo\ipc_sdk_fix\src\p2p\p2p_answer_channel_handshake.cc, xrefs: 00007FF8A8E1236F
status:, xrefs: 00007FF8A8E123BE
[p2p_answer_handshake] OnHandleshakeTimeout, xrefs: 00007FF8A8E12391

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: connection_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_answer_channel_handshake.cc$[p2p_answer_handshake] OnHandleshakeTimeout
API String ID: 3768306364-3297076769
Opcode ID: 3a9ece091fb2261737d3cfc249440dbbd150ece4c2eef3d0cc6b09d4f3d08345
Instruction ID: 25364ac412c6da8d842e2e71f23fc0a58244d4e236fcaaad376c23ecfef7030f
Opcode Fuzzy Hash: 3a9ece091fb2261737d3cfc249440dbbd150ece4c2eef3d0cc6b09d4f3d08345
Instruction Fuzzy Hash: 7E21A132A0A683E6DB36DF25E8403E973A1FB94B84F404136C64C07A69DF7CE958CB54

Function 00007FF8A8DF2D5B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 61COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E72F07
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E72F25

Strings

connection_id:, xrefs: 00007FF8A8E72EF6
F:\Demo\ipc_sdk_fix\src\p2p\p2p_pending_channel_handshake.cc, xrefs: 00007FF8A8E72EC5
status:, xrefs: 00007FF8A8E72F10
[p2p_pending_handshake] OnOnConnectionClosed, xrefs: 00007FF8A8E72EE7

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: connection_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_pending_channel_handshake.cc$[p2p_pending_handshake] OnOnConnectionClosed
API String ID: 3768306364-3277691146
Opcode ID: 42ee5e10ad22b9d8eb6337eea1f16ab40f58f5bbe0172451f54b915c7e1e30d0
Instruction ID: 52cdbb6d46abb27b2fd1d3c93adec7d6548e9e16e2ecd537fd3cb3e60819de4b
Opcode Fuzzy Hash: 42ee5e10ad22b9d8eb6337eea1f16ab40f58f5bbe0172451f54b915c7e1e30d0
Instruction Fuzzy Hash: 4721D132A0A683E2EB25CF10E4403ED73A1FB84784F404132DA4D03A69DF7CD959CB54

Function 00007FF8A8E2539E Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z.MSVCP140 ref: 00007FF8A8E253F8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E25456

Strings

SendRequest discarded, xrefs: 00007FF8A8E253B8
[ServiceInvoker], xrefs: 00007FF8A8E253A9
uri:, xrefs: 00007FF8A8E253C7
mid:, xrefs: 00007FF8A8E253E5

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@__invalid_parameter_noinfo_noreturn
String ID: SendRequest discarded$ mid:$ uri:$[ServiceInvoker]
API String ID: 2506420284-4089903041
Opcode ID: 220faf720186cdd815af7b0cc53579ec7663d0dfd7b25eca11ca321de8d2e1eb
Instruction ID: a46e166e3dde63aa26071a78a7c2b515af6b47e1aed8c36a6df4dcbe6edb1188
Opcode Fuzzy Hash: 220faf720186cdd815af7b0cc53579ec7663d0dfd7b25eca11ca321de8d2e1eb
Instruction Fuzzy Hash: FA21C571B0A542E0EF659B24D8413F96360FF807E0F409132D96D076EAEF7CD9899328

Function 00007FF8A8DF1483 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E48356
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E48370

Strings

error_code:, xrefs: 00007FF8A8E4835F
[p2p_answer_task_observer] NotifyFailure, xrefs: 00007FF8A8E48336
F:\Demo\ipc_sdk_fix\src\p2p\p2p_answer_task_observer.cc, xrefs: 00007FF8A8E48314
port_number:, xrefs: 00007FF8A8E48345

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: error_code:$ port_number:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_answer_task_observer.cc$[p2p_answer_task_observer] NotifyFailure
API String ID: 3768306364-1186998497
Opcode ID: 1985d6c764770c82952e48154c24cb10a83114056ccf82849abfb17341a04487
Instruction ID: 1dd5c1aba70cf95f5e2ac1b49050ec1a6bbd6202c9c1b6ae28d97adaf7cb349e
Opcode Fuzzy Hash: 1985d6c764770c82952e48154c24cb10a83114056ccf82849abfb17341a04487
Instruction Fuzzy Hash: 51219032A0A983E6DB219B14D8403EA73A0FB847C8F454036D65D0B659EF7DD959C718

Function 00007FF8A8DF2DDD Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 57COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E72DC3
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E72DDE

Strings

[p2p_pending_handshake] OnHandleshakeTimeout, xrefs: 00007FF8A8E72D9F
connection_id:, xrefs: 00007FF8A8E72DAE
F:\Demo\ipc_sdk_fix\src\p2p\p2p_pending_channel_handshake.cc, xrefs: 00007FF8A8E72D7D
status:, xrefs: 00007FF8A8E72DCC

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: connection_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_pending_channel_handshake.cc$[p2p_pending_handshake] OnHandleshakeTimeout
API String ID: 3768306364-651343980
Opcode ID: a7287548626051bc01404988ff22593ac20b35ed5913143b0dacf7e3eb5fa2e4
Instruction ID: 2c6e423bbd747614f6a599e912590f3259ea0ba042d1a1e0316e155550b0a48a
Opcode Fuzzy Hash: a7287548626051bc01404988ff22593ac20b35ed5913143b0dacf7e3eb5fa2e4
Instruction Fuzzy Hash: E521A13260A683E6EB25CF20E8403E973A0FB84788F405136C75D07A69DF7CE959DB54

Function 00007FF8A8DF2685 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 57COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E123B5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E123D0

Strings

connection_id:, xrefs: 00007FF8A8E123A0
F:\Demo\ipc_sdk_fix\src\p2p\p2p_answer_channel_handshake.cc, xrefs: 00007FF8A8E1236F
status:, xrefs: 00007FF8A8E123BE
[p2p_answer_handshake] OnHandleshakeTimeout, xrefs: 00007FF8A8E12391

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: connection_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_answer_channel_handshake.cc$[p2p_answer_handshake] OnHandleshakeTimeout
API String ID: 3768306364-3297076769
Opcode ID: 3c6da4ad60ba26c7a5d716d86212bcdc12d163bd7e71ca9cb4b1ffae1a8adb69
Instruction ID: 6153c720eca4b5f1c501d9cf717738bba10efddbe6dfac166786a342070820f4
Opcode Fuzzy Hash: 3c6da4ad60ba26c7a5d716d86212bcdc12d163bd7e71ca9cb4b1ffae1a8adb69
Instruction Fuzzy Hash: B0218E3260A683E6EB36DF21E8403E973A1FB94B84F405136CA4D07669DF7CE958CB54

Function 00007FF8A8DF4629 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 57COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E1B439
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E1B454

Strings

listener_id:, xrefs: 00007FF8A8E1B428
[p2p_tcp_port] OnListernerClosed, xrefs: 00007FF8A8E1B419
F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc, xrefs: 00007FF8A8E1B3F7
status:, xrefs: 00007FF8A8E1B442

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: listener_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc$[p2p_tcp_port] OnListernerClosed
API String ID: 3768306364-1543895763
Opcode ID: e11b7fccb3432522d2685839755de3af29591403bcbbf881d47271678f366f0c
Instruction ID: f18c2e9dd942cdd445a3054c158ebacef668da3bb28928565105698274f55f38
Opcode Fuzzy Hash: e11b7fccb3432522d2685839755de3af29591403bcbbf881d47271678f366f0c
Instruction Fuzzy Hash: F121E072A0A642E2EB21DF21E4402AD37A0FB84BC0F408136DA5C036A9DF7CEE19C754

Function 00007FF8A8DF3765 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 57COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E6C4AE
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E6C4C8

Strings

[p2p_tcp_port] OnHandshakeSuccess, xrefs: 00007FF8A8E6C48D
listener_id:, xrefs: 00007FF8A8E6C49C
connection_id:, xrefs: 00007FF8A8E6C4B7
F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc, xrefs: 00007FF8A8E6C46B

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: connection_id:$ listener_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc$[p2p_tcp_port] OnHandshakeSuccess
API String ID: 3768306364-2048626725
Opcode ID: d6231e9ab9521267185ca0e629d1dc314f3433d2b50a86292cd0b6c863c3f0a1
Instruction ID: 6d24b67eafbfa4a96c1411ea2021b262f70e31ab0a6fee24f15d79ef3dc579cf
Opcode Fuzzy Hash: d6231e9ab9521267185ca0e629d1dc314f3433d2b50a86292cd0b6c863c3f0a1
Instruction Fuzzy Hash: 94217F32A0A642E2EB21DB21E8402E97760FFC47C4F405036DA5D07A65EF7CE95AC714

Function 00007FF8A8DF33E1 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 53COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E1115E
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E11179

Strings

listener_id:, xrefs: 00007FF8A8E1114C
[p2p_tcp_port] Close, xrefs: 00007FF8A8E1113D
F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc, xrefs: 00007FF8A8E1111B
status:, xrefs: 00007FF8A8E11167

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: listener_id:$ status:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_tcp_port.cc$[p2p_tcp_port] Close
API String ID: 3768306364-3259199221
Opcode ID: c8e55e78e654c8328530674120d1e17cd970af436497ba2850a618af2c8eebc2
Instruction ID: 37c2e9878ff3d5319488f19346d361e18f135f671079749588ffceb041aa53d8
Opcode Fuzzy Hash: c8e55e78e654c8328530674120d1e17cd970af436497ba2850a618af2c8eebc2
Instruction Fuzzy Hash: 5E21C232A1A142E6EB61DF21E8516B97360FF84BC4F006032DA5D0366ADF7CED99CB14

Function 00007FF8A8E299E0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z.MSVCP140 ref: 00007FF8A8E29A59
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E29A74

Strings

F:\Demo\ipc_sdk_fix\src\p2p\net\event_loop.cc, xrefs: 00007FF8A8E29A16
handle:, xrefs: 00007FF8A8E29A47
handle_type:, xrefs: 00007FF8A8E29A62
[p2p_loop] walk check handler, xrefs: 00007FF8A8E29A38

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: handle:$ handle_type:$F:\Demo\ipc_sdk_fix\src\p2p\net\event_loop.cc$[p2p_loop] walk check handler
API String ID: 3768306364-2131581698
Opcode ID: e48c5f2676b4b1fe6af61098e6ac145167a8fb1bff499fea9fdcbbf95bf36a4a
Instruction ID: 7640a3131590b985f4813b5c0b43cb1500b0e2c81a3254be964d82e4bee596f4
Opcode Fuzzy Hash: e48c5f2676b4b1fe6af61098e6ac145167a8fb1bff499fea9fdcbbf95bf36a4a
Instruction Fuzzy Hash: 22118E72A0A242E6DF219F20E8502F933A0FB847C4F805436DA5D0B6A9EF7CD959CB14

Function 00007FF8A8DF318E Relevance: 10.5, APIs: 7, Instructions: 40COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF8A8E9F9EC
SetHandleInformation.KERNEL32 ref: 00007FF8A8E9FA06
GetStdHandle.KERNEL32 ref: 00007FF8A8E9FA11
SetHandleInformation.KERNEL32 ref: 00007FF8A8E9FA2B
GetStdHandle.KERNEL32 ref: 00007FF8A8E9FA36
SetHandleInformation.KERNEL32 ref: 00007FF8A8E9FA50
GetStartupInfoW.KERNEL32 ref: 00007FF8A8E9FA5B

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Handle$Information$InfoStartup
String ID:
API String ID: 4234762616-0
Opcode ID: 50e52297198edd2dd5172646a07ea5be65ee8e511f17647b20364c317f068b91
Instruction ID: 4b62a6ed7a552387da6dd40bd7247e8c63d934438c7c0d794fd4c3b8a26f4e8e
Opcode Fuzzy Hash: 50e52297198edd2dd5172646a07ea5be65ee8e511f17647b20364c317f068b91
Instruction Fuzzy Hash: 6D114232A0A903A6E7509774EC2567D7351EF817F1F404335E63E426E4EF6DA4488764

Function 00007FF8A8E02BBE Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E02BF9
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E02C13

Strings

error_code:, xrefs: 00007FF8A8E02C02
StartWithPort failure exceed max_port, xrefs: 00007FF8A8E02BD9
[IPCServiceHostBizHandler], xrefs: 00007FF8A8E02BCA
port_number:, xrefs: 00007FF8A8E02BE8

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: StartWithPort failure exceed max_port$ error_code:$ port_number:$[IPCServiceHostBizHandler]
API String ID: 3768306364-271826915
Opcode ID: fb5bf879ec41a527d81ab9b737c930585377efcfe822e747cb1adac502ded1e9
Instruction ID: 697e43bd859846568be3f00dc96cc7222d21d9e2747a3b0bae1968df33a7f4a8
Opcode Fuzzy Hash: fb5bf879ec41a527d81ab9b737c930585377efcfe822e747cb1adac502ded1e9
Instruction Fuzzy Hash: 0B01A932B0AA02E1EE129B11E4501A927A0FF88BC4F459136D99E17366DF3CD95EC318

Function 00007FF8A8DF1ACD Relevance: 9.2, APIs: 6, Instructions: 242networkCOMMON

Download Yara Rule

APIs

QueueUserWorkItem.KERNEL32 ref: 00007FF8A8E8ACE5
GetLastError.KERNEL32 ref: 00007FF8A8E8AD40
WSASocketW.WS2_32 ref: 00007FF8A8E8ADB5
closesocket.WS2_32 ref: 00007FF8A8E8ADCF
UnregisterWait.KERNEL32 ref: 00007FF8A8E8ADFE
CloseHandle.KERNEL32 ref: 00007FF8A8E8AE1B

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CloseErrorHandleItemLastQueueSocketUnregisterUserWaitWorkclosesocket
String ID:
API String ID: 3627974087-0
Opcode ID: 3408c83254e042e8322f7b92d873b265741e538fdc72454ea57cc685b139ffd2
Instruction ID: d6999367b610a17152a7a3d7cc62a08b6c747165829e0fb7f6156d2a209959e4
Opcode Fuzzy Hash: 3408c83254e042e8322f7b92d873b265741e538fdc72454ea57cc685b139ffd2
Instruction Fuzzy Hash: D3B15A32A06B82DAEB548F29D09026D73A1FB44BD8F544235CB5D477A4DF38E8B0C764

Function 00007FF8A8DF3D69 Relevance: 9.2, APIs: 6, Instructions: 197COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E423AE

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c8d53531ea13d32169c166410a3dc55983e30c121a527a4fe2ff9aecd3951b0e
Instruction ID: b26841926f3bd92a436f2b4696b60c301d2a3bf7ea43519ca9b72460532aed76
Opcode Fuzzy Hash: c8d53531ea13d32169c166410a3dc55983e30c121a527a4fe2ff9aecd3951b0e
Instruction Fuzzy Hash: 89818E72B09A82AAFB14CBA4D0443AC2372EB057E8F004635DB6D17AC9DF799495D328

Function 00007FF8A8DF3C2E Relevance: 9.2, APIs: 6, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E42027

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d53e4e909368194a3043a0f5413e413bced58478a70f686151d763bfd317838e
Instruction ID: d75911681fc57e22156635e83c25388c48ffe2f4f5fe5df547b565d5497b4732
Opcode Fuzzy Hash: d53e4e909368194a3043a0f5413e413bced58478a70f686151d763bfd317838e
Instruction Fuzzy Hash: DB819E72F09A82AAFB14CFB4D4443AC2362EB057E8F004235DA5D27AC9DF799495D328

Function 00007FF8A8DF1E92 Relevance: 9.1, APIs: 6, Instructions: 97fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF8A8E9881E
GetLastError.KERNEL32 ref: 00007FF8A8E9882D
GetFileInformationByHandle.KERNEL32 ref: 00007FF8A8E9885A
GetLastError.KERNEL32 ref: 00007FF8A8E98864
CloseHandle.KERNEL32 ref: 00007FF8A8E98958

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorFileHandleLast$CloseCreateInformation
String ID:
API String ID: 1345328482-0
Opcode ID: f8b721ef5142193cfd1893b737eb42ec9073def1039223156c0aa18f35ede1bf
Instruction ID: 2dc624d01cefe763d07deefcd0c2f5e8fe6d3ac4d5eb9a39abc97ae594f9458d
Opcode Fuzzy Hash: f8b721ef5142193cfd1893b737eb42ec9073def1039223156c0aa18f35ede1bf
Instruction Fuzzy Hash: E041B232A0EA8292F7608F64E44437EB361FB857D4F504235DA9D876A4DF7CE054CB24

Function 00007FF8A8E8CD30 Relevance: 9.1, APIs: 6, Instructions: 88pipeCOMMON

Download Yara Rule

APIs

SetNamedPipeHandleState.KERNEL32 ref: 00007FF8A8E8CD85
GetLastError.KERNEL32 ref: 00007FF8A8E8CD8F
GetNamedPipeHandleStateW.KERNEL32 ref: 00007FF8A8E8CDBA
SetLastError.KERNEL32 ref: 00007FF8A8E8CDD3
SetLastError.KERNEL32 ref: 00007FF8A8E8CDED

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$HandleNamedPipeState
String ID:
API String ID: 1166708894-0
Opcode ID: f0f550eab250291b0190a454b78c19f40937792be8933d2bf146b0bf6c071e08
Instruction ID: 6a57c12450b7a496a7deccc60bfc4e59c02f29ed5bf5f8e620f6592cb8ec73a2
Opcode Fuzzy Hash: f0f550eab250291b0190a454b78c19f40937792be8933d2bf146b0bf6c071e08
Instruction Fuzzy Hash: B931D032A09682D6E7A08F24A54477D3AA0FB4ABE8F504235DE5953AD4CF3CE890CB14

Function 00007FF8A8E81FD0 Relevance: 9.1, APIs: 6, Instructions: 88networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8A8E82019
WSAGetLastError.WS2_32 ref: 00007FF8A8E82024

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLastioctlsocket
String ID:
API String ID: 1021210092-0
Opcode ID: b1a7d805a221c46ce0963740a4bbf2db91394c6936672f8690b649d3ca3ad72f
Instruction ID: 26045d66863f8ffafa55196443bb4804be0cc04b850aa47649335fa22e277f5b
Opcode Fuzzy Hash: b1a7d805a221c46ce0963740a4bbf2db91394c6936672f8690b649d3ca3ad72f
Instruction Fuzzy Hash: 4E31E431E0E682E6F7608B25AA4177D7391EF11BD8F900135DE1946AD8DF3DE890C729

Function 00007FF8A8E82B50 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8E82B87
VerSetConditionMask.KERNEL32 ref: 00007FF8A8E82BB6
VerSetConditionMask.KERNEL32 ref: 00007FF8A8E82BC7
VerSetConditionMask.KERNEL32 ref: 00007FF8A8E82BD8
VerSetConditionMask.KERNEL32 ref: 00007FF8A8E82BE9
VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8E82BFC

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 29eeb67bf26451561cf294e660ef6926990467e84aa966adb6df2a7628add57f
Instruction ID: e42112caeb3ab058e18215a0307fe2b6c442629a6516498110d5e21ef0c06efd
Opcode Fuzzy Hash: 29eeb67bf26451561cf294e660ef6926990467e84aa966adb6df2a7628add57f
Instruction Fuzzy Hash: 11117032E0E68693E725DF21F8153AAA3A0FBC9781F004135DA4D0BB94EF7CD5068B24

Function 00007FF8A8DF2027 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 276COMMON

Download Yara Rule

Strings

error_code:, xrefs: 00007FF8A8E470A5
[p2p_offer_task_observer] NotifyCreateChannelFailure, xrefs: 00007FF8A8E47096
F:\Demo\ipc_sdk_fix\src\p2p\p2p_offer_task_observer.cc, xrefs: 00007FF8A8E47074

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID:
String ID: error_code:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_offer_task_observer.cc$[p2p_offer_task_observer] NotifyCreateChannelFailure
API String ID: 0-4192184434
Opcode ID: a391d1ce4a9edb432d45963bc89ce522776f32769f0874f5bf55369bd3b30836
Instruction ID: 5a1b058e5df2ef0cd30a5a834adf01c74330aa7b53bc602d6bb1232fb4f60d31
Opcode Fuzzy Hash: a391d1ce4a9edb432d45963bc89ce522776f32769f0874f5bf55369bd3b30836
Instruction Fuzzy Hash: EC71793270AA41E2EB548F26D28026C73A1FB84FD4F599036DB5E07B58CF39D8A5C754

Function 00007FF8A8DF3E40 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E27834
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E278AA

Strings

[p2p_loop] EventLoop destructor, xrefs: 00007FF8A8E27710
loop_name:, xrefs: 00007FF8A8E2771F
F:\Demo\ipc_sdk_fix\src\p2p\net\event_loop.cc, xrefs: 00007FF8A8E276FB

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnterminate
String ID: loop_name:$F:\Demo\ipc_sdk_fix\src\p2p\net\event_loop.cc$[p2p_loop] EventLoop destructor
API String ID: 664030348-3219599726
Opcode ID: 32f77ad29e0f6644c6261e0edc1bbf20d8c0f53d57d898aff185294294d3147f
Instruction ID: de71b94c49a59be163b129a89a0f77abd8ac09dbc52f38dd7f09f7c6069c3a97
Opcode Fuzzy Hash: 32f77ad29e0f6644c6261e0edc1bbf20d8c0f53d57d898aff185294294d3147f
Instruction Fuzzy Hash: FC418B72B0A682A2EF1D9B25D8543FD6360FB407C8F444035DA2D0B6A6DF7CE869C358

Function 00007FF8A8DF1C71 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E339E9

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc, xrefs: 00007FF8A8E33847, 00007FF8A8E33901
can not find task session_id:, xrefs: 00007FF8A8E33930
[p2p_biz_service] OnCreateAnswerChannelSuccess, xrefs: 00007FF8A8E33866, 00007FF8A8E33921
session_id:, xrefs: 00007FF8A8E33875

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: can not find task session_id:$ session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_biz_service.cc$[p2p_biz_service] OnCreateAnswerChannelSuccess
API String ID: 3668304517-1173086432
Opcode ID: c8f60182004de2e366934eaa9b87cc319c3dc3409ea3a1c796d82976d9b66ed2
Instruction ID: e6c71d21d176245e0afe67ef2941fa66f1cde0fe5b3c1bf6a53b716309de494d
Opcode Fuzzy Hash: c8f60182004de2e366934eaa9b87cc319c3dc3409ea3a1c796d82976d9b66ed2
Instruction Fuzzy Hash: 9751B071B1A682E1EF209B15E8407AD6311FF807D4F405236EA9E076E9DF7CD949C714

Function 00007FF8A8DF3D91 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E55C65
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A8E55CD4
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A8E55CF0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E55DA0

Strings

,, xrefs: 00007FF8A8E55C17

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnatoi
String ID: ,
API String ID: 3803844803-3772416878
Opcode ID: 01346ee7308326895c835151e0d6d9d0db705157a9233b8c1a91e24d09fe0255
Instruction ID: 737574a054f8ac55d2fad782db475e189d7bbac5ff755fa35bac9fc0f2421167
Opcode Fuzzy Hash: 01346ee7308326895c835151e0d6d9d0db705157a9233b8c1a91e24d09fe0255
Instruction Fuzzy Hash: 7451F6B3A19A8191EF188F25E44436E6361EB44BE8F541231EAAD03BD9CF7DD490C758

Function 00007FF8A8DF4697 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 124COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E1A0E1

Strings

error_code:, xrefs: 00007FF8A8E1A0D0
OnListenFailure, xrefs: 00007FF8A8E1A0C1
F:\Demo\ipc_sdk_fix\src\ipc_core\service_host.cc, xrefs: 00007FF8A8E1A091
[ServiceHost], xrefs: 00007FF8A8E1A0B2

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: OnListenFailure$ error_code:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_host.cc$[ServiceHost]
API String ID: 3768306364-3284507861
Opcode ID: 040af8f40d27f1aea42df41d99c8588266de68f062cdaeb3c28c0342fc1782d3
Instruction ID: d5af5ef9ffe282dc387b7b3f6a5cc76b291e493262e08c984887fe12794ef893
Opcode Fuzzy Hash: 040af8f40d27f1aea42df41d99c8588266de68f062cdaeb3c28c0342fc1782d3
Instruction Fuzzy Hash: 4751D132A0AA82A2EA60DF11E4403B973A1FF85BC4F445035EA8D17769DF7CD959C714

Function 00007FF8A8DF4138 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 123COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E1A36B

Strings

port:, xrefs: 00007FF8A8E1A35A
F:\Demo\ipc_sdk_fix\src\ipc_core\service_host.cc, xrefs: 00007FF8A8E1A31B
OnListenSuccess, xrefs: 00007FF8A8E1A34B
[ServiceHost], xrefs: 00007FF8A8E1A33C

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: OnListenSuccess$ port:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_host.cc$[ServiceHost]
API String ID: 3768306364-1914322320
Opcode ID: 526c336d7ceb22c25fbca45b7a008387334d60e407d67581eaadb004efb6d665
Instruction ID: 8d3a94e481186024eaa23976965e935d09889e2641360cc0de2bece4084419a1
Opcode Fuzzy Hash: 526c336d7ceb22c25fbca45b7a008387334d60e407d67581eaadb004efb6d665
Instruction Fuzzy Hash: B951EF32A0AA82E2EEA5DF10E4407BD63A0FF84BC0F045035EA8D17A69DF7CD959C714

Function 00007FF8A8DF406B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8A8E9269D
PostQueuedCompletionStatus.KERNEL32 ref: 00007FF8A8E926ED
LeaveCriticalSection.KERNEL32 ref: 00007FF8A8E92713
GetLastError.KERNEL32 ref: 00007FF8A8E92730

Strings

PostQueuedCompletionStatus, xrefs: 00007FF8A8E92738

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CriticalSection$CompletionEnterErrorLastLeavePostQueuedStatus
String ID: PostQueuedCompletionStatus
API String ID: 1216617850-3446536168
Opcode ID: 8e12b8ba807de1862f66c8340e5d0ba0517e6717999ee9b0308ff1abfd2ead7f
Instruction ID: 34bb5d08abe8d61876728d49aaddc5dc3a7f36a3ad1fb06702839e3e7e56f8d3
Opcode Fuzzy Hash: 8e12b8ba807de1862f66c8340e5d0ba0517e6717999ee9b0308ff1abfd2ead7f
Instruction Fuzzy Hash: 5721D231A0AA43E1EF11DB20E8102A973A0FF88BC4F544032DA1D87794EF7CD855C7A8

Function 00007FF8A8E0C3F0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0C575

Strings

service_name:, xrefs: 00007FF8A8E0C4DA
F:\Demo\ipc_sdk_fix\src\ipc_core\service_dispatcher.cc, xrefs: 00007FF8A8E0C49D
AddService, xrefs: 00007FF8A8E0C4CB
[ServiceDispatcher], xrefs: 00007FF8A8E0C4BC

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: AddService$ service_name:$F:\Demo\ipc_sdk_fix\src\ipc_core\service_dispatcher.cc$[ServiceDispatcher]
API String ID: 3668304517-3984109149
Opcode ID: 07f94d4b12584bf96b1cacc1f39adae6b514f46d47f3f2a0432dbe3c726c6d2a
Instruction ID: 70305152400c747bc2fd912f388d4289c99f95d4d23cda43467b6a86775b1e88
Opcode Fuzzy Hash: 07f94d4b12584bf96b1cacc1f39adae6b514f46d47f3f2a0432dbe3c726c6d2a
Instruction Fuzzy Hash: F141E672A0AA82A1EA259B11E4503EE6360FF88BD0F444235DAAC037D9DF7CD959C714

Function 00007FF8A8E978F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A8E979DC

Strings

\\?\UNC\, xrefs: 00007FF8A8E9796C
\\?\, xrefs: 00007FF8A8E97997

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID: \\?\$\\?\UNC\
API String ID: 1452528299-3019864461
Opcode ID: 692462167e7973219ce53b10b86390dc4062856e3ad5c36d50172961fb62cbca
Instruction ID: 86dff886d1d076e9c3ed7d95222347e2e2998b2b09d7136baefae99335dbd85c
Opcode Fuzzy Hash: 692462167e7973219ce53b10b86390dc4062856e3ad5c36d50172961fb62cbca
Instruction Fuzzy Hash: F621E331B09B42D2EB149F6AB850679A351EF45BE4F049230DE6E47BD4DF3CD4198718

Function 00007FF8A8DF1ECE Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E73AA9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E73B99
InitOnceBeginInitialize.KERNEL32 ref: 00007FF8A8E73BE3
InitOnceComplete.KERNEL32 ref: 00007FF8A8E73C37
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E73C41

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: InitOnce_invalid_parameter_noinfo_noreturn$BeginCompleteInitializeabort
String ID:
API String ID: 440719201-0
Opcode ID: 14afbf7bccb5eb7a5c56c268d7294d39896a9dd6c9dcbcd610ca3491a05ff8b9
Instruction ID: acab5e38d3ee42208fe1743bbd9a0dd626ba4c4f173972fd46219aa019146594
Opcode Fuzzy Hash: 14afbf7bccb5eb7a5c56c268d7294d39896a9dd6c9dcbcd610ca3491a05ff8b9
Instruction Fuzzy Hash: F051B272B0A682E2EB94DB22A44436E6765FB45BC4F544035EF8D27B59CF3CD8A08318

Function 00007FF8A8DF17DA Relevance: 7.7, APIs: 5, Instructions: 166filepipeCOMMON

Download Yara Rule

APIs

PeekNamedPipe.KERNEL32 ref: 00007FF8A8E8C71E
ReadFile.KERNEL32 ref: 00007FF8A8E8C76E
ReadFile.KERNEL32 ref: 00007FF8A8E8C7A0

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: FileRead$NamedPeekPipe
String ID:
API String ID: 11789816-0
Opcode ID: 5ab9808a0aedd035275c5d4156aac913fe35a702c758f60ad19df4630a60bf4a
Instruction ID: 83905b5c3f646ff522e1d7497b9414ce2762787459374366bcd66dfa9c1ead82
Opcode Fuzzy Hash: 5ab9808a0aedd035275c5d4156aac913fe35a702c758f60ad19df4630a60bf4a
Instruction Fuzzy Hash: 5271A233A09A82D2EB948F25E4406BD73A1FB85BC4F441135EE8D87A98DF3CE455CB24

Function 00007FF8A8DF3436 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z.MSVCP140 ref: 00007FF8A8E15DC5
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z.MSVCP140 ref: 00007FF8A8E15DE6
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF8A8E15DFB
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z.MSVCP140 ref: 00007FF8A8E15E0A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z.MSVCP140 ref: 00007FF8A8E15E1E

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Locimp@locale@std@@V123@$??0?$codecvt@_??4?$_Addfac@_Bid@locale@std@@D@std@@Locimp@_Locimp_Mbstatet@@@std@@New_V01@V123@@Vfacet@23@_Yarn@
String ID:
API String ID: 1096164258-0
Opcode ID: a31f74514f0d341e426ae94bcf1a51ec55394f16fd51e7a3bc0119d883bd2c70
Instruction ID: c026e0e2fd42443b054ac75e4d109dd98f35de77e45145621dfc564b4d45ccf7
Opcode Fuzzy Hash: a31f74514f0d341e426ae94bcf1a51ec55394f16fd51e7a3bc0119d883bd2c70
Instruction Fuzzy Hash: D6313B32A0AB42D6EB159F21E94426C33A5FB54FC4F544039CA4D07B54EF38E865C358

Function 00007FF8A8DF14EC Relevance: 7.6, APIs: 5, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF8A8E83D9B
GetProcessTimes.KERNEL32 ref: 00007FF8A8E83DBD
GetLastError.KERNEL32 ref: 00007FF8A8E83DC7
FileTimeToSystemTime.KERNEL32 ref: 00007FF8A8E83DE3
FileTimeToSystemTime.KERNEL32 ref: 00007FF8A8E83DF7

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Time$FileProcessSystem$CurrentErrorLastTimes
String ID:
API String ID: 3892490796-0
Opcode ID: 38a02260bb4230660135ce7af74006252958098456c225b68dc2eb66094f83a5
Instruction ID: b28c0a4ffedc24e8b5cf2dcf4241861d6a0dd2a292c561151a64de4f3bf277d7
Opcode Fuzzy Hash: 38a02260bb4230660135ce7af74006252958098456c225b68dc2eb66094f83a5
Instruction Fuzzy Hash: 15318072E19B8296E7448F21E41037EB3A0FB94B44F40523BFA89856A8FF3CD595CB14

Function 00007FF8A8E94A80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

TerminateProcess.KERNEL32 ref: 00007FF8A8E94AA5
GetLastError.KERNEL32 ref: 00007FF8A8E94AB3
GetExitCodeProcess.KERNEL32 ref: 00007FF8A8E94AC8
GetExitCodeProcess.KERNEL32 ref: 00007FF8A8E94B03
GetLastError.KERNEL32 ref: 00007FF8A8E94B0D

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Process$CodeErrorExitLast$Terminate
String ID:
API String ID: 53387917-0
Opcode ID: 02d5ae966345563e7fe8091d46d50fa75557dde1a25e5cb4034d01806a38f40e
Instruction ID: 9f5e10a70b580573270043efcbd08650bcb2589a42dd0e1e2b08dd89fae869ce
Opcode Fuzzy Hash: 02d5ae966345563e7fe8091d46d50fa75557dde1a25e5cb4034d01806a38f40e
Instruction Fuzzy Hash: F211E732F1A942D2EB9057A5F48013E7290FF847D4F485130E65A86695FFBCD8E1872C

Function 00007FF8A8E898E0 Relevance: 7.6, APIs: 5, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF8A8E89914
GetLastError.KERNEL32 ref: 00007FF8A8E89931
CreateFileW.KERNEL32 ref: 00007FF8A8E89963

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CreateFile$ErrorLast
String ID:
API String ID: 3733516855-0
Opcode ID: 44aca6df59496b689968ca5ae63223b3e144e0609ce746007cd3bfdbefee9b34
Instruction ID: 4d1cdff9e8df991393286cd327391bc20dda24f6bc0986a5d5d1b4cd4160653a
Opcode Fuzzy Hash: 44aca6df59496b689968ca5ae63223b3e144e0609ce746007cd3bfdbefee9b34
Instruction Fuzzy Hash: 6F21C272A18642C2E7A04F24F95472F7260FB847F8F544321EAB906BD8DFBDC8958B04

Function 00007FF8A8DF3571 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ.MSVCP140 ref: 00007FF8A8DFAA47
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ.MSVCP140 ref: 00007FF8A8DFAA6F
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ.MSVCP140 ref: 00007FF8A8DFAA84
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8DFAA9E
?_Xbad_alloc@std@@YAXXZ.MSVCP140 ref: 00007FF8A8DFAAEA

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Locinfo@std@@$Cvtvec@@Getcvt@_Getdays@_Getmonths@_Xbad_alloc@std@@calloc
String ID:
API String ID: 1268400193-0
Opcode ID: f6f9c332de12b6c605ce91be57aae533b85ae52a3f2e8ba23459cefc4ec93ec6
Instruction ID: 7592d4aa4f551c7dae73f50b20834208ca7cedbf832be104a8d6363b819b65a8
Opcode Fuzzy Hash: f6f9c332de12b6c605ce91be57aae533b85ae52a3f2e8ba23459cefc4ec93ec6
Instruction Fuzzy Hash: 69217F22E0AB86A2EA04CF25E51117973B0FF98BC4F049235DA5D07B11EF7CE5A9C714

Function 00007FF8A8DF20E0 Relevance: 7.5, APIs: 5, Instructions: 35stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8A8E83C7C
LeaveCriticalSection.KERNEL32 ref: 00007FF8A8E83C9F
GetLastError.KERNEL32 ref: 00007FF8A8E83CA5
strncpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8E83CD0
LeaveCriticalSection.KERNEL32 ref: 00007FF8A8E83CDD

Part of subcall function 00007FF8A8E82D70: GetConsoleTitleW.KERNEL32 ref: 00007FF8A8E82D9F
Part of subcall function 00007FF8A8E82D70: WideCharToMultiByte.KERNEL32 ref: 00007FF8A8E82DCE
Part of subcall function 00007FF8A8E82D70: WideCharToMultiByte.KERNEL32 ref: 00007FF8A8E82E12

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CriticalSection$ByteCharLeaveMultiWide$ConsoleEnterErrorLastTitlestrncpy_s
String ID:
API String ID: 460504654-0
Opcode ID: 599a6068358c80461268e583f68ea581a4b84defb369460cd803e65fcccf0a63
Instruction ID: 4ba540ddde2154d032fdf05270a31fdd5bd9cc39e7892c406e7911e4accaec46
Opcode Fuzzy Hash: 599a6068358c80461268e583f68ea581a4b84defb369460cd803e65fcccf0a63
Instruction Fuzzy Hash: 06011E70A1B943B1EA14AB75F8844B92660EF49BF4F540231DA3D872E5EF2DE4958338

Function 00007FF8A8DF162C Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 434COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E4887B

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_answer_task_observer.cc, xrefs: 00007FF8A8E4883C
timeout_in_ms:, xrefs: 00007FF8A8E4886A
[p2p_answer_task_observer] StartWithTimeout, xrefs: 00007FF8A8E4885B

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: timeout_in_ms:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_answer_task_observer.cc$[p2p_answer_task_observer] StartWithTimeout
API String ID: 3768306364-398695073
Opcode ID: 5545faa81de51ad9b34f004f4ec38f34a1b844412d1673132a02038c30775c51
Instruction ID: fd1bcdebb0261a49043cbc66a3144b6e49c3d8c41b87a5de7378aceae224ac5a
Opcode Fuzzy Hash: 5545faa81de51ad9b34f004f4ec38f34a1b844412d1673132a02038c30775c51
Instruction Fuzzy Hash: 56A19A32A0AB91D6EBA08F25D88026973A0FB88B94F098031CF9D87754DF7DD965CB14

Function 00007FF8A8DF1514 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E07B91
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E07C0A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E07CCB

Strings

verify, xrefs: 00007FF8A8E07B32

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: verify
API String ID: 3668304517-2703567427
Opcode ID: 944a4442fb05973ee8206fbb43116ee8fde9f4675c9f90cadac5e95696e4a580
Instruction ID: 5b5810a8e0ab1d6e99f20a04d1119abeb2f2069c726ba4af2ee027c9b3f47697
Opcode Fuzzy Hash: 944a4442fb05973ee8206fbb43116ee8fde9f4675c9f90cadac5e95696e4a580
Instruction Fuzzy Hash: 6671EFB2B09A82A0EB04CF25E88037C27A2EB49BD5F004535DA9D43795DF3DD8E0C328

Function 00007FF8A8DF2513 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 188COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF8A8E4CA09

Strings

ports_size:, xrefs: 00007FF8A8E4C9F3
F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc, xrefs: 00007FF8A8E4C7B4, 00007FF8A8E4C9C4
[p2p_channel_service] CheckAndCloseIdlePort, xrefs: 00007FF8A8E4C7D6, 00007FF8A8E4C9E4

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@_
String ID: ports_size:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_generic_channel_service.cc$[p2p_channel_service] CheckAndCloseIdlePort
API String ID: 3957442437-3183097916
Opcode ID: a07d3b22aeaf25e3976968dd14703a5c9c163a8119e05a7cdf09ffa0f0f491df
Instruction ID: aea051699abe075f77d23bc9ab9ac96029a4e5c2ef32d363d435a4ef801a7d8e
Opcode Fuzzy Hash: a07d3b22aeaf25e3976968dd14703a5c9c163a8119e05a7cdf09ffa0f0f491df
Instruction Fuzzy Hash: CF91D332A0AB41E2EB648F25D4403A977A0FB88BE4F159135CB9E43794CF3DE8A5C754

Function 00007FF8A8DF1FAF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

\\?\pipe, xrefs: 00007FF8A8E89DD4

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID:
String ID: \\?\pipe
API String ID: 0-3050279299
Opcode ID: 4da61ea727baa215802f74cb36ff4b01eb232e91f58312107c3b57f309f91853
Instruction ID: ed5e6d2e2776629409cd402e1db7b5d667b756a24bd2b867d9cfad3093bc890e
Opcode Fuzzy Hash: 4da61ea727baa215802f74cb36ff4b01eb232e91f58312107c3b57f309f91853
Instruction Fuzzy Hash: DB51D332A0AB42D2E710AF25A84016D77A0FB84BE4F904235EBAD477D5DF3CE865C718

Function 00007FF8A8DF40FC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

UnregisterWaitEx.KERNEL32 ref: 00007FF8A8E94C53
GetLastError.KERNEL32 ref: 00007FF8A8E94C97
CloseHandle.KERNEL32 ref: 00007FF8A8E94CF0

Strings

UnregisterWaitEx, xrefs: 00007FF8A8E94C9F

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CloseErrorHandleLastUnregisterWait
String ID: UnregisterWaitEx
API String ID: 2308365291-3194662728
Opcode ID: 91a1ab8e4b8a0ec4f6c73faa86fcd7aad96a27b748f4420e9976376dec0db91b
Instruction ID: 2a32106300d403e62dd4615fcbcdc570971947cdfcdd3f17b1c82bac4090755c
Opcode Fuzzy Hash: 91a1ab8e4b8a0ec4f6c73faa86fcd7aad96a27b748f4420e9976376dec0db91b
Instruction Fuzzy Hash: 73212C72605A8696EB148F69E48016873A2F748FB8F184331CE7C477D8DF38D891C7A4

Function 00007FF8A8DF4192 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E3E375
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A8E3E3D1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E3E480

Strings

~, xrefs: 00007FF8A8E3E327

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$atoi
String ID: ~
API String ID: 1428063464-1707062198
Opcode ID: af27af19c1194a46e796b4f26f4e177bdf69aece4f65eadcc6ed1c0389ec9c3b
Instruction ID: a971ac97d212e19f91385da630c83550c3af6155989cc1e26347a133653f0b27
Opcode Fuzzy Hash: af27af19c1194a46e796b4f26f4e177bdf69aece4f65eadcc6ed1c0389ec9c3b
Instruction Fuzzy Hash: 8F41F672B0968291EE149B25E44437E6351EB48BE8F540231EAAD03BD9DFBCD890C754

Function 00007FF8A8DF24E1 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E78023

Strings

[p2p_tcp_client] Close, xrefs: 00007FF8A8E78002
F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_client.cc, xrefs: 00007FF8A8E77FE3
connection_id:, xrefs: 00007FF8A8E78011

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: connection_id:$F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_client.cc$[p2p_tcp_client] Close
API String ID: 3768306364-1811782363
Opcode ID: c5c156a78c510edf802de510cddc8b1417ae19417ddcf6b59aa9c80042c6002e
Instruction ID: 568b8adff0c8b700b3ad6fd61240ea30d8adf6752a9fe70e792e4fc96ccf1f49
Opcode Fuzzy Hash: c5c156a78c510edf802de510cddc8b1417ae19417ddcf6b59aa9c80042c6002e
Instruction Fuzzy Hash: D2510332A0AA82D1EB20CF21E8502BA7760FBC8BD4F459035DA8D43799DF7CD856C718

Function 00007FF8A8DF4070 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF8A8E1BE34
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E1BEC5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E1BF06

Strings

disable_verify, xrefs: 00007FF8A8E1BE2D

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcmp
String ID: disable_verify
API String ID: 807481086-1024895267
Opcode ID: b1fc33b509f335f22fa527fc94a125c358be87ecb6fae7cf857d3b7caba75e95
Instruction ID: cd926f89fd7dcb287e0fe1e44cce5a6c32a5ebf825f7f12e9fb0e0c3f80ad27f
Opcode Fuzzy Hash: b1fc33b509f335f22fa527fc94a125c358be87ecb6fae7cf857d3b7caba75e95
Instruction Fuzzy Hash: BA41C232A19AC5A6EB509B25E4403AE6761FB857E4F401331EBAD03BD9CF7CD492CB14

Function 00007FF8A8DF2699 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E475B9

Strings

F:\Demo\ipc_sdk_fix\src\p2p\p2p_offer_task_observer.cc, xrefs: 00007FF8A8E4751C
[p2p_offer_task_observer] NotifyCreateOfferSuccess, xrefs: 00007FF8A8E4753B
session_id:, xrefs: 00007FF8A8E4754A

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: session_id:$F:\Demo\ipc_sdk_fix\src\p2p\p2p_offer_task_observer.cc$[p2p_offer_task_observer] NotifyCreateOfferSuccess
API String ID: 3668304517-2454683834
Opcode ID: 5825b59c766e9d31826f822a833b973f2380439e5a27d81c09f733374e0d2eb7
Instruction ID: abf0ffaa39a326921116b8447f871e14923e14ae2aa01a0c66c872d856ec53b8
Opcode Fuzzy Hash: 5825b59c766e9d31826f822a833b973f2380439e5a27d81c09f733374e0d2eb7
Instruction Fuzzy Hash: A831F472B0AA46A1EE24DB20E8403AE6361FF887D4F404235D99D07BD9DF7CE945C714

Function 00007FF8A8E06F90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E07006

Strings

error_code:, xrefs: 00007FF8A8E06FF5
[p2p] create offer channel failed, xrefs: 00007FF8A8E06FE6
F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_service_invoker_biz_handler.cc, xrefs: 00007FF8A8E06FC4

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: error_code:$F:\Demo\ipc_sdk_fix\src\ipc_core\ipc_service_invoker_biz_handler.cc$[p2p] create offer channel failed
API String ID: 3768306364-2215136272
Opcode ID: d70c34b1f516a864e9069276c3ea9b24373c399f51dd461de2b6a1a417dce376
Instruction ID: 92c70ab22b2534fe8f4db5383924f039994210f085bc6517a2acfacc3d0389ed
Opcode Fuzzy Hash: d70c34b1f516a864e9069276c3ea9b24373c399f51dd461de2b6a1a417dce376
Instruction Fuzzy Hash: 2721C332A09682E6DB22DF12D4503ED3760FBD4784F858132D68D43666CF7CD94AC764

Function 00007FF8A8DF1645 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF8A8E7F19D
memmove.VCRUNTIME140 ref: 00007FF8A8E7F1DE
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A8E7F1F1

Strings

(, xrefs: 00007FF8A8E7F1D3

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: atoihtonsmemmove
String ID: (
API String ID: 1328169870-3887548279
Opcode ID: c63ce16eac604ac9875bb75899980823996a279829dad97bd195d57ffc8eb7a5
Instruction ID: 1c64fc92cad7e18bf80c2561a7589f145ad547224fd9457ac91d4c7b6549e044
Opcode Fuzzy Hash: c63ce16eac604ac9875bb75899980823996a279829dad97bd195d57ffc8eb7a5
Instruction Fuzzy Hash: 9E11E132A09B8296EA00DF22E8001AAB3A1EF987C0F154132EE8D47795EF7CD085C710

Function 00007FF8A8DF24AF Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF8A8E7BFC0

Strings

listener_id:, xrefs: 00007FF8A8E7BFAE
[p2p_tcp_listener] OnListenerStoped, xrefs: 00007FF8A8E7BF9F
F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_listener.cc, xrefs: 00007FF8A8E7BF7D

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@
String ID: listener_id:$F:\Demo\ipc_sdk_fix\src\p2p\net\tcp_listener.cc$[p2p_tcp_listener] OnListenerStoped
API String ID: 3768306364-3811729947
Opcode ID: 3fae988a4ab6cc627202a5d957b0fb579da3c7831110e00489c216c363e83905
Instruction ID: 179e0d6f35ec8afaf28a770b62e8b96c02581b37d35c1d98cedfb0a9b70b9485
Opcode Fuzzy Hash: 3fae988a4ab6cc627202a5d957b0fb579da3c7831110e00489c216c363e83905
Instruction Fuzzy Hash: B411B63260D682D5EB259B25E8113EA67A0FFC4BC4F444135DA8D472A9DF7CD918CB14

Function 00007FF8A8E1A500 Relevance: 6.4, APIs: 5, Instructions: 140COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8E1A53A
memmove.VCRUNTIME140 ref: 00007FF8A8E1A581
memmove.VCRUNTIME140 ref: 00007FF8A8E1A5EA
memset.VCRUNTIME140 ref: 00007FF8A8E1A605

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: 543f42870f71992413d99a8ec788e3a7b500951cd287565d7b637c9d6cb79754
Instruction ID: e158270e18e2dd65445026a6d49132133112cbb6d91604d05a0e60d3642529e9
Opcode Fuzzy Hash: 543f42870f71992413d99a8ec788e3a7b500951cd287565d7b637c9d6cb79754
Instruction Fuzzy Hash: 7B51C072A4A786EAEB61CF00D6862BDB796EF207C0F418131CB1A46681EF7DF5358314

Function 00007FF8A8E1F320 Relevance: 6.3, APIs: 4, Instructions: 332COMMON

Download Yara Rule

APIs

_Mtx_lock.MSVCP140 ref: 00007FF8A8E1F355
_Mtx_unlock.MSVCP140 ref: 00007FF8A8E1F4FF
?_Throw_C_error@std@@YAXH@Z.MSVCP140 ref: 00007FF8A8E1F52A
_Mtx_lock.MSVCP140 ref: 00007FF8A8E1F5D7

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Mtx_lock$C_error@std@@Mtx_unlockThrow_
String ID:
API String ID: 1655869161-0
Opcode ID: a2caea49fec35520039b96e6f6bfa15cb6cfd7082c4cfba269a383660211676e
Instruction ID: 5d27c6210d64976019316f1a28c3fa483fd7175aebd149dee6fa0ed4e5955d1f
Opcode Fuzzy Hash: a2caea49fec35520039b96e6f6bfa15cb6cfd7082c4cfba269a383660211676e
Instruction Fuzzy Hash: D2817D32A0AB81A6EB549F62E4403A977A1FB94BC8F084035EF8C47B95DF78D464C758

Function 00007FF8A8DF1730 Relevance: 6.3, APIs: 4, Instructions: 323COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E2F430
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E2F4D0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E2F570
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E2F656

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 3803a256ca5446686c5d947a475cd793cc5c4b9c9a50dec86aad36ea8ac0c3af
Instruction ID: bf91e9b01e2d30216a9a884bfb1f1fe00ccd1e2cf58fbd6a35078979dc1441a9
Opcode Fuzzy Hash: 3803a256ca5446686c5d947a475cd793cc5c4b9c9a50dec86aad36ea8ac0c3af
Instruction Fuzzy Hash: 60518F72B16689A1EF19CB25D5983AC2361FB48FC8F580031CB4D0BB89DF7DD8A58714

Function 00007FF8A8DF29F0 Relevance: 6.3, APIs: 4, Instructions: 271COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0B09B
memmove.VCRUNTIME140 ref: 00007FF8A8E0B10A
memmove.VCRUNTIME140 ref: 00007FF8A8E0B1D0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E0B236

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnmemmove
String ID:
API String ID: 4032823789-0
Opcode ID: 2fe6d996d536ef05bf4ff26487628d524395d8799c00606bb5f555517e85dc50
Instruction ID: 3f3ed1a8072b998887f04881306fd118b7566b9722d0612bec5a0c55e4b3d1aa
Opcode Fuzzy Hash: 2fe6d996d536ef05bf4ff26487628d524395d8799c00606bb5f555517e85dc50
Instruction Fuzzy Hash: 6B51C271B0A686E5EB049B26D44427D6260FB84BE4F580A31DB6D07BD9DF7CD4A18328

Function 00007FF8A8DF454D Relevance: 6.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

APIs

_Mtx_lock.MSVCP140 ref: 00007FF8A8E453BE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E454B1
_Mtx_unlock.MSVCP140 ref: 00007FF8A8E454DE
?_Throw_C_error@std@@YAXH@Z.MSVCP140 ref: 00007FF8A8E454FA
_Mtx_lock.MSVCP140 ref: 00007FF8A8E455C8
_Mtx_unlock.MSVCP140 ref: 00007FF8A8E455E5

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Mtx_lockMtx_unlock$C_error@std@@Throw__invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2540038121-0
Opcode ID: a6895080eff53490f203e5b74fbffd362f8ecf2d9d1f1cb8da58a75886378028
Instruction ID: 2a699a106578d6dbf454145e02b6fbc17f5081fbc1cbcbf8bde6fd0146537ae5
Opcode Fuzzy Hash: a6895080eff53490f203e5b74fbffd362f8ecf2d9d1f1cb8da58a75886378028
Instruction Fuzzy Hash: 6E415A32B26B1195FF049BA1E8402BC23A4FB44BD8F444536EE5D27B99DF7CD4608364

Function 00007FF8A8DF1E79 Relevance: 6.2, APIs: 4, Instructions: 187COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E7614D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E7625D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E762A9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E76339

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 9278536e50fcb000115ff70084193ab182dbced5c8c6ab69b3db4c39765a3f9f
Instruction ID: 3f7069e53d072db3727531e937514ff4e4c077db51e2ca2b13fbf5647e4aea07
Opcode Fuzzy Hash: 9278536e50fcb000115ff70084193ab182dbced5c8c6ab69b3db4c39765a3f9f
Instruction Fuzzy Hash: 6D718F72F15A46A5FB10CBA4D4883AC2731EB057E8F500136DE6E27AE9DF78E486D314

Function 00007FF8A8DF36DE Relevance: 6.1, APIs: 4, Instructions: 116networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8E42D39
memset.VCRUNTIME140 ref: 00007FF8A8E42D4A
htons.WS2_32 ref: 00007FF8A8E42DC9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E42E63

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: memset$_invalid_parameter_noinfo_noreturnhtons
String ID:
API String ID: 2847493226-0
Opcode ID: 605bfbdfabc48fc959b9da5de35dc0ca57f6c08fe818218eaf47539359e98b63
Instruction ID: 7bcfee572ffcaa30d0aa94c0a85e4a03587c7424a430894cd3f2baaa4ddc3f74
Opcode Fuzzy Hash: 605bfbdfabc48fc959b9da5de35dc0ca57f6c08fe818218eaf47539359e98b63
Instruction Fuzzy Hash: 3F51D472A19A81A6E720DF24E4403ED7760FB887D8F405235EA9C43AD9DFBCD589CB14

Function 00007FF8A8DF1BBD Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

wcschr.VCRUNTIME140 ref: 00007FF8A8E937AE
wcschr.VCRUNTIME140 ref: 00007FF8A8E937C8
LCMapStringW.KERNEL32 ref: 00007FF8A8E93850
LCMapStringW.KERNEL32 ref: 00007FF8A8E93878

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Stringwcschr
String ID:
API String ID: 524711434-0
Opcode ID: 629dfaa4509f14c536420fde1577efca79fe75ce9651d578ef0c9baaecd83272
Instruction ID: 4ef83c0cf1de17c0e8a388ec002ba0e65dfecbd2b394b418560cef5e59976c89
Opcode Fuzzy Hash: 629dfaa4509f14c536420fde1577efca79fe75ce9651d578ef0c9baaecd83272
Instruction Fuzzy Hash: 3841E132A15A82E5EB208B65E8402AA7360FB48BF8F545332ED6D47BD8DF7CE551C314

Function 00007FF8A8E88EC0 Relevance: 6.1, APIs: 4, Instructions: 88networkCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8A8E88F86
WSAGetLastError.WS2_32 ref: 00007FF8A8E88F93
WSAGetLastError.WS2_32 ref: 00007FF8A8E88F9D

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 92e7e3fdbcaf9ef0a12f2b8e3b82d1ef8805655e0ecf64be8be34729ab4f123b
Instruction ID: af84317771adb39114060409dca54efafb7473dcd85f4c2531890d13460f97da
Opcode Fuzzy Hash: 92e7e3fdbcaf9ef0a12f2b8e3b82d1ef8805655e0ecf64be8be34729ab4f123b
Instruction Fuzzy Hash: 33413832609B85DAE750DF26E48456C73B9F708B94FA50139DB8D43B20EF39E8A1C354

Function 00007FF8A8E91530 Relevance: 6.1, APIs: 4, Instructions: 84networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF8A8E91624
WSAGetLastError.WS2_32 ref: 00007FF8A8E91631
WSAGetLastError.WS2_32 ref: 00007FF8A8E9163B
WSAGetLastError.WS2_32 ref: 00007FF8A8E91643

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ba0c32f09d58fc24b59cbb8b116e96d7576a89226dec04c13bedeb9e30b78f11
Instruction ID: d642a894847bb6638d232552ade773826eab611256d1480ef8a77c61e49baadb
Opcode Fuzzy Hash: ba0c32f09d58fc24b59cbb8b116e96d7576a89226dec04c13bedeb9e30b78f11
Instruction Fuzzy Hash: 3A41CBB2909B81D6E7458B75D4543A87BA4FB05B80F184239DB9C43382EF7CD4E4C754

Function 00007FF8A8DF11DB Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ.MSVCP140 ref: 00007FF8A8DFAB57
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ.MSVCP140 ref: 00007FF8A8DFAB7F
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ.MSVCP140 ref: 00007FF8A8DFAB94
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8DFABAE

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Locinfo@std@@$Cvtvec@@Getcvt@_Getdays@_Getmonths@_calloc
String ID:
API String ID: 1088302243-0
Opcode ID: 427ce340567dac49b25abc30bc2303fa4097dee899ecd283a9d9533eef3da199
Instruction ID: d5475e9fb54711c62e99d7d32872ccc59b2b66d3816f147a082d4df9f3f779f2
Opcode Fuzzy Hash: 427ce340567dac49b25abc30bc2303fa4097dee899ecd283a9d9533eef3da199
Instruction Fuzzy Hash: 66217A22A0AB86A2EA04CF65E55127933B0FF98B84F049235DA5D07711EF7CE5E58B14

Function 00007FF8A8E0A3B0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionmemoryCOMMON

Download Yara Rule

APIs

CertGetNameStringW.CRYPT32 ref: 00007FF8A8E0A3F9
LocalAlloc.KERNEL32 ref: 00007FF8A8E0A40F
CertGetNameStringW.CRYPT32 ref: 00007FF8A8E0A433
LocalFree.KERNEL32 ref: 00007FF8A8E0A45D

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CertLocalNameString$AllocFree
String ID:
API String ID: 240117179-0
Opcode ID: 2658a65b8a1cbab780a3fc78edff9288bc062582cbdc7f2e6a3d0d46116d934a
Instruction ID: 9bc4c425a3b2f7b8595074b15c527840952e5e92e4a3474635da4fa8858ac694
Opcode Fuzzy Hash: 2658a65b8a1cbab780a3fc78edff9288bc062582cbdc7f2e6a3d0d46116d934a
Instruction Fuzzy Hash: BA11D235A0AB8292E760CF22B80456AB7B1FF84BE4F044635DE5C47B98EF3CD0648718

Function 00007FF8A8E919F0 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

QueueUserWorkItem.KERNEL32 ref: 00007FF8A8E91A60
GetLastError.KERNEL32 ref: 00007FF8A8E91A6A
GetLastError.KERNEL32 ref: 00007FF8A8E91A74
GetLastError.KERNEL32 ref: 00007FF8A8E91A7C

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$ItemQueueUserWork
String ID:
API String ID: 3747073370-0
Opcode ID: ea69c6a6f9f7dbc96dc42b19cbb25493374f2b21617c0f0c3005558484f9ca02
Instruction ID: b12d022a57fe4044c81194230bcc5e6ff0b59f4b2b99ee5ce8dadcfdb9d3cc66
Opcode Fuzzy Hash: ea69c6a6f9f7dbc96dc42b19cbb25493374f2b21617c0f0c3005558484f9ca02
Instruction Fuzzy Hash: F3218E7260AB81D5EB508B66E4903A8B7A4FB06B90F4C0179C78C47B91DF7CD4B4C764

Function 00007FF8A8E9C150 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

ReadDirectoryChangesW.KERNEL32 ref: 00007FF8A8E9C1B5
GetLastError.KERNEL32 ref: 00007FF8A8E9C1BF
GetLastError.KERNEL32 ref: 00007FF8A8E9C1C9
GetLastError.KERNEL32 ref: 00007FF8A8E9C1D1

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLast$ChangesDirectoryRead
String ID:
API String ID: 3633525831-0
Opcode ID: e160677cce87432248c8fc111da2e8c17b314b20880756b4e9fc1265a085a165
Instruction ID: 61e3ddc0d24d135e7b6a97e1164eaf7d74afa6c003abd6f1282978011f6e2228
Opcode Fuzzy Hash: e160677cce87432248c8fc111da2e8c17b314b20880756b4e9fc1265a085a165
Instruction Fuzzy Hash: BD218772A09F8291E7509F51F480329B3A4FB58B94F144235DA8C47B64EFB9E4E1C320

Function 00007FF8A8E977E0 Relevance: 6.0, APIs: 4, Instructions: 46fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF8A8E9783B
CloseHandle.KERNEL32 ref: 00007FF8A8E97862
GetLastError.KERNEL32 ref: 00007FF8A8E97868

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID:
API String ID: 2528220319-0
Opcode ID: 08ad433b90992001b74b054e356e34733b9bcc0a99cb832ae8732726e5b6f3fa
Instruction ID: 57b33fedf4e3b512821782f19b3081d15052dcae2d35525adf810e89674e2b21
Opcode Fuzzy Hash: 08ad433b90992001b74b054e356e34733b9bcc0a99cb832ae8732726e5b6f3fa
Instruction Fuzzy Hash: 63119371A0AB8192E7508F75E8087697390FB44BF8F544335D9BD4A7D4DFBC80998B24

Function 00007FF8A8DF400C Relevance: 6.0, APIs: 4, Instructions: 43networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8A8E89692
WSAGetLastError.WS2_32 ref: 00007FF8A8E8969C

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID:
API String ID: 1729277954-0
Opcode ID: 1bc407ec73a613ecd44a3cbd30370c98ba2eebfb298624a6ebf0d8e2b95577e8
Instruction ID: a67c995a0ff71b060c024b87074382aedcf688363894d6fbe0cddff109b9b454
Opcode Fuzzy Hash: 1bc407ec73a613ecd44a3cbd30370c98ba2eebfb298624a6ebf0d8e2b95577e8
Instruction Fuzzy Hash: 38015E76F29143EBFB10AB35984552D2790FF80784FD40131D61D826A0EF3DE95AEA28

Function 00007FF8A8DF13CA Relevance: 6.0, APIs: 4, Instructions: 42networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8A8E89424
WSAGetLastError.WS2_32 ref: 00007FF8A8E8942E

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID:
API String ID: 1729277954-0
Opcode ID: f270654f4214fd02686820d6361f3e15832fe1665ca25b36ab9b6bbf0da3975e
Instruction ID: 3847489211431df8a3d1fc3cbede77726312048a7b8d3d3c0405f5c973e5f944
Opcode Fuzzy Hash: f270654f4214fd02686820d6361f3e15832fe1665ca25b36ab9b6bbf0da3975e
Instruction Fuzzy Hash: 87017C75F29542D7FB00AB34988522D27A5FF80B80FC40135DA0D827A0EF3CE95ADA28

Function 00007FF8A8DF164F Relevance: 6.0, APIs: 4, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF8A8E87449

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: c7e014d9f2f237a85d8541e9f782fce76c73870400f046a79b590be81f11bb65
Instruction ID: 47e8812f1d330a261fea9fc4469ba80355988e495ea6b5546e216c7d37aff9e4
Opcode Fuzzy Hash: c7e014d9f2f237a85d8541e9f782fce76c73870400f046a79b590be81f11bb65
Instruction Fuzzy Hash: 1CF03975F0A903E2EB546772AC8513C2265EF98B95FE44931C11D812A8EF2CA4BA4728

Function 00007FF8A8E91150 Relevance: 6.0, APIs: 4, Instructions: 40networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 00007FF8A8E9117D
SetHandleInformation.KERNEL32 ref: 00007FF8A8E91196
CreateIoCompletionPort.KERNEL32 ref: 00007FF8A8E911AC
closesocket.WS2_32 ref: 00007FF8A8E911C8

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CompletionCreateHandleInformationPortSocketclosesocket
String ID:
API String ID: 2454369209-0
Opcode ID: 0adb53fd211e34137db338b0558b3c39ecd341ef67ab95c836abd37dca8be9ec
Instruction ID: 5343d1f655805155ee8e2c714570ba75f2fe9718ffb365a883bc2d46e000c236
Opcode Fuzzy Hash: 0adb53fd211e34137db338b0558b3c39ecd341ef67ab95c836abd37dca8be9ec
Instruction Fuzzy Hash: 79018C3170964292EB508B26F80462AB360EB48BF4F184335DE3D077E4EF3DD4548A14

Function 00007FF8A8DF30E9 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

GetConsoleScreenBufferInfo.KERNEL32 ref: 00007FF8A8E8EAFB
GetLastError.KERNEL32 ref: 00007FF8A8E8EB05
EnterCriticalSection.KERNEL32 ref: 00007FF8A8E8EB1B
LeaveCriticalSection.KERNEL32 ref: 00007FF8A8E8EB32

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CriticalSection$BufferConsoleEnterErrorInfoLastLeaveScreen
String ID:
API String ID: 1301423563-0
Opcode ID: fdbcbf890e748bfb5b725390b28fd43c386673ff503bb8b22a92a54df6f4f299
Instruction ID: f27ac88c63da80d3cb55fdf15431e70a077e9b5e4f251cfa301742e45eac80a6
Opcode Fuzzy Hash: fdbcbf890e748bfb5b725390b28fd43c386673ff503bb8b22a92a54df6f4f299
Instruction Fuzzy Hash: 59012D71A1AA43E6EB10DF30E85117973A0FF887C4F404132EA4E87665EF3CE4658B28

Function 00007FF8A8DF3053 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32 ref: 00007FF8A8E84CDA
RegQueryValueExW.ADVAPI32 ref: 00007FF8A8E84D45

Strings

PERF, xrefs: 00007FF8A8E84D5E

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID: PERF
API String ID: 3660427363-2334803174
Opcode ID: 63faa57c79bb2be80338743905fd2f992a61af00322b3f709d9f73cf5aadd723
Instruction ID: 31d7c2198886f4099cc6cdb964682070b68d3672960c9fa080494acfbcff060f
Opcode Fuzzy Hash: 63faa57c79bb2be80338743905fd2f992a61af00322b3f709d9f73cf5aadd723
Instruction Fuzzy Hash: D451B632B1AA81E7EA61DB35E04066D7391FB84BD8F904231E64E07794DF3CE895C718

Function 00007FF8A8DF3B07 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E267C8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E2686A

Strings

stopped, xrefs: 00007FF8A8E26757, 00007FF8A8E267F9

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: stopped
API String ID: 3668304517-2795915500
Opcode ID: 323762119c66c4d45e959407a3fbdd3da47911930d60f10a03543002d4489950
Instruction ID: 614980aec03579111fda15c40d0c8c51b8ae7ce11d5ce296f64ed45be0b2d089
Opcode Fuzzy Hash: 323762119c66c4d45e959407a3fbdd3da47911930d60f10a03543002d4489950
Instruction Fuzzy Hash: A6519036A0A78196EF18DB25E44036D73A0FB957E0F144231EAAD037A5DF3CE464CB18

Function 00007FF8A8DF1370 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E1C6E8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E1C78A

Strings

stopped, xrefs: 00007FF8A8E1C677, 00007FF8A8E1C719

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: stopped
API String ID: 3668304517-2795915500
Opcode ID: 1e1dd1a6b212a9a9d9fc058f7c4405e220cec5d5ae6b8da2f9b82884a8dde675
Instruction ID: 89a360fe1bb65dd1facc2681fd52cd7115c9a7099c741b857bbc693e18ed7344
Opcode Fuzzy Hash: 1e1dd1a6b212a9a9d9fc058f7c4405e220cec5d5ae6b8da2f9b82884a8dde675
Instruction Fuzzy Hash: F651B432A0A782D6EA54DB25E04036D77A0FB44BE0F144231EBAD43B95CF7CE4A4CB18

Function 00007FF8A8DF26F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF8A8E81F5C
GetLastError.KERNEL32 ref: 00007FF8A8E81F86

Strings

CreateEvent, xrefs: 00007FF8A8E81F8E

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: CreateEvent
API String ID: 545576003-2692171526
Opcode ID: 228d9d8191148f0262c4eb30a64a75150bae74706620c116aea9414c1870c26e
Instruction ID: 38d5b5c1ee87cd06e963e606ec85d2d286f70d756012557a3efda408f8a94337
Opcode Fuzzy Hash: 228d9d8191148f0262c4eb30a64a75150bae74706620c116aea9414c1870c26e
Instruction Fuzzy Hash: 64119332B19683A6EB148B29E440B3D7391EF18BC8F544435CA49466A5DF3DD862C7A8

Function 00007FF8A8DF1BB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E3E972
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8E3E9C3

Strings

0.0.0.0, xrefs: 00007FF8A8E3E908

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 0.0.0.0
API String ID: 3668304517-3771769585
Opcode ID: 0cd53de4d30b7cd83531dc136b01b6428e8dd3ae437b49dbf42f8b31c09518b0
Instruction ID: 7900e0b4c385873d2baab6d936d17c6fbe68b67051262e2b53bc1e90e2f42bdb
Opcode Fuzzy Hash: 0cd53de4d30b7cd83531dc136b01b6428e8dd3ae437b49dbf42f8b31c09518b0
Instruction Fuzzy Hash: 5B31D972A0D682A2EB24DB54E44036E6761EF853E4F100231F6AD43AE9DF7CD849CB18

Function 00007FF8A8E8CC90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

QueueUserWorkItem.KERNEL32 ref: 00007FF8A8E8CCAE
GetLastError.KERNEL32 ref: 00007FF8A8E8CCBD

Strings

QueueUserWorkItem, xrefs: 00007FF8A8E8CCC5

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ErrorItemLastQueueUserWork
String ID: QueueUserWorkItem
API String ID: 476849798-2469634949
Opcode ID: bf9951621eb76f46a874d1cb95876bba9c11d2fdf8fe2eb6d7683a19c52fef93
Instruction ID: 0de24fdcf15feb1efb8818d4340d4d5bf1cbc6d57e7a8606ddf6877e57f8d472
Opcode Fuzzy Hash: bf9951621eb76f46a874d1cb95876bba9c11d2fdf8fe2eb6d7683a19c52fef93
Instruction Fuzzy Hash: 07E04632F1B603B1EA446721A8442B912A0EF5ABC0FD40036C90D022A0FF3CE5A8C638

Function 00007FF8A8E281B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_Thrd_id.MSVCP140 ref: 00007FF8A8E28223

Strings

[p2p_loop] PreRun, xrefs: 00007FF8A8E281FF
F:\Demo\ipc_sdk_fix\src\p2p\net\event_loop.cc, xrefs: 00007FF8A8E281DD

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: Thrd_id
String ID: F:\Demo\ipc_sdk_fix\src\p2p\net\event_loop.cc$[p2p_loop] PreRun
API String ID: 479284-3495524936
Opcode ID: fe6688b5862b8abdb61e8ddc816640f662dca80847cab9f9cb9c47b690471b57
Instruction ID: ae82d640081b7af4e761ed81d28fe364879c2d6cfb4210e353c084f05f404434
Opcode Fuzzy Hash: fe6688b5862b8abdb61e8ddc816640f662dca80847cab9f9cb9c47b690471b57
Instruction Fuzzy Hash: 9B01D432A0E282A6EB25AF20E4413FD6360FB843C4F858039D79C03596DF7CD919C714

Function 00007FF8A8DF20D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF8A8E9F0E1
GetLastError.KERNEL32 ref: 00007FF8A8E9F0ED

Strings

NUL, xrefs: 00007FF8A8E9F0C1

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: NUL
API String ID: 1214770103-1038343538
Opcode ID: 4dc1e1eeca89cc3302f9979937ea22b94dd18afb3d07eb172eda978739078f2b
Instruction ID: 9be855dbf4231d460b015942c2fca2886229a60d4dce4d40c5b1131a687d08e5
Opcode Fuzzy Hash: 4dc1e1eeca89cc3302f9979937ea22b94dd18afb3d07eb172eda978739078f2b
Instruction Fuzzy Hash: 41F06D32A19A45D7E3208F70F4002AAB6A0FB55764F540325E6AC427C4DFBDD1E8CB14

Function 00007FF8A8DF32B1 Relevance: 5.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E9B042
GetLastError.KERNEL32 ref: 00007FF8A8E9B04F

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 6dddd6cbb617cacaccbfaf967716de66024050f573a780d116fa9c09479a80b9
Instruction ID: 37419adf737019f632fe0e92e7b9fb97b7a9c4101ab8e84392cb4c04de1214e9
Opcode Fuzzy Hash: 6dddd6cbb617cacaccbfaf967716de66024050f573a780d116fa9c09479a80b9
Instruction Fuzzy Hash: 1451E13260AB81E2E710DF62B9402AA77A4FB85BC8F084A35DE9C47795DF78D464D314

Function 00007FF8A8DF16D1 Relevance: 5.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E9BBEF
GetLastError.KERNEL32 ref: 00007FF8A8E9BBFC

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 8d650d357ebe3d4e742028df1e9f6ed7db9bf0deef14ea6be234945f2fdf463a
Instruction ID: 97936ad5339b9775aacef6fa0e19623626589de4a3e63df7bae1434c9786c0b8
Opcode Fuzzy Hash: 8d650d357ebe3d4e742028df1e9f6ed7db9bf0deef14ea6be234945f2fdf463a
Instruction Fuzzy Hash: C451C032609F91E1E710CF61A8002AAB7A4FF84BC8F184A35EE8C47795DF78D4A5D314

Function 00007FF8A8DF45DE Relevance: 5.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E9A6AA
GetLastError.KERNEL32 ref: 00007FF8A8E9A6B7

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 8b2daf393a255df149d78d024e9120ecaf30520a1f6f83a41d848168fd6e4725
Instruction ID: 9ac7dd2e8a50715bd63d6dc66309aaac37ea2772dd10a57a3aa818b4f9055315
Opcode Fuzzy Hash: 8b2daf393a255df149d78d024e9120ecaf30520a1f6f83a41d848168fd6e4725
Instruction Fuzzy Hash: 9E51BC3260AB8192E750CF61A8002AAB7E4FF44BC8F184635DE9D47B95DF78D4B5C724

Function 00007FF8A8DF4179 Relevance: 5.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E9B29A
GetLastError.KERNEL32 ref: 00007FF8A8E9B2A7

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 599551f49476c24152a4c7bd8f0805e3062455596ca8b3ef8a6b865fd30a263c
Instruction ID: 3c61c92fbfd78f01e34ab04a1e4a041eb41e6e66367b4e77736b70d93cf306f9
Opcode Fuzzy Hash: 599551f49476c24152a4c7bd8f0805e3062455596ca8b3ef8a6b865fd30a263c
Instruction Fuzzy Hash: 5B519F3260AF81D2E710CF61A8002AE76E4FB84BC8F184A35DE9D47B94DFB8D465C324

Function 00007FF8A8DF35BC Relevance: 5.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E9A21A
GetLastError.KERNEL32 ref: 00007FF8A8E9A227

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: e924da9bb928719d2c29efbcb08e7ba34b47dc525f82e149ee52a8f834270c46
Instruction ID: 0bfda72c9b5a715f9a5262f25727c7e6095bda5d15f46f55bfe4fcd039bc3a71
Opcode Fuzzy Hash: e924da9bb928719d2c29efbcb08e7ba34b47dc525f82e149ee52a8f834270c46
Instruction Fuzzy Hash: BF517B7260AB81D2E750CF61A8002AEB7E4FF44BC8F184635DE9D47B95DF78D4A58328

Function 00007FF8A8DF46A1 Relevance: 5.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E992FA
GetLastError.KERNEL32 ref: 00007FF8A8E99307

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 16fe630a38b2a05dfddb77ebf31c196ef344365a670baf29fe1fee4bfd99ebdd
Instruction ID: b0609f31aa0542f9c7c9f5f03a01eb71443d99a1764fa92ee7a8d3ff86d11ac7
Opcode Fuzzy Hash: 16fe630a38b2a05dfddb77ebf31c196ef344365a670baf29fe1fee4bfd99ebdd
Instruction Fuzzy Hash: 47519E32609F81D2E711DF61A8402AEB7A4FB44BC4F184635DE9D47B94DF78D8A5C324

Function 00007FF8A8DF3954 Relevance: 5.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E99557
GetLastError.KERNEL32 ref: 00007FF8A8E99564

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: d5ad701a61ce68619533dc3b7a0e2ad8c7d1d17811b032d02f9248d012d3a743
Instruction ID: 9aaa0492c2bbf887dc7976b7e3f199dd2a5d00f21f2496e51ee4ca5be864cd55
Opcode Fuzzy Hash: d5ad701a61ce68619533dc3b7a0e2ad8c7d1d17811b032d02f9248d012d3a743
Instruction Fuzzy Hash: 2441AE3260AB81D1E7109F62B9002AAB7A4FB44BC8F184235DE9D47795DF78D8A5D328

Function 00007FF8A8DF1C7B Relevance: 5.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E99FC2
GetLastError.KERNEL32 ref: 00007FF8A8E99FCF

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: b9b764d6cb7843c2343d1ce1f06b7c8fbb9bcc9f3a23ec66edf675df52fcb4c9
Instruction ID: 05b64ac341591a451cd8676d765b59f5411c4b4088c3aae042c70f4506793aee
Opcode Fuzzy Hash: b9b764d6cb7843c2343d1ce1f06b7c8fbb9bcc9f3a23ec66edf675df52fcb4c9
Instruction Fuzzy Hash: 1241BF3260AB81D2E7119F61A9002AAB7A4FF45BC8F084239DE8C47794DF78D4B5D318

Function 00007FF8A8DF238D Relevance: 5.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E9909A
GetLastError.KERNEL32 ref: 00007FF8A8E990A7

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 10b5a6df76f11530bd0ef2e38495b7ab171c5d4c2c44ae75104d97c0ab0c2277
Instruction ID: 80e5e95e1481498ac36b1f4268fd30a0e8ae49e439da7de5d270b4391602b2db
Opcode Fuzzy Hash: 10b5a6df76f11530bd0ef2e38495b7ab171c5d4c2c44ae75104d97c0ab0c2277
Instruction Fuzzy Hash: 9D519232609F81D2E7549F62A8002AAB7E4FB44BC4F144635DE9D47B94DF78D8A5C328

Function 00007FF8A8DF3418 Relevance: 5.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E9B992
GetLastError.KERNEL32 ref: 00007FF8A8E9B99F

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 444cb8c45d4522fa87c869414183cddac3b82106da4c462c7778ef4cddeae4e0
Instruction ID: 9e2b519ca649f105fdc31c8a5f3cf7d7f1b640c3d7f60565ba56dff7dd634022
Opcode Fuzzy Hash: 444cb8c45d4522fa87c869414183cddac3b82106da4c462c7778ef4cddeae4e0
Instruction Fuzzy Hash: D641FF32A0AB91D6E710DF61B9402AEB7A4FB84BD8F084635DE8C47794DFB8D464D318

Function 00007FF8A8DF278E Relevance: 5.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E9AAC2
GetLastError.KERNEL32 ref: 00007FF8A8E9AACF

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: a10324804769cc4f690163efcd4e3f889c56fb2ba4f9d88ae87783aa5a7b1073
Instruction ID: 255954e91ee96b1026105ef6693bb4b7d031f044c9b013c494de0b503ba5696d
Opcode Fuzzy Hash: a10324804769cc4f690163efcd4e3f889c56fb2ba4f9d88ae87783aa5a7b1073
Instruction Fuzzy Hash: 0141BE3260AB81D2E7109F61B9002AAB7A5FF44BC8F184235DE8C47795EF78D4B59318

Function 00007FF8A8DF169A Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E9A472
GetLastError.KERNEL32 ref: 00007FF8A8E9A47F

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 47a458ab462e07580ef1f6c315e33fd1a3b23dd2a007576169e2074889174ac0
Instruction ID: b8698993abf16e1a943e1fc3c01cce6f917907ecc48fd78271a6d7b8d1699fc2
Opcode Fuzzy Hash: 47a458ab462e07580ef1f6c315e33fd1a3b23dd2a007576169e2074889174ac0
Instruction Fuzzy Hash: D641AB32A09B82A2E720DF61B8002AEB3A5FB48BD8F084235DE9C47795DF78D475D314

Function 00007FF8A8DF13D9 Relevance: 5.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF8A8E2B982
memcmp.VCRUNTIME140 ref: 00007FF8A8E2B9BB
memcmp.VCRUNTIME140 ref: 00007FF8A8E2B9F0
memcmp.VCRUNTIME140 ref: 00007FF8A8E2BA39

Memory Dump Source

Source File: 00000006.00000002.2229044258.00007FF8A8DF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8DF0000, based on PE: true

Associated: 00000006.00000002.2229019295.00007FF8A8DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DF7000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8DFA000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229044258.00007FF8A8EC2000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229277418.00007FF8A8EE7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229332945.00007FF8A8F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229354256.00007FF8A8F09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229376758.00007FF8A8F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229392600.00007FF8A8F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2229436952.00007FF8A8F31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8df0000_rundll32.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 7e49771d4e403117cb5788d0c4204a23de16efc48f5f40d63b6e5fe728bef1f1
Instruction ID: 30ccff82add12d40818f62f4acb66f4584deb1bda81a92c8b601fad7d7c7ddaa
Opcode Fuzzy Hash: 7e49771d4e403117cb5788d0c4204a23de16efc48f5f40d63b6e5fe728bef1f1
Instruction Fuzzy Hash: 413132B2A15A46F2EF54DE25C1811A82366FB84BC4F809032CB4E57589EF74E5F4C324

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ipc_core.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ipc_34de501b8bd73c3e36d3e0acfc3b73cfa66f9184_69175d2b_a729d135-c707-4015-acc1-f27b8f28852a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ipc_8b9bed975dae47e075ac375e31246032436a60ba_69175d2b_857be848-56bf-4ec5-a37e-8df4ee63ed60\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ipc_94ee8ec67bc632ff8e90ed8ca719e8074793a6_69175d2b_366efc25-0cd7-4d79-ad15-0a93ec4edbd3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ipc_94ee8ec67bc632ff8e90ed8ca719e8074793a6_69175d2b_bddcb41c-2ce8-4647-90cb-888c62a06e81\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER100.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER11F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AD.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1DB.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EC.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER21A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER289.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C6.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER306.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE664.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE701.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE77F.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Windows Analysis Report
ipc_core.dll.dll

Function 00007FF8A8DF13E8 Relevance: 1.7, APIs: 1, Instructions: 193
COMMON