Edit tour

Windows Analysis Report
FSJs1TlAyf.exe

Overview

General Information

Sample name:	FSJs1TlAyf.exe renamed because original name is a hash value
Original sample name:	ee9523e1c8dacfac2fa2414e6ff2bb3e.exe
Analysis ID:	1520605
MD5:	ee9523e1c8dacfac2fa2414e6ff2bb3e
SHA1:	0134b858c8ad7445ea13f7fbd92705dc80dd726f
SHA256:	d275d3443707fd0808aadf5e4697b4dc38f5c74034cec06af426142c4ea72bd0
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	5
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

FSJs1TlAyf.exe (PID: 6088 cmdline: "C:\Users\user\Desktop\FSJs1TlAyf.exe" MD5: EE9523E1C8DACFAC2FA2414E6FF2BB3E)

conhost.exe (PID: 5676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: FSJs1TlAyf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715206920 FindFirstFileExW,FindClose,	0_2_00007FF715206920
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715220974 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF715220974
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715216208 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF715216208
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715216208 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF715216208

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715210D6C	0_2_00007FF715210D6C
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71521AFEC	0_2_00007FF71521AFEC
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715211BF4	0_2_00007FF715211BF4
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71521F9D8	0_2_00007FF71521F9D8
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71520FDD0	0_2_00007FF71520FDD0
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715222DDC	0_2_00007FF715222DDC
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71520783C	0_2_00007FF71520783C
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715216054	0_2_00007FF715216054
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715212028	0_2_00007FF715212028
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71521D818	0_2_00007FF71521D818
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715205890	0_2_00007FF715205890
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71521705C	0_2_00007FF71521705C
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF7152110F8	0_2_00007FF7152110F8
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF7152098F0	0_2_00007FF7152098F0
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715228718	0_2_00007FF715228718
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71520FFBC	0_2_00007FF71520FFBC
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71520F814	0_2_00007FF71520F814
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715208FF0	0_2_00007FF715208FF0
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715207314	0_2_00007FF715207314
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715222950	0_2_00007FF715222950
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71520717D	0_2_00007FF71520717D
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715214970	0_2_00007FF715214970
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715220974	0_2_00007FF715220974
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71521D198	0_2_00007FF71521D198
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF7152101A4	0_2_00007FF7152101A4
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715216208	0_2_00007FF715216208
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71520F9FC	0_2_00007FF71520F9FC
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71521F9D8	0_2_00007FF71521F9D8
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF7152249D8	0_2_00007FF7152249D8
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715224C54	0_2_00007FF715224C54
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715218C60	0_2_00007FF715218C60
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71521CCE8	0_2_00007FF71521CCE8
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715216208	0_2_00007FF715216208
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715207B48	0_2_00007FF715207B48
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF7152253D0	0_2_00007FF7152253D0
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71520FBE8	0_2_00007FF71520FBE8
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF7152123F4	0_2_00007FF7152123F4

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe

Code function: String function: 00007FF715201C40 appears 44 times

Source: classification engine

Classification label: clean5.winEXE@2/1@0/0

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe

Code function: 0_2_00007FF7152065C0 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF7152065C0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5676:120:WilError_03

Source: FSJs1TlAyf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe

File read: C:\Users\user\Desktop\FSJs1TlAyf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FSJs1TlAyf.exe "C:\Users\user\Desktop\FSJs1TlAyf.exe"
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe

Section loaded: kernel.appcore.dll

Jump to behavior

Source: FSJs1TlAyf.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: FSJs1TlAyf.exe

Static file information: File size 1908755 > 1048576

Source: FSJs1TlAyf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: FSJs1TlAyf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: FSJs1TlAyf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: FSJs1TlAyf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: FSJs1TlAyf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: FSJs1TlAyf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: FSJs1TlAyf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: FSJs1TlAyf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: FSJs1TlAyf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: FSJs1TlAyf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: FSJs1TlAyf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: FSJs1TlAyf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: FSJs1TlAyf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: FSJs1TlAyf.exe

Static PE information: real checksum: 0x6b0ea0 should be: 0x1e112c

Source: FSJs1TlAyf.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe

Code function: 0_2_00007FF715202EF0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF715202EF0

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17778

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe

API coverage: 7.8 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715206920 FindFirstFileExW,FindClose,	0_2_00007FF715206920
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715220974 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF715220974
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715216208 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF715216208
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715216208 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF715216208

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe

Code function: 0_2_00007FF71520A79C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF71520A79C

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe

Code function: 0_2_00007FF715222540 GetProcessHeap,

0_2_00007FF715222540

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71520A79C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF71520A79C
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71520A944 SetUnhandledExceptionFilter,	0_2_00007FF71520A944
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF71520A184 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF71520A184
Source: C:\Users\user\Desktop\FSJs1TlAyf.exe	Code function: 0_2_00007FF715219B90 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF715219B90

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe

Code function: 0_2_00007FF715228560 cpuid

0_2_00007FF715228560

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe

Code function: 0_2_00007FF71520A680 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF71520A680

Source: C:\Users\user\Desktop\FSJs1TlAyf.exe

Code function: 0_2_00007FF7152249D8 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7152249D8

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
FSJs1TlAyf.exe	0%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520605
Start date and time:	2024-09-27 16:45:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FSJs1TlAyf.exe renamed because original name is a hash value
Original Sample Name:	ee9523e1c8dacfac2fa2414e6ff2bb3e.exe
Detection:	CLEAN
Classification:	clean5.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 22 Number of non-executed functions: 78
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: FSJs1TlAyf.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\FSJs1TlAyf.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.992032697619302
Encrypted:	false
SSDEEP:	3:sVWLVVALkjBXFEWMAK0Nk8uUWJRWjdpi2mgL5eT98uUWJRWjGvn:sAzTFXF2oNk8uNJALtHAT98uNJAav
MD5:	B55C99998D8C3373C0D85DE03CE2F34D
SHA1:	567E2B86CD501916997CCF575DD2AE71E3D00B0E
SHA-256:	5327633513DA874A793F8844D1DAAFB30AAFE7C245A923861CBE99DBA5CB2CF2
SHA-512:	2BF8E4C7DA634AFC3060A9AD64B04B9D9D26B30851610F0890248E0B9D3CAC271FC38A6C7C2D52D9D8C9A88582A58B366B229511416FEB19B199272FF44723A6
Malicious:	false
Reputation:	low
Preview:	[6088] Cannot open PyInstaller archive from executable (C:\Users\user\Desktop\FSJs1TlAyf.exe) or external archive (C:\Users\user\Desktop\FSJs1TlAyf.pkg)..

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.92076736379278
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FSJs1TlAyf.exe
File size:	1'908'755 bytes
MD5:	ee9523e1c8dacfac2fa2414e6ff2bb3e
SHA1:	0134b858c8ad7445ea13f7fbd92705dc80dd726f
SHA256:	d275d3443707fd0808aadf5e4697b4dc38f5c74034cec06af426142c4ea72bd0
SHA512:	f302124d0224657fc25e05bc16fe8a4bd7426f9e822094ed6c549c559b3d8d12652bbb62b4016537f30e91d0f1d4e11c4ab20eac100bfaf87214dc05118a9c4c
SSDEEP:	24576:zzmVuyO5XT6785RIWO4r2EBnfxGmTgayLPA8nkweCk9mIZQeICFcIiLbnQNbnKWX:zXzXTK82EZ5zgzQCFIKerF1wA2W5V
TLSH:	0F952285726018F5ECB2913EC8519926E6717C261725C68B03F4DB633F236E2AD3F792
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0..&t..ut..ut..u...ts..u...t...u...t~..u...uw..u&..tS..u&..te..u&..t}..u...tq..ut..u...u...t`..u...tu..uRicht..u...............

File Icon


Icon Hash:	2e1e7c4c4c61e979

Static PE Info

General

Entrypoint:	0x14000a170
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x635FD051 [Mon Oct 31 13:40:33 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	0bbecc8e9f9f17b0ea9cc3899b15e5cf

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F171CB44FACh
dec eax
add esp, 28h
jmp 00007F171CB4490Fh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0001FF83h]
dec eax
mov ecx, ebx
call dword ptr [0001FF72h]
call dword ptr [0001FEFCh]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0001FF68h]
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [0001FF54h]
test eax, eax
je 00007F171CB44AA9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00040EBAh]
call 00007F171CB44C6Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00040FA1h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00040F31h], eax
dec eax
mov eax, dword ptr [00040F8Ah]
dec eax
mov dword ptr [00040DFBh], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00040EFFh], eax
mov dword ptr [00040DD5h], C0000409h
mov dword ptr [00040DCFh], 00000001h
mov dword ptr [000000D9h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3af84	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x51000	0xf00c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4d000	0x20c4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x61000	0x760	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x388d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x388f0	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x350	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x283b0	0x28400	3934da16b5483705275109464a144723	False	0.5573866944875776	zlib compressed data	6.489819183693795	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0x11b0a	0x11c00	5a74c3f7ad60948d0df9367209637026	False	0.49700154049295775	data	5.740250026808923	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3c000	0x103f8	0xe00	2e1e8fe7925a84141c5002f6f9f2433f	False	0.13169642857142858	data	1.815543957758518	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x4d000	0x20c4	0x2200	fa1e65ae14d0fa9cfb8c159678c80456	False	0.4762178308823529	data	5.29574114817852	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x50000	0xf4	0x200	b8e40129f8b47b4f0cad612d6dcc81ce	False	0.30859375	data	1.9916014127577144	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x51000	0xf00c	0xf200	22651a6423c0ab780c43ed764bf56979	False	0.7950994318181818	data	7.356285455548181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x61000	0x760	0x800	f1b8ddf27c1f50be169553e1e4fa77ae	False	0.5576171875	data	5.23067452278527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x51208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.56636460554371
RT_ICON	0x520b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7287906137184116
RT_ICON	0x52958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.7471098265895953
RT_ICON	0x52ec0	0x909b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9971636186822983
RT_ICON	0x5bf5c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.38309128630705397
RT_ICON	0x5e504	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.4826454033771107
RT_ICON	0x5f5ac	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.699468085106383
RT_GROUP_ICON	0x5fa14	0x68	data	0.7019230769230769
RT_MANIFEST	0x5fa7c	0x58e	XML 1.0 document, ASCII text, with CRLF line terminators	0.4451476793248945

Imports

DLL

Import

KERNEL32.dll

GetCommandLineW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, FreeLibrary, LoadLibraryExW, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, SetEndOfFile, GetProcAddress, GetModuleFileNameW, SetDllDirectoryW, GetStartupInfoW, GetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetModuleHandleW, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, SetConsoleCtrlHandler, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, HeapReAlloc, GetFileAttributesExW, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW

ADVAPI32.dll

ConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW

Target ID:	0
Start time:	10:45:55
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\FSJs1TlAyf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\FSJs1TlAyf.exe"
Imagebase:	0x7ff715200000
File size:	1'908'755 bytes
MD5 hash:	EE9523E1C8DACFAC2FA2414E6FF2BB3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:45:55
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	33

Executed Functions

Function 00007FF71521AFEC Relevance: 10.8, APIs: 7, Instructions: 286
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71521B41E

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1efec4cda5df6dec563488fd6b489641d90e4c159bad1a86432f81c53d1c3fea
Instruction ID: 2d32883203f605419f2786866cf29ab0f35eb0f50b9de663ae38deeca9d129de
Opcode Fuzzy Hash: 1efec4cda5df6dec563488fd6b489641d90e4c159bad1a86432f81c53d1c3fea
Instruction Fuzzy Hash: 09C191A3A08E4695E7697B219CD03BEA7A0EB41FA0FC44135DA4E077A1CF7CE45C8721

Function 00007FF715211BF4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b57c07ee410fd099c399a89ba106d39b1c70b102af5975a3334a5b455f61937
Instruction ID: b2d8875e54e247a4dc0e17a2ecc64d9bdf1d0b2816a7137331e0810a566ba284
Opcode Fuzzy Hash: 6b57c07ee410fd099c399a89ba106d39b1c70b102af5975a3334a5b455f61937
Instruction Fuzzy Hash: C1E1C9A3908E4685EB6CAA298C8437FA7A1EB45F68FA44135DD0D472F5CF39D849C321

Function 00007FF715210D6C Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df827db252763572e02e0a54ce157ccc6132b2c44029538ac4c7a5bbc0429e0f
Instruction ID: 0c2c0e30307011da54d01bd4bee8ebab3c55d2ab01675d7003436b058e1de648
Opcode Fuzzy Hash: df827db252763572e02e0a54ce157ccc6132b2c44029538ac4c7a5bbc0429e0f
Instruction Fuzzy Hash: 10B16EB3A08A8586E768AF358C9127E7BA0EB05F68F640135CE4D473A9CF39D448C764

Function 00007FF7152017A0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF71520184C
_fread_nolock.LIBCMT ref: 00007FF7152018FE

Part of subcall function 00007FF71520E1FC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71520E210

Strings

fread, xrefs: 00007FF71520185E
Failed to seek to cookie position!, xrefs: 00007FF71520181F
malloc, xrefs: 00007FF7152018DA
MEI, xrefs: 00007FF7152017DF
Could not allocate buffer for TOC!, xrefs: 00007FF7152018D3
Failed to read cookie!, xrefs: 00007FF715201857
Could not read full TOC!, xrefs: 00007FF715201909
Error on file., xrefs: 00007FF71520192D
Cannot read Table of Contents., xrefs: 00007FF715201985
fseek, xrefs: 00007FF715201826

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _fread_nolock$_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 3405171723-4158440160
Opcode ID: dcb00d85fefd41ca24dcc0014f77b320b48d92a86aa44687ca5b56c916bd0197
Instruction ID: 6593ab7b0507df3289fbe508e360621eb3eb1804e3e686cba9a8e8236fd15a52
Opcode Fuzzy Hash: dcb00d85fefd41ca24dcc0014f77b320b48d92a86aa44687ca5b56c916bd0197
Instruction Fuzzy Hash: 6A5150B3A0AE0686EB58EF24DC90178A3A0FF88F64BA14135D90D877A5DF7CE548C750

Function 00007FF715225918 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF715225648: _invalid_parameter_noinfo.LIBCMT ref: 00007FF715225689
Part of subcall function 00007FF715225648: _invalid_parameter_noinfo.LIBCMT ref: 00007FF715225709
Part of subcall function 00007FF715225648: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71522575D
Part of subcall function 00007FF715225648: _get_daylight.LIBCMT ref: 00007FF7152257B5

CreateFileW.KERNELBASE ref: 00007FF715225A1E
CreateFileW.KERNEL32 ref: 00007FF715225A6E
GetLastError.KERNEL32 ref: 00007FF715225A9E
GetFileType.KERNELBASE ref: 00007FF715225AB3
GetLastError.KERNEL32 ref: 00007FF715225ABD
CloseHandle.KERNEL32 ref: 00007FF715225AF0
CloseHandle.KERNEL32 ref: 00007FF715225C54
CreateFileW.KERNEL32 ref: 00007FF715225C89
GetLastError.KERNEL32 ref: 00007FF715225C98

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 02cca5bccd40fabf63340106bcaa0c32295241461f6bfbf06850c78983670354
Instruction ID: 2bd350280d2921e900d97c69a822259b6685155d1c2c12a9abe0ef3065bdf782
Opcode Fuzzy Hash: 02cca5bccd40fabf63340106bcaa0c32295241461f6bfbf06850c78983670354
Instruction Fuzzy Hash: 9CC1CF77B24E4285EB18EF64C8802AC7761FB49FB8B814225DA1F9B7A4DF38D059C750

Function 00007FF715201000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF715202CA0: GetModuleFileNameW.KERNEL32(?,00007FF715202799,?,?,?,?,?,?), ref: 00007FF715202CD1

SetDllDirectoryW.KERNEL32 ref: 00007FF7152029A5

Part of subcall function 00007FF715205AA0: GetEnvironmentVariableW.KERNEL32(00007FF7152027E7,?,?,?,?,?,?), ref: 00007FF715205ADA
Part of subcall function 00007FF715205AA0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF715205AF7

Strings

_MEIPASS2, xrefs: 00007FF7152027D3, 00007FF71520283C, 00007FF715202AEB, 00007FF715202AFB
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF71520292C
MEI, xrefs: 00007FF7152028E7
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF71520288E
Failed to convert DLL search path!, xrefs: 00007FF71520298D
_PYI_ONEDIR_MODE, xrefs: 00007FF7152027FC, 00007FF715202827

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 437be6d0b46d60767c3808ad64dd4452352ae2485947e3d029eda56fbacb3c9c
Instruction ID: 17ad17f5cfb77efde7a8765b7f65714710b3b95252e044be4062e06a60a04f4b
Opcode Fuzzy Hash: 437be6d0b46d60767c3808ad64dd4452352ae2485947e3d029eda56fbacb3c9c
Instruction Fuzzy Hash: E0C175A7A1AD8241EA2CBB21DC502FDA351BF55FA4FC44032EA4D476B6DF2CE50D8760

Function 00007FF71521DED0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF71521E26E,?,?,-00000018,00007FF71521A2D2,?,?,?,00007FF71521A1CA,?,?,?,00007FF715214E92), ref: 00007FF71521E04F
GetProcAddress.KERNEL32(?,00000000,?,00007FF71521E26E,?,?,-00000018,00007FF71521A2D2,?,?,?,00007FF71521A1CA,?,?,?,00007FF715214E92), ref: 00007FF71521E05B

Strings

ext-ms-, xrefs: 00007FF71521DFAC
api-ms-, xrefs: 00007FF71521DF99

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 9ff0b00ddf2d53719ca0ae7b4d7c1f3d3dc542aa51b61fb483f5c334d992089f
Instruction ID: 52af08bba8365f9cf0d61534086d7b945353e4ab3d440aaaf9c260dd6cd2703b
Opcode Fuzzy Hash: 9ff0b00ddf2d53719ca0ae7b4d7c1f3d3dc542aa51b61fb483f5c334d992089f
Instruction Fuzzy Hash: 2041E5A3B19E4285FA19BB269C446A6A391BF44FF0F844135DD0D87764EF3CE14D8320

Function 00007FF71521C51C Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF71521C4BC), ref: 00007FF71521C63F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF71521C4BC), ref: 00007FF71521C6C9

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: b8782002306de0398a634dae520aeb9f99aa45353b65106ac1a4176d4e67bd1c
Instruction ID: 98339d95bb340f39b16c7df0ceba81f2921181d25d0d9068c26f5a75b014e8a9
Opcode Fuzzy Hash: b8782002306de0398a634dae520aeb9f99aa45353b65106ac1a4176d4e67bd1c
Instruction Fuzzy Hash: 4C91E6F7E18E5285E758AB65DCC02BEA7A0BB44FA8F805135DD0E636A4CF78D049C720

Function 00007FF715209FEC Relevance: 6.1, APIs: 4, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF71520A000

Part of subcall function 00007FF71520A46C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF71520A48E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF71520A015
__scrt_release_startup_lock.LIBCMT ref: 00007FF71520A083
__scrt_is_managed_app.LIBCMT ref: 00007FF71520A0FA

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 1321466686-0
Opcode ID: 75ced3f1347e96692db72aa4457157b955664eb10c7598344c9f390de26af036
Instruction ID: 8f912c7e4b5c07801454422da5b21b24265128af11a434c3206c80744223e80a
Opcode Fuzzy Hash: 75ced3f1347e96692db72aa4457157b955664eb10c7598344c9f390de26af036
Instruction Fuzzy Hash: 05315BA3E0AD4642EA1CBB209C913BAD391AF41FA4FC44135E90D076F3DFADA40D8321

Function 00007FF71521893C Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF715218938), ref: 00007FF71521894D
TerminateProcess.KERNEL32(?,?,?,00007FF715218938), ref: 00007FF715218958
ExitProcess.KERNEL32 ref: 00007FF715218967

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 72c40e9bc9da88f563b1ddfc7c3b652d8fa207243ca7bed097afc0063ca2036c
Instruction ID: 013611d01cafb1a034bff0b35ac5b1f8069dbbf694fee578e7a6136ef821db00
Opcode Fuzzy Hash: 72c40e9bc9da88f563b1ddfc7c3b652d8fa207243ca7bed097afc0063ca2036c
Instruction Fuzzy Hash: 89D09E9AB18E0642EA1C3B715CD517AA3516F88F61FC01938C94B067B3DFFDA84D8662

Function 00007FF71520E228 Relevance: 3.2, APIs: 2, Instructions: 175
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71520E264
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71520E361

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e44e10923db74b5893bbab202256f5abcd689c30b6215d53ffe62d7ddd08f1bb
Instruction ID: 1292a6f7eaf78367438134027f7b68d157a6923f9ecc2995e1b1f3be0e869768
Opcode Fuzzy Hash: e44e10923db74b5893bbab202256f5abcd689c30b6215d53ffe62d7ddd08f1bb
Instruction Fuzzy Hash: 0551B9A3B0AA424AF66CAE259D0067AA791BF40F74F844331DD6C177E5CF3CD4898721

Function 00007FF71521BFCC Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 00007FF71521C07F
GetLastError.KERNEL32 ref: 00007FF71521C09B

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 60ba3ea1cee370b47c9822f89494a1430f5e21301793be04a4380ac70a028981
Instruction ID: d798e439926f77d52a867f294a36509dfaa4eea8b34517c4239eaf4440c2a11a
Opcode Fuzzy Hash: 60ba3ea1cee370b47c9822f89494a1430f5e21301793be04a4380ac70a028981
Instruction Fuzzy Hash: 7831D9B7619E818AD714AF25EC8029AB760FB58F90F844032DB4D53724DF7CD55ACB10

Function 00007FF71521B9B0 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF71521BA29
GetFileType.KERNELBASE ref: 00007FF71521BA3F

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 254452b7706e12ab99815ecd481b2d36dcc5792f580765e970da78b2d1b252ed
Instruction ID: 9f45cbba0dcd59d962016d62ba5896a98e2d4ad90cfc72a77c8fa5254bf56c3c
Opcode Fuzzy Hash: 254452b7706e12ab99815ecd481b2d36dcc5792f580765e970da78b2d1b252ed
Instruction Fuzzy Hash: 53316F63A18F4681DB68AB159D8017AA660FB45FB0BA4133ADB6E077F0CF38E495D350

Function 00007FF71521B6CC Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF71521B66C,?,?,?,?,?,?,?,00007FF71521B7C1), ref: 00007FF71521B718
GetLastError.KERNEL32(?,?,?,?,?,00007FF71521B66C,?,?,?,?,?,?,?,00007FF71521B7C1), ref: 00007FF71521B722

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3fcae65897e6c61f04e557ea26a8e218cd8f9f9714c9d8c87c697d929e26921c
Instruction ID: e333b961e20d9ad46db41ef38f753e2ddf8d84539600fde0d0e9afff1c9dc7c2
Opcode Fuzzy Hash: 3fcae65897e6c61f04e557ea26a8e218cd8f9f9714c9d8c87c697d929e26921c
Instruction Fuzzy Hash: EB11C4A7718E8181DA14AB25AC8416AA361EB45FF4F944332EE7D0B7F9CF7CD0598740

Function 00007FF71521A0D8 Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF715219F55,?,?,00000000,00007FF71521A00A), ref: 00007FF71521A146
GetLastError.KERNEL32(?,?,?,00007FF715219F55,?,?,00000000,00007FF71521A00A), ref: 00007FF71521A150

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 72524f83cc78990394c5b66e1865510d1fac97e41dc314b45af11a8cb4b07a54
Instruction ID: b73ee849dacae41f24a56941ffeb77744a5eda1a08ffe71ebaf34ef5403ee70d
Opcode Fuzzy Hash: 72524f83cc78990394c5b66e1865510d1fac97e41dc314b45af11a8cb4b07a54
Instruction Fuzzy Hash: 8C2192A2B08E8241EE6877619DC137E92C15F44FB0FD44235D96E4B7E1CFACE48D8250

Function 00007FF71521B438 Relevance: 1.6, APIs: 1, Instructions: 105
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71521B460

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d62942da97de37a2860dd6d0e1f9e630cfdeedc3425349316c2570dffc25b01a
Instruction ID: b52bde095a54679be9f5578a4dd5087e1f29bada654ae5e3ae02be741613f136
Opcode Fuzzy Hash: d62942da97de37a2860dd6d0e1f9e630cfdeedc3425349316c2570dffc25b01a
Instruction Fuzzy Hash: 0D41A473A18A0593EA38EB19EDC027AB7B0EB55F60F940131D68A477B1CF2DE5068760

Function 00007FF7152062B0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF71520635A

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: cb22e2439c165d9821cd33dcd0ae704be25b1c4f8b238088efad9984f8d70623
Instruction ID: 97ce5c0d761990b7cf3e87c5b9e7985b62906d48c8a892dfb538df451d7c71ec
Opcode Fuzzy Hash: cb22e2439c165d9821cd33dcd0ae704be25b1c4f8b238088efad9984f8d70623
Instruction Fuzzy Hash: C6218162B09A9245FA1CAB125D043BAE695BB45FE4FD85430EE0D07B96CF3CF0498320

Function 00007FF71521AED0 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71521AFC7

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a12535e4dc74fb1052bc3e5f393ecddc21ee65f167b380334bfc50af62763cea
Instruction ID: 07ae6d1c9f0333e5fef24e55adcd25756fa0c98e2c0ab6f95407d06a21f87dc1
Opcode Fuzzy Hash: a12535e4dc74fb1052bc3e5f393ecddc21ee65f167b380334bfc50af62763cea
Instruction Fuzzy Hash: 2F3194E3A18A0645E6197B558CC137EAA90AB80F71FD50135EA1D073F2CFBCA4498771

Function 00007FF71521886D Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF71521889B

Part of subcall function 00007FF7152189A0: GetModuleHandleExW.KERNEL32 ref: 00007FF7152189C5
Part of subcall function 00007FF7152189A0: GetProcAddress.KERNEL32 ref: 00007FF7152189DB
Part of subcall function 00007FF7152189A0: FreeLibrary.KERNEL32 ref: 00007FF715218A02

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: daca8cff460457d6512fb6da0464d50e1cc43b67e9e7d2a5494a2fa5ad7a7b29
Instruction ID: d42839ed6c6bb04e3afa48f98287a1eb515fa0294cd7f0948d96586b6ecefda6
Opcode Fuzzy Hash: daca8cff460457d6512fb6da0464d50e1cc43b67e9e7d2a5494a2fa5ad7a7b29
Instruction Fuzzy Hash: A0218373E04B0589EB19AFA4CCC42ED73A0EB44B28F944635D65D07AE5DFB8D849C790

Function 00007FF715214EE8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715214E4D

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e90f8ce5764a470f7ee9635705d620940d88810dc673939d3ef575fbcdedae18
Instruction ID: 6e439b2a22d294cbf0af23708629e033b7b8f70156fb84486997e188a9f1eab2
Opcode Fuzzy Hash: e90f8ce5764a470f7ee9635705d620940d88810dc673939d3ef575fbcdedae18
Instruction Fuzzy Hash: FE1196A3A1CA4241EA68BF519C8067FE2A0BF85FA0FC84431EB4C576A6CF7DD40447A4

Function 00007FF71522530C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71522532F

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6c3d8333815b8a39be3028d6c802438f47f4a5808d3411c6d7eaaeee1b4a38a8
Instruction ID: c3ad88aedda405f8671689d7e2c2363d1f191c810625d429636e85ba8b8c89b3
Opcode Fuzzy Hash: 6c3d8333815b8a39be3028d6c802438f47f4a5808d3411c6d7eaaeee1b4a38a8
Instruction Fuzzy Hash: 06210A73718E4147D728AF24E880379B6A0EB84F74F949234D65E4B6E5DF7CD4048B00

Function 00007FF71520E4A8 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71520E4FC

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 29025e4fbd0061adb57e08459e0c1774dda2bf5131305b82728034827c82207c
Instruction ID: a6b65c4c5e72501e72b56753e35c37ed8766da204c2fcc9f227250c246bb929f
Opcode Fuzzy Hash: 29025e4fbd0061adb57e08459e0c1774dda2bf5131305b82728034827c82207c
Instruction Fuzzy Hash: 0001E1A2A09F4141EA08AB529D0106AEA91AF85FF0F884A31EE5C13BE6DF3CE4458310

Non-executed Functions

Function 00007FF715202EF0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7152022BE,?,?,?,?), ref: 00007FF715202F06
GetProcAddress.KERNEL32(?,?,00000000,00007FF7152022BE,?,?,?,?), ref: 00007FF715202F45
GetProcAddress.KERNEL32(?,?,00000000,00007FF7152022BE,?,?,?,?), ref: 00007FF715202F6A
GetProcAddress.KERNEL32(?,?,00000000,00007FF7152022BE,?,?,?,?), ref: 00007FF715202F8F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7152022BE,?,?,?,?), ref: 00007FF715202FB7
GetProcAddress.KERNEL32(?,?,00000000,00007FF7152022BE,?,?,?,?), ref: 00007FF715202FDF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7152022BE,?,?,?,?), ref: 00007FF715203007
GetProcAddress.KERNEL32(?,?,00000000,00007FF7152022BE,?,?,?,?), ref: 00007FF71520302F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7152022BE,?,?,?,?), ref: 00007FF715203057

Strings

Failed to get address for PyErr_Fetch, xrefs: 00007FF7152032C9
Failed to get address for PyImport_AddModule, xrefs: 00007FF715203341
GetProcAddress, xrefs: 00007FF715202F1F
Failed to get address for Py_UTF8Mode, xrefs: 00007FF715203099
Failed to get address for PyImport_ImportModule, xrefs: 00007FF715203391
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF715203549
Failed to get address for PyObject_Str, xrefs: 00007FF7152034F9
PyImport_ExecCodeModule, xrefs: 00007FF71520334D
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF715202F57
Py_UTF8Mode, xrefs: 00007FF71520307D
Failed to get address for PyEval_EvalCode, xrefs: 00007FF715203611
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF715203369
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF715203069
PyLong_AsLong, xrefs: 00007FF7152033ED
Failed to get address for Py_VerboseFlag, xrefs: 00007FF715203041
PyErr_Restore, xrefs: 00007FF7152032D5
PySys_SetArgvEx, xrefs: 00007FF715203555
Py_FrozenFlag, xrefs: 00007FF715202F60
Failed to get address for Py_SetPythonHome, xrefs: 00007FF715203201
Failed to get address for PyUnicode_Join, xrefs: 00007FF715203779
Failed to get address for Py_GetPath, xrefs: 00007FF7152031B1
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF715202FF1
PyUnicode_FromFormat, xrefs: 00007FF7152036BD
Failed to get address for PyMem_RawFree, xrefs: 00007FF7152036B1
PyRun_SimpleStringFlags, xrefs: 00007FF715203505
PyErr_Clear, xrefs: 00007FF715203235
PyDict_GetItemString, xrefs: 00007FF71520320D
PyUnicode_Decode, xrefs: 00007FF7152036E5
Failed to get address for Py_FrozenFlag, xrefs: 00007FF715202F7C
PyObject_SetAttrString, xrefs: 00007FF71520348D
PyUnicode_DecodeFSDefault, xrefs: 00007FF71520370D
Py_FileSystemDefaultEncoding, xrefs: 00007FF715202F3B
Failed to get address for PyModule_GetDict, xrefs: 00007FF715203431
Py_UnbufferedStdioFlag, xrefs: 00007FF71520304D
Py_IgnoreEnvironmentFlag, xrefs: 00007FF715202F85
Failed to get address for Py_SetPath, xrefs: 00007FF715203189
PyEval_EvalCode, xrefs: 00007FF7152035F5
Failed to get address for PyErr_Occurred, xrefs: 00007FF715203279
PyUnicode_AsUTF8, xrefs: 00007FF715203735
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7152034A9
Py_NoUserSiteDirectory, xrefs: 00007FF715202FD5
Failed to get address for Py_Initialize, xrefs: 00007FF715203161
PyErr_NormalizeException, xrefs: 00007FF7152032FD
Py_NoSiteFlag, xrefs: 00007FF715202FAD
Py_GetPath, xrefs: 00007FF715203195
Failed to get address for PyLong_AsLong, xrefs: 00007FF715203409
PyObject_CallFunctionObjArgs, xrefs: 00007FF715203465
PyUnicode_Join, xrefs: 00007FF71520375D
Py_Initialize, xrefs: 00007FF715203145
PyImport_ImportModule, xrefs: 00007FF715203375
PyObject_Str, xrefs: 00007FF7152034DD
PySys_AddWarnOption, xrefs: 00007FF71520352D
Failed to get address for PyList_Append, xrefs: 00007FF7152033B9
Failed to get address for PyObject_CallFunction, xrefs: 00007FF715203459
Py_SetProgramName, xrefs: 00007FF7152031BD
Failed to get address for PyErr_Clear, xrefs: 00007FF715203251
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF715202F18
Failed to get address for PySys_GetObject, xrefs: 00007FF715203599
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF715203521
PyMem_RawFree, xrefs: 00007FF715203695
Py_SetPath, xrefs: 00007FF71520316D
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF715203751
Failed to get address for PyDict_GetItemString, xrefs: 00007FF715203229
PyList_Append, xrefs: 00007FF71520339D
PySys_SetPath, xrefs: 00007FF7152035CD
Failed to get address for PySys_SetObject, xrefs: 00007FF7152035C1
Py_DecodeLocale, xrefs: 00007FF71520366D
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF715202FC9
PyList_New, xrefs: 00007FF7152033C5
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7152036D9
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7152037A1
Failed to get address for Py_BuildValue, xrefs: 00007FF7152030C1
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7152034D1
Py_VerboseFlag, xrefs: 00007FF715203025
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF715203481
Py_OptimizeFlag, xrefs: 00007FF715202FFD
Py_IncRef, xrefs: 00007FF71520311D
PyObject_CallFunction, xrefs: 00007FF71520343D
Failed to get address for PyErr_Restore, xrefs: 00007FF7152032F1
Failed to get address for Py_DecRef, xrefs: 00007FF7152030E9
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF715203019
Py_DecRef, xrefs: 00007FF7152030CD
PyErr_Occurred, xrefs: 00007FF71520325D
PySys_GetObject, xrefs: 00007FF71520357D
Failed to get address for PyErr_Print, xrefs: 00007FF7152032A1
PyModule_GetDict, xrefs: 00007FF715203415
Failed to get address for PyUnicode_Decode, xrefs: 00007FF715203701
Py_Finalize, xrefs: 00007FF7152030F5
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF715203729
Failed to get address for Py_DecodeLocale, xrefs: 00007FF715203689
PySys_SetObject, xrefs: 00007FF7152035A5
Failed to get address for Py_IncRef, xrefs: 00007FF715203139
PyErr_Print, xrefs: 00007FF715203285
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF715203639
Failed to get address for Py_Finalize, xrefs: 00007FF715203111
PyObject_GetAttrString, xrefs: 00007FF7152034B5
PyErr_Fetch, xrefs: 00007FF7152032AD
PyUnicode_FromString, xrefs: 00007FF715203645
PyMarshal_ReadObjectFromString, xrefs: 00007FF71520361D
Py_DontWriteBytecodeFlag, xrefs: 00007FF715202EFF
Failed to get address for PySys_SetPath, xrefs: 00007FF7152035E9
Failed to get address for PyList_New, xrefs: 00007FF7152033E1
Failed to get address for Py_SetProgramName, xrefs: 00007FF7152031D9
Failed to get address for PyUnicode_FromString, xrefs: 00007FF715203661
Py_SetPythonHome, xrefs: 00007FF7152031E5
PyImport_AddModule, xrefs: 00007FF715203325
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF715203319
PyUnicode_Replace, xrefs: 00007FF715203785
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF715202FA1
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF715203571
Py_BuildValue, xrefs: 00007FF7152030A5

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 9c2bbc218991423718b6960939b18873de7b1caac2114aaca40452c8a50254ff
Instruction ID: 3a0537ae9c0217a2a64eaf92eedf289f35cd7c7089d8171059dc4dd5dba2c2cb
Opcode Fuzzy Hash: 9c2bbc218991423718b6960939b18873de7b1caac2114aaca40452c8a50254ff
Instruction Fuzzy Hash: CE4263EBA0EF0791EA5DEB05EC54274A3A1AF19FA0BD45135D80E06674EFACB54C9320

Function 00007FF715222DDC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1203COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF715222E2B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71522345E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7152235D4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF715223890
_invalid_parameter_noinfo.LIBCMT ref: 00007FF715223AB0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF715223CEB
memcpy_s.LIBCPMT ref: 00007FF715223DC6
memcpy_s.LIBCPMT ref: 00007FF715223E71
memcpy_s.LIBCPMT ref: 00007FF715223F41

Part of subcall function 00007FF71522401C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71522404E

Strings

1#QNAN, xrefs: 00007FF715222F47
1#INF, xrefs: 00007FF715222F57
1#IND, xrefs: 00007FF715222F1B
1#SNAN, xrefs: 00007FF715222F3E

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 88546c3e9777260c07589008071f33eafcbe12cf6fb5ac57dc0ccaafb8243f92
Instruction ID: b7dd40539843c307bf175e72c53598ce2b70ba0e6753283c06c375b1a09f4292
Opcode Fuzzy Hash: 88546c3e9777260c07589008071f33eafcbe12cf6fb5ac57dc0ccaafb8243f92
Instruction Fuzzy Hash: B9B249B7E186828BE7289F24DC407FDB7A1FB64B54F805135DA0957AA4DF38E508CB50

Function 00007FF7152065C0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(WideCharToMultiByte,00007FF715201CD4,?,?,00000000,00007FF715206853), ref: 00007FF7152065E7
FormatMessageW.KERNEL32 ref: 00007FF715206616
WideCharToMultiByte.KERNEL32 ref: 00007FF71520666C

Part of subcall function 00007FF715201CA0: GetLastError.KERNEL32(?,?,00000000,00007FF715206853,?,?,?,?,?,?,?,?,?,?,?,00007FF715201023), ref: 00007FF715201CC7

Strings

No error messages generated., xrefs: 00007FF715206620
Failed to encode wchar_t as UTF-8., xrefs: 00007FF715206676
FormatMessageW, xrefs: 00007FF715206627
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF715206689
PyInstaller: FormatMessageW failed., xrefs: 00007FF715206633
WideCharToMultiByte, xrefs: 00007FF7152065C0, 00007FF71520667D

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ErrorLast$ByteCharFormatMessageMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2383786077-2573406579
Opcode ID: 1b8d59cd5b5bf335459b2e3d94409fe6cc25077a4b6f638e6fa76439b37b363e
Instruction ID: 73cc2de7d110c7692119c89eba2a847f759defa22296defeb77adc63edf221c2
Opcode Fuzzy Hash: 1b8d59cd5b5bf335459b2e3d94409fe6cc25077a4b6f638e6fa76439b37b363e
Instruction Fuzzy Hash: BA216DB3A0DE4291E628AB55EC50366A3A5FF88BA4FD40135E54D936B4EF3CE50DC720

Function 00007FF715205890 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF71520585D), ref: 00007FF71520592A
GetCurrentProcessId.KERNEL32(?,00007FF71520585D), ref: 00007FF715205930

Part of subcall function 00007FF715205AA0: GetEnvironmentVariableW.KERNEL32(00007FF7152027E7,?,?,?,?,?,?), ref: 00007FF715205ADA
Part of subcall function 00007FF715205AA0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF715205AF7

Part of subcall function 00007FF7152161A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7152161C1

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7152059E1

Strings

TMP, xrefs: 00007FF7152058C8, 00007FF715205989, 00007FF715205A17
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF715205908
TMP, xrefs: 00007FF7152058EE
_MEI%d, xrefs: 00007FF715205938

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 1556224225-1116378104
Opcode ID: ed69d033866e9cd31fee1e2177c8787c46bf75be1e4d62d76d1c8fa4a080ed4b
Instruction ID: 7fdfeb121619e32defddd71225bf480e81e955b2ca59f2be01a17900adb8b955
Opcode Fuzzy Hash: ed69d033866e9cd31fee1e2177c8787c46bf75be1e4d62d76d1c8fa4a080ed4b
Instruction Fuzzy Hash: FA514F93B0AE5250FE5CB6229D952BAD2915F49FE0FD40031EC0E47BB6DF2CE5098720

Function 00007FF715207B48 Relevance: 12.0, Strings: 9, Instructions: 730COMMON

Download Yara Rule

Strings

invalid distances set, xrefs: 00007FF71520801D
invalid literal/lengths set, xrefs: 00007FF715207FB0
invalid distance code, xrefs: 00007FF7152083FA
invalid distance too far back, xrefs: 00007FF7152084AC
invalid code lengths set, xrefs: 00007FF715207CB7
too many length or distance symbols, xrefs: 00007FF715207CD0
invalid code -- missing end-of-block, xrefs: 00007FF715207F29
invalid bit length repeat, xrefs: 00007FF715207F42
invalid literal/length code, xrefs: 00007FF715208248

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 66a29c6a9c930a8d813cc0886cc88004687682dd640166dffdb68fb0cc9f406e
Instruction ID: ab0b30d8851af4f7c8b8462cc487044fe2fb870da9e805008057b7cd0b4eb6d2
Opcode Fuzzy Hash: 66a29c6a9c930a8d813cc0886cc88004687682dd640166dffdb68fb0cc9f406e
Instruction Fuzzy Hash: FE5228B3A19AAA47D798AF14D888A7E77ADFB84710F454139D689837D0DF3CD848CB10

Function 00007FF71520A79C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF71520A7B8
RtlCaptureContext.KERNEL32 ref: 00007FF71520A7E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF71520A7FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF71520A840
IsDebuggerPresent.KERNEL32 ref: 00007FF71520A894
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71520A8B5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF71520A8C0

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 54619639c4e19b591525bcec07e2514be4908dfaa4c6e05eec1230d45fa8032c
Instruction ID: c610c1076afa31cbbe9d955dbe50b8c637f83628d8c11c7bad37a9ff6621777d
Opcode Fuzzy Hash: 54619639c4e19b591525bcec07e2514be4908dfaa4c6e05eec1230d45fa8032c
Instruction Fuzzy Hash: 7D316FB7609E8186EB649F61E8403EDB361FB44B64F84443ADA4D47AA4EFBCC54CC720

Function 00007FF7152249D8 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF715224A1D

Part of subcall function 00007FF715224378: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71522438C

Part of subcall function 00007FF715219EC8: HeapFree.KERNEL32(?,?,?,00007FF715221DDA,?,?,?,00007FF715221E17,?,?,00000000,00007FF7152222E8,?,?,00000000,00007FF71522221B), ref: 00007FF715219EDE
Part of subcall function 00007FF715219EC8: GetLastError.KERNEL32(?,?,?,00007FF715221DDA,?,?,?,00007FF715221E17,?,?,00000000,00007FF7152222E8,?,?,00000000,00007FF71522221B), ref: 00007FF715219EE8

Part of subcall function 00007FF715219E80: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF715219E5E,?,?,?,?,?,00007FF715211476), ref: 00007FF715219E89
Part of subcall function 00007FF715219E80: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF715219E5E,?,?,?,?,?,00007FF715211476), ref: 00007FF715219EAE

_get_daylight.LIBCMT ref: 00007FF715224A0C

Part of subcall function 00007FF7152243D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7152243EC

_get_daylight.LIBCMT ref: 00007FF715224C82
_get_daylight.LIBCMT ref: 00007FF715224C93
_get_daylight.LIBCMT ref: 00007FF715224CA4
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF715224EE4), ref: 00007FF715224CCB

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 05719709eeb8bce8f1e8c0b75a80b94850ea42a6417b7f374a0be3bd65579af4
Instruction ID: bcdb2af8976f873a12613df306d1bbcc80dd449041e24e878930536e6f2b5e91
Opcode Fuzzy Hash: 05719709eeb8bce8f1e8c0b75a80b94850ea42a6417b7f374a0be3bd65579af4
Instruction Fuzzy Hash: 91D1B4BBE08A4246E728FF25DC501B9A6A1FF44FA4FC44136DA0D476A5DF3CE44987A0

Function 00007FF715219B90 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF715219C09
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF715219C21
RtlVirtualUnwind.KERNEL32 ref: 00007FF715219C5C
IsDebuggerPresent.KERNEL32 ref: 00007FF715219C95
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF715219C9F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF715219CAA

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 301eb69301f3734f54b04e04011c3038f0fd6acd3c64170b9e7f47c13de2a280
Instruction ID: c7620c229b87fd41ff2ed46167834de6166ab54b64f9ebf711a091fd7f74ef4c
Opcode Fuzzy Hash: 301eb69301f3734f54b04e04011c3038f0fd6acd3c64170b9e7f47c13de2a280
Instruction Fuzzy Hash: 3C314D77618F8185DB64DB25EC402AEB3A4FB88B64F904136EA9D43BA4DF7CC149CB10

Function 00007FF715220974 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7152209C0
FindFirstFileExW.KERNEL32 ref: 00007FF715220ACA

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: f5c4de298b3eb13d643d0c7cc3d76b332490ae3ea56438630f49c8633663cf3c
Instruction ID: 7eb3ff221b7a48042766badd0410e91e73995392d4ce358eaf549bd1ab15a510
Opcode Fuzzy Hash: f5c4de298b3eb13d643d0c7cc3d76b332490ae3ea56438630f49c8633663cf3c
Instruction Fuzzy Hash: CCB1C9ABB19E9641EA69AB21DD001B9E392EB44FF4FC44132DA4D47AA5DF3CE449C310

Function 00007FF715222950 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7152229BA
memcpy_s.LIBCPMT ref: 00007FF7152229E5

Strings

, xrefs: 00007FF715222B18

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: dbe32003fc979fca20096e7f857c02f8f250bdb8c637356438d5f2f7703990db
Instruction ID: 1c988a0606279d71055c31bb10b17d674947b366c83ef5579a04a580fd9c808c
Opcode Fuzzy Hash: dbe32003fc979fca20096e7f857c02f8f250bdb8c637356438d5f2f7703990db
Instruction Fuzzy Hash: 2AC117B7B18A8687D728DF15E444AAAF791F784B94F848134DB4E43B54DB3DE809CB10

Function 00007FF715224C54 Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF715224C82

Part of subcall function 00007FF7152243D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7152243EC

_get_daylight.LIBCMT ref: 00007FF715224C93

Part of subcall function 00007FF715224378: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71522438C

_get_daylight.LIBCMT ref: 00007FF715224CA4

Part of subcall function 00007FF7152243A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7152243BC

Part of subcall function 00007FF715219EC8: HeapFree.KERNEL32(?,?,?,00007FF715221DDA,?,?,?,00007FF715221E17,?,?,00000000,00007FF7152222E8,?,?,00000000,00007FF71522221B), ref: 00007FF715219EDE
Part of subcall function 00007FF715219EC8: GetLastError.KERNEL32(?,?,?,00007FF715221DDA,?,?,?,00007FF715221E17,?,?,00000000,00007FF7152222E8,?,?,00000000,00007FF71522221B), ref: 00007FF715219EE8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF715224EE4), ref: 00007FF715224CCB

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 28dd224734edfb14863a4a314489bc730e29ffcc86fa699e779e74096d9017b9
Instruction ID: ce65e1879ec2a9cfd6603fa731f53da1aa39d53a430384d0d43838121bf719f8
Opcode Fuzzy Hash: 28dd224734edfb14863a4a314489bc730e29ffcc86fa699e779e74096d9017b9
Instruction Fuzzy Hash: 635167B7A08A4246E718FF25DC815A9A760FF48F64FC44135EA4D436B5DF7CE4488760

Function 00007FF715207314 Relevance: 5.4, Strings: 4, Instructions: 399COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF7152077AE
unknown compression method, xrefs: 00007FF715207348
unknown header flags set, xrefs: 00007FF715207369
, xrefs: 00007FF7152073F9

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown compression method$unknown header flags set
API String ID: 0-4074041902
Opcode ID: cfc0f713a2359d4960dfa851b33a48a66bf808d315256c79df550c7d5088afa5
Instruction ID: d020836a31eadb5197c8238492c8e46aaac7a072076eb79baffc6c1e151b6999
Opcode Fuzzy Hash: cfc0f713a2359d4960dfa851b33a48a66bf808d315256c79df550c7d5088afa5
Instruction Fuzzy Hash: 68F1C9B3619BC547E7A9AF08C888A3ABBA9FF44B54F494538DA4D073A1DB3CD448C750

Function 00007FF7152098F0 Relevance: 4.1, Strings: 3, Instructions: 384COMMON

Download Yara Rule

Strings

invalid distance code, xrefs: 00007FF715209D43
invalid distance too far back, xrefs: 00007FF715209D60
invalid literal/length code, xrefs: 00007FF715209D26

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID: invalid distance code$invalid distance too far back$invalid literal/length code
API String ID: 0-3255898291
Opcode ID: 76358157b968d48b0cdac3bdd6641d9e39c39ac49580ea4f5e9837c3b2f208a1
Instruction ID: 735c3e127e8d11b040e825513303a7ab3f79ac372b9fe82bd53ebc9dafbf7d9d
Opcode Fuzzy Hash: 76358157b968d48b0cdac3bdd6641d9e39c39ac49580ea4f5e9837c3b2f208a1
Instruction Fuzzy Hash: 8DD154B3B099C18BD71D9B28D850279BBE1E795BA0F448139EA9B437D5CB3CD90AC710

Function 00007FF71520717D Relevance: 4.0, Strings: 3, Instructions: 219COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF7152072E2
unknown compression method, xrefs: 00007FF715207267
incorrect header check, xrefs: 00007FF7152072FB

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size$unknown compression method
API String ID: 0-1186847913
Opcode ID: dc6f6637eae4ad8260e70fd7a9f65f9afe53dd101c5fca4c778ccf820c9863bf
Instruction ID: e0b304d9d438d017179d53d7e404c80927eb1ab562288309908485eece9a3621
Opcode Fuzzy Hash: dc6f6637eae4ad8260e70fd7a9f65f9afe53dd101c5fca4c778ccf820c9863bf
Instruction Fuzzy Hash: A991F9B3A19A854BE7A8AF14CC48B3B77ADFF40760F554135DA49467A0CB38E948CB10

Function 00007FF71520783C Relevance: 3.9, Strings: 3, Instructions: 161COMMON

Download Yara Rule

Strings

, xrefs: 00007FF71520785A
, xrefs: 00007FF71520783C
invalid block type, xrefs: 00007FF71520793F

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID: $ $invalid block type
API String ID: 0-2056396358
Opcode ID: a9bab42206015fa5475629a96226a8ecf7e95e173ed42da48c8850fe955239d4
Instruction ID: 21412e2682c5ef67c3e6dca62430de10dbcfc0252da6ccc927835eab209e00dd
Opcode Fuzzy Hash: a9bab42206015fa5475629a96226a8ecf7e95e173ed42da48c8850fe955239d4
Instruction Fuzzy Hash: 6D61E9F3D05B9A87E764AF15DC8C63A7AADFB40760F954135C648823A0DF78E549CB10

Function 00007FF715228718 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF715228967
RaiseException.KERNEL32 ref: 00007FF715228978

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 927f2303c65032b379294b09c50f1c16bdf3dde702c5ba013418468f2142f5bc
Instruction ID: 193cf016705d1af7d6d6ac8facc19410819ed5e798abcca9a5c32b09c4130583
Opcode Fuzzy Hash: 927f2303c65032b379294b09c50f1c16bdf3dde702c5ba013418468f2142f5bc
Instruction Fuzzy Hash: E5B16EBBA00B888BEB19CF29C88236877A0F744F58F548921EB5D87BB4CB79D455C711

Function 00007FF715206920 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF71520694F
FindClose.KERNEL32 ref: 00007FF71520695E

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c4226705429021310e2405b2fcfa2fd33e843441c3bca499de0f338ae03d5563
Instruction ID: 3494b93b7466389976f29fd2d8bfdccddd745aa5bac98a830f505783ba26a488
Opcode Fuzzy Hash: c4226705429021310e2405b2fcfa2fd33e843441c3bca499de0f338ae03d5563
Instruction Fuzzy Hash: 66018867A1998181F7A4AB10E8553AAB391FB85B34FC11335D56D46AE4DF7CE40C8B10

Function 00007FF71521D198 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF71521D2A5
gfff, xrefs: 00007FF71521D322

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: d265a0edf78bf113034b8edf7e65410607a41c186a8833035051b41bdfa47671
Instruction ID: 67a8eed2322d6940cc0cab0faed912766aa632af7c30bfce62107af151385b93
Opcode Fuzzy Hash: d265a0edf78bf113034b8edf7e65410607a41c186a8833035051b41bdfa47671
Instruction Fuzzy Hash: 875160A3B18AC586E728AE359C4076AF791F744FA4F888231CB684BAD5CF7DD448C710

Function 00007FF71521F9D8 Relevance: 2.0, APIs: 1, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 62391075a08f777cca59d4d240808eb9bd4591fb822f05c971a2e8337e003bc5
Instruction ID: d09c8f2e4907b7d75179c0db061e9186296a22f66b26626c53b97f7cbfadf556
Opcode Fuzzy Hash: 62391075a08f777cca59d4d240808eb9bd4591fb822f05c971a2e8337e003bc5
Instruction Fuzzy Hash: 2902ABA3B09E4640FA6DBB219D9167AA280AF15FB0FD44635DD7D466F2DF3CA4098330

Function 00007FF7152253D0 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF715225433

Part of subcall function 00007FF71521518C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7152151A0

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 2cdae2c4bae686e0b2ab8e1597d0ef303a8a530a40c1dc1bec2af7fa7c99efef
Instruction ID: 89d7c602179f1213e9bd1b78a952ba52183b9455ccadfc9f9d452a82badcbb1b
Opcode Fuzzy Hash: 2cdae2c4bae686e0b2ab8e1597d0ef303a8a530a40c1dc1bec2af7fa7c99efef
Instruction Fuzzy Hash: BE61E9A7F1895245FB68A9188C40739E591AF40F70FD5C239DA1F8B6F1EF6DE8488720

Function 00007FF71521CCE8 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF71521D047

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: f0babd2a4116c292f609ecd59ca72ddd1d97966ff2f5f7d81977c7f268a0cbd2
Instruction ID: dda2a1a962a008a21f20498775ea167a1f6208c19833c7e76905267f9a87bf9c
Opcode Fuzzy Hash: f0babd2a4116c292f609ecd59ca72ddd1d97966ff2f5f7d81977c7f268a0cbd2
Instruction Fuzzy Hash: 4AA159A3B08BC586EB29DB25DC8076AB791AB50BD4F848132DE4D477A5DB3DE409C311

Function 00007FF71521705C Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF71521707B

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 9c7c30ff1bd3034210a31de3d8723e6c27ff280c2fa648633df4a30bb0249d96
Instruction ID: 2e26a88aabe866d07b83b92147ff907d16ee25750ba80bbf600dec24733302dc
Opcode Fuzzy Hash: 9c7c30ff1bd3034210a31de3d8723e6c27ff280c2fa648633df4a30bb0249d96
Instruction Fuzzy Hash: 61519093B08A4641FA6CBA265D8117BD2926F85FA4FDC4535DD0E477B6EF3CE40A8220

Function 00007FF715222540 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF715222544

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2a5b2a835b90c1c75182aa9a41e7504d1bbb522c305e3250e911f83f474f91d7
Instruction ID: b25b7f0612810f62c3fc1cd713296ce0dc0d279b6e8c27dcd9e74f7249497cff
Opcode Fuzzy Hash: 2a5b2a835b90c1c75182aa9a41e7504d1bbb522c305e3250e911f83f474f91d7
Instruction Fuzzy Hash: 12B09265F07F46C2EA0C7B55AC8261463A47F4CF20FC80038C00C52730DFAC24A95720

Function 00007FF7152123F4 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79aeb74dcd41203d883abb8f602e37265719b91fdc4bb7065a078c7c0318d7e6
Instruction ID: ef961a12bf7805fecf96dbf9b15f0aa61ff8a94a4e66d6008fa6894bf1b09a28
Opcode Fuzzy Hash: 79aeb74dcd41203d883abb8f602e37265719b91fdc4bb7065a078c7c0318d7e6
Instruction Fuzzy Hash: D2D1B3E3908A4682EB6CAF168CD057BB7A1FB05F64F945135EE4D032E4DF29D85AC360

Function 00007FF715212028 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85b87da5def6e9f4aa1042f1c42724fe328baef1587be38b9c4391f28844ca4
Instruction ID: 822ca4c6b699f9724bc492e28e60894285d8801d2c6f6e66b44552ec338b8ea0
Opcode Fuzzy Hash: e85b87da5def6e9f4aa1042f1c42724fe328baef1587be38b9c4391f28844ca4
Instruction Fuzzy Hash: A5D1DAE3908A4685EB2CEB268C8067FA761EB06F68F940135EE4D176F5DF39D449C360

Function 00007FF7152110F8 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6805a75c0a02df8d9b4224ca4059a18b17722ca7cf91ca6ed0098cc30caf1eb
Instruction ID: 6a5e23d2b431ad00beb6d1c42157b0c3c53387d3a98c27dfaffdae3567f436fe
Opcode Fuzzy Hash: a6805a75c0a02df8d9b4224ca4059a18b17722ca7cf91ca6ed0098cc30caf1eb
Instruction Fuzzy Hash: ECB19FB3A08B9585E76D9F2A8C9013EBBA0E706F68FB40135CA4D477A9CF39D445C724

Function 00007FF71521D818 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757df43eff3413411748c25245d8275d8800926c10e05f909bcc79928a9f3bea
Instruction ID: 9e1cde5ad5ac053eb47a429ba1bd0d1a65253631136c16224e3003af564fb8b2
Opcode Fuzzy Hash: 757df43eff3413411748c25245d8275d8800926c10e05f909bcc79928a9f3bea
Instruction Fuzzy Hash: D681CBB3A0CB8185E778EB159CC037BAA91FB45BA4F944235DA9E47BA5CF3DD4048B10

Function 00007FF715208FF0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f9c5395b3148a3a418ac3d9f385a2b2dd1f6988032a93fe45e84df5a34dcd6
Instruction ID: 8eecb2a990f46d1e08e4779760954b4381a064ca4eb5f81d366517f6d12372e7
Opcode Fuzzy Hash: 51f9c5395b3148a3a418ac3d9f385a2b2dd1f6988032a93fe45e84df5a34dcd6
Instruction Fuzzy Hash: 0971ADB37301749BEB688B2E9514AB93390F36A749FC16115EB8547B81CF3EB921CB50

Function 00007FF71520FDD0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91676e2c6819f2125a1fdcdf1d499c76ba6867f36b41da1b0312bc2d09b032fe
Instruction ID: efa780f62b9f0c7ee88958e0263cab00ff2a609dfe6f84ee17691ab76875c09d
Opcode Fuzzy Hash: 91676e2c6819f2125a1fdcdf1d499c76ba6867f36b41da1b0312bc2d09b032fe
Instruction Fuzzy Hash: EF51B4B3A49A5182E32C9F24C95863CA760EB55F78F941134DF1A177F9CB28EC46C390

Function 00007FF715214970 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ef73793ea1788ae08d57b95515db7d43b127d7364744ae73512ded182e4f5a
Instruction ID: 9d0239f4ba41caa8a92c79dce2b0a9d618cff9874a12783f0a5e625a76479c07
Opcode Fuzzy Hash: d6ef73793ea1788ae08d57b95515db7d43b127d7364744ae73512ded182e4f5a
Instruction Fuzzy Hash: B941B4D3C09E8A04E95D99180DA07B69680AF12FB8DA952B4CD9D137E2DF0E358EC364

Function 00007FF7152101A4 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35544f0de4291087a22586488ce75b6eb3c39d1b62f2cbc732685b95b505f20
Instruction ID: cc926700a2d0a4d1a38608b5c7a4c2886b02c6e00bc09ad53d82271f635539d1
Opcode Fuzzy Hash: d35544f0de4291087a22586488ce75b6eb3c39d1b62f2cbc732685b95b505f20
Instruction Fuzzy Hash: DA518FB3B08A1183E76CAE248C9423EA7A0EB55F78F540135DA491B7A8CF2DEC45C750

Function 00007FF71520F9FC Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd13913463f2a535fc0c8be1876713af60b9a5b5c2f997033bced444a0d0364e
Instruction ID: 3bb4db20d3aa9f53aa9ed72e3d875edc62be16b0b71e650ff0afbf187430ec5e
Opcode Fuzzy Hash: cd13913463f2a535fc0c8be1876713af60b9a5b5c2f997033bced444a0d0364e
Instruction Fuzzy Hash: 2551A1B3A59A6182E72CAE28C854A3CB7A0EB54F78F544135CE5D177E8CF28EC45C790

Function 00007FF71520FFBC Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd8ebc248ced660718111c5b2368b9a6156698bebe51c5a3ea58e993a1de5436
Instruction ID: 9c14a292b3406c34398664b61acfaef475784d3cfba12ad94b2749dc4b8559b7
Opcode Fuzzy Hash: fd8ebc248ced660718111c5b2368b9a6156698bebe51c5a3ea58e993a1de5436
Instruction Fuzzy Hash: 0F5190B3B08A5183E72C9E288C9423EA7A0EB55F68F940135CA4D177A8DB3DEC45C790

Function 00007FF71520F814 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa0e8279f47b3a442918b0d2efffb71c4d8b95321069e11353736f5b085a131
Instruction ID: b13f2138591890db9e0dbffec8d9e362c87222d32d0bba9759404b749f8d512b
Opcode Fuzzy Hash: eaa0e8279f47b3a442918b0d2efffb71c4d8b95321069e11353736f5b085a131
Instruction Fuzzy Hash: FF51E2B3A49A1182E72CAF29C99477CA7A0EB50F68F550135CF5D173A8DF28EC85C790

Function 00007FF71520FBE8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d206cf78a1e1fdd7179b185d329a52e3742a16a0b21815c9c7ebae968ae7add
Instruction ID: 1bf945dce00eb889ab0dac9841c07f0be46c01e0ec951046910a7efcd646e77e
Opcode Fuzzy Hash: 0d206cf78a1e1fdd7179b185d329a52e3742a16a0b21815c9c7ebae968ae7add
Instruction Fuzzy Hash: D451D3B3A59A0182E72CAF24C84573CA7A0EB55F78F940135CE1D177A8CB28EC86C790

Function 00007FF715218C60 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: e35ea190b458751bdcea846265f53a439cee16ecec82aef6602eccaaa71a0652
Instruction ID: 7377baeae78b64abbd6caf175daaf6be375c635b8262768d96239cb22d36de2e
Opcode Fuzzy Hash: e35ea190b458751bdcea846265f53a439cee16ecec82aef6602eccaaa71a0652
Instruction Fuzzy Hash: B041D663714E5482EF48DF2ADD941A9B391BB48FE4B899136DE4D97B64DF3CD04A8300

Function 00007FF715216054 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ce6953021ea5498c95affb9162b79822c7e59d3f1215ec751abce20f6463ca
Instruction ID: c8c50afac0ca9b344db5a514cbbbc9caaa43f7ad4b0c91cb5b9dcae50307866d
Opcode Fuzzy Hash: b2ce6953021ea5498c95affb9162b79822c7e59d3f1215ec751abce20f6463ca
Instruction Fuzzy Hash: AF31A373B18F4281EA28AF256C8013FA695AB84FA0F544238EA5D53BE6DF3CE1158714

Function 00007FF715228560 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7591aee40615b900559739c7508c649997bd7b38f439b587c3fca6a269e69796
Instruction ID: 1214ea47aa142cac3a20e7a9881123ded8447a2240864e1e06597c6bd6783a71
Opcode Fuzzy Hash: 7591aee40615b900559739c7508c649997bd7b38f439b587c3fca6a269e69796
Instruction Fuzzy Hash: 99F044B36186558ADB9C9F6DF8026297BD0F708790F808039E68983A14D73C90648F14

Function 00007FF71520A944 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e64e7364472d09bdf8af0a1a870edad0a13a036e59e5f52640ce81408c81c52c
Instruction ID: 6fbc5a504eec988fb364da051ce369df738c36bc774abeb7d126d0c31a1e30d4
Opcode Fuzzy Hash: e64e7364472d09bdf8af0a1a870edad0a13a036e59e5f52640ce81408c81c52c
Instruction Fuzzy Hash: 02A002A7A0EC4AD0EA4CAB05ECD1034A330FF50B30BC18131D00D514B09FFCA458C360

Function 00007FF7152046F0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF715206260: LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7152022BE,?,?,?,?), ref: 00007FF715206283

GetProcAddress.KERNEL32 ref: 00007FF715205097
GetProcAddress.KERNEL32 ref: 00007FF7152050D6
GetProcAddress.KERNEL32 ref: 00007FF7152050FB
GetProcAddress.KERNEL32 ref: 00007FF715205120
GetProcAddress.KERNEL32 ref: 00007FF715205148
GetProcAddress.KERNEL32 ref: 00007FF715205170
GetProcAddress.KERNEL32 ref: 00007FF715205198
GetProcAddress.KERNEL32 ref: 00007FF7152051C0
GetProcAddress.KERNEL32 ref: 00007FF7152051E8

Strings

Tcl_Alloc, xrefs: 00007FF7152054D6
Tcl_ConditionFinalize, xrefs: 00007FF715205256
Tcl_GetCurrentThread, xrefs: 00007FF7152051DE
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF7152054CA
GetProcAddress, xrefs: 00007FF7152050B0
Tcl_GetVar2, xrefs: 00007FF71520531E
Tcl_SetVar2Ex, xrefs: 00007FF71520540E
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF715205182
Tcl_CreateThread, xrefs: 00007FF7152051B6
Tcl_GetString, xrefs: 00007FF715205396
Tcl_MutexUnlock, xrefs: 00007FF71520522E
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF7152051AA
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF71520473A
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF7152050E8
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF71520542A
Failed to get address for Tcl_Finalize, xrefs: 00007FF71520515A
Tcl_GetObjResult, xrefs: 00007FF715205436
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF71520510D
Tcl_Free, xrefs: 00007FF7152054FE
Failed to get address for Tcl_MutexLock, xrefs: 00007FF715205222
Failed to get address for Tcl_GetString, xrefs: 00007FF7152053B2
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF71520529A
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF715205402
Tcl_Init, xrefs: 00007FF715205090
Failed to get address for Tcl_Alloc, xrefs: 00007FF7152054F2
Failed to get address for Tcl_Init, xrefs: 00007FF7152050A9
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7152053DA
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF7152052C2
Tcl_NewByteArrayObj, xrefs: 00007FF7152053E6
Failed to get address for Tcl_EvalFile, xrefs: 00007FF71520547A
Tcl_EvalEx, xrefs: 00007FF715205486
Failed to get address for Tcl_Free, xrefs: 00007FF71520551A
Tcl_Finalize, xrefs: 00007FF71520513E
Tcl_SetVar2, xrefs: 00007FF715205346
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF715205132
Tcl_FinalizeThread, xrefs: 00007FF715205166
Failed to get address for Tcl_EvalEx, xrefs: 00007FF7152054A2
Failed to get address for Tcl_SetVar2, xrefs: 00007FF715205362
Tcl_MutexLock, xrefs: 00007FF715205206
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF715205312
Tcl_CreateObjCommand, xrefs: 00007FF71520536E
Tcl_DoOneEvent, xrefs: 00007FF715205116
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF715205272
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7152052EA
Tcl_NewStringObj, xrefs: 00007FF7152053BE
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7152051FA
Tcl_ConditionNotify, xrefs: 00007FF71520527E
Tcl_ConditionWait, xrefs: 00007FF7152052A6
Tcl_ThreadQueueEvent, xrefs: 00007FF7152052CE
Tcl_EvalObjv, xrefs: 00007FF7152054AE
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF715205452
Tk_GetNumMainWindows, xrefs: 00007FF71520554E
Tcl_EvalFile, xrefs: 00007FF71520545E
Tcl_CreateInterp, xrefs: 00007FF7152050CC
Failed to get address for Tcl_GetVar2, xrefs: 00007FF71520533A
Tcl_DeleteInterp, xrefs: 00007FF71520518E
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF71520556A
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7152051D2
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF71520538A
Tcl_ThreadAlert, xrefs: 00007FF7152052F6
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF71520524A
Failed to get address for Tk_Init, xrefs: 00007FF715205542
Tcl_FindExecutable, xrefs: 00007FF7152050F1
Tk_Init, xrefs: 00007FF715205526

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: 90bcec71e667a96801b07e8c92031bd4810347336fdf9f7575a7f48e75f8c625
Instruction ID: 3d4fbcd61e661ecc352bdbdc0b887e2646b4da313b68e7af79c427d5a05fd3a3
Opcode Fuzzy Hash: 90bcec71e667a96801b07e8c92031bd4810347336fdf9f7575a7f48e75f8c625
Instruction Fuzzy Hash: 28E1A7EBA0AF0390FA5DAB44FC94275A3A5AF08F60FD45035D80E16674EFBCA54C9361

Function 00007FF715206B40 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 113COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF715206B7C

Part of subcall function 00007FF715201CA0: GetLastError.KERNEL32(?,?,00000000,00007FF715206853,?,?,?,?,?,?,?,?,?,?,?,00007FF715201023), ref: 00007FF715201CC7

Strings

Out of memory., xrefs: 00007FF715206BC0, 00007FF715206C62
win32_wcs_to_mbs, xrefs: 00007FF715206C5B
Failed to get ANSI buffer size., xrefs: 00007FF715206C3D
Failed to decode wchar_t from UTF-8, xrefs: 00007FF715206BF6
win32_utils_from_utf8, xrefs: 00007FF715206BB9
Failed to get wchar_t buffer size., xrefs: 00007FF715206B89
MultiByteToWideChar, xrefs: 00007FF715206B90, 00007FF715206BFD
WideCharToMultiByte, xrefs: 00007FF715206C9C
Failed to encode filename as ANSI., xrefs: 00007FF715206C95

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$WideCharToMultiByte$win32_utils_from_utf8$win32_wcs_to_mbs
API String ID: 203985260-1562484376
Opcode ID: a5ed55af1c6e677fe154f2cf6df17f5e4f0e08ee002acad090a135831242e49e
Instruction ID: 8854690029a8f50a5c63490a413b06f4bdb69e74341b2720454adc41ec099a8b
Opcode Fuzzy Hash: a5ed55af1c6e677fe154f2cf6df17f5e4f0e08ee002acad090a135831242e49e
Instruction Fuzzy Hash: 464174B3A0DE4251E628BB11AC4017AA692FF84FF4FE44535D94D57AB5DF3CE5098320

Function 00007FF715201440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF715201559
fread, xrefs: 00007FF7152015EC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7152014CA
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7152015D5
malloc, xrefs: 00007FF715201560
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7152015E5
Failed to extract %s: failed to open target file!, xrefs: 00007FF71520148A
fwrite, xrefs: 00007FF7152015DC
fopen, xrefs: 00007FF715201491
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7152014F9
fseek, xrefs: 00007FF715201500

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: b4523c211dac84283705a3c98717d9ab97cd2e8500c41bdaaea837af148db2f8
Instruction ID: b185ecbd4951b47cd97c410e64f5a74855dca90baabd2ef3df16946c2042565b
Opcode Fuzzy Hash: b4523c211dac84283705a3c98717d9ab97cd2e8500c41bdaaea837af148db2f8
Instruction Fuzzy Hash: 96517CA3A0AE4241EA18BB11DC406B9A351AF45FF4FD44131DE1D47AB5EFACE54D8320

Function 00007FF7152069B0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF71520596A,?,00007FF71520585D), ref: 00007FF7152069F0
OpenProcessToken.ADVAPI32(?,00007FF71520585D), ref: 00007FF715206A01
GetTokenInformation.ADVAPI32(?,00007FF71520585D(TokenIntegrityLevel)), ref: 00007FF715206A23
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF715206A2D
GetTokenInformation.ADVAPI32(?,TokenIntegrityLevel), ref: 00007FF715206A6A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF715206A7C
CloseHandle.KERNEL32(?,00007FF71520585D), ref: 00007FF715206A94
LocalFree.KERNEL32(?,00007FF71520585D), ref: 00007FF715206AC6
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF715206AED
CreateDirectoryW.KERNEL32(?,00007FF71520585D), ref: 00007FF715206AFE

Strings

D:(A;;FA;;;%s), xrefs: 00007FF715206AA9
S-1-3-4, xrefs: 00007FF715206A9F

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: bef6b7e1ae39f53b6f69793a258f0788f4ad7388b7c7719ded7cbd05991c14be
Instruction ID: 2a90a6f6480a803864a202a59bb60b96bb2efc1683881e2ba36dd78815a86c82
Opcode Fuzzy Hash: bef6b7e1ae39f53b6f69793a258f0788f4ad7388b7c7719ded7cbd05991c14be
Instruction Fuzzy Hash: DF416473609A4282E764AF11E8407AAB361FB84B74F940231EA5E47AA5DF7CE54CC750

Function 00007FF71520CADC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF71520CB38

Part of subcall function 00007FF71520DA30: _GetEstablisherFrame.LIBVCRUNTIME ref: 00007FF71520DA65
Part of subcall function 00007FF71520DA30: __GetUnwindTryBlock.LIBCMT ref: 00007FF71520DA73
Part of subcall function 00007FF71520DA30: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF71520DA98

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF71520CC10
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF71520CE56
_GetEstablisherFrame.LIBVCRUNTIME ref: 00007FF71520CEA8
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71520CF62

Strings

csm, xrefs: 00007FF71520CBB9
csm, xrefs: 00007FF71520CC33
csm, xrefs: 00007FF71520CB52

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: Frame$BlockEstablisherHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3606184308-393685449
Opcode ID: e293e87a919c72b577dbd3c5999e3d98b00d41f3e638475b7b9119a8300110a0
Instruction ID: 8710f4cafd1b34243afa54fcc26664775b8d6c5cdca3ff912ba2285c2fde1fe2
Opcode Fuzzy Hash: e293e87a919c72b577dbd3c5999e3d98b00d41f3e638475b7b9119a8300110a0
Instruction Fuzzy Hash: 3CD1B7F3909B4186EB28AF65D8442ADF7A0FB45BA8F400135DE4D677A9CF38E088C751

Function 00007FF7152012B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

Strings

fread, xrefs: 00007FF7152013E9
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7152012E2
malloc, xrefs: 00007FF715201353
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF71520134C
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7152013E2
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF715201312
fseek, xrefs: 00007FF715201319

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 0-3659356012
Opcode ID: 95ce5ddeb1016ec66aab2b9a2c26b0d62a05a270a5920c0c331f0d320ca516a8
Instruction ID: 5aadd10886a9d39e8b371d4e5eaccbb0f4d580c799838273b129e7c199168527
Opcode Fuzzy Hash: 95ce5ddeb1016ec66aab2b9a2c26b0d62a05a270a5920c0c331f0d320ca516a8
Instruction Fuzzy Hash: 344162A3A09E4281EA1CEB15AC402AAE3A1EB44FE0FD44431DE4D47A65EF7CE5498310

Function 00007FF715219324 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715219368
_invalid_parameter_noinfo.LIBCMT ref: 00007FF715219740
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7152199EB

Strings

0, xrefs: 00007FF715219790
p, xrefs: 00007FF715219492
f, xrefs: 00007FF71521948A
p, xrefs: 00007FF71521941A

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: be5fa115a8b52a4824b37adbae4d10183e050eaabf8b896c07a19f058a599ef8
Instruction ID: 691189f0d4f8465fe1ed8ebb6644189ce8ecaa74a3dd62274bdfc5927431fb0b
Opcode Fuzzy Hash: be5fa115a8b52a4824b37adbae4d10183e050eaabf8b896c07a19f058a599ef8
Instruction Fuzzy Hash: 5E12C3A3F0898386FB287A15DCD427BB691EB40F64FC44032D69A476E4DF3DE5488B21

Function 00007FF715201050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON

Download Yara Rule

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF715201249
malloc, xrefs: 00007FF7152010F8, 00007FF715201126
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7152010B4
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF71520111F
1.2.11, xrefs: 00007FF71520107E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7152010F1

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID:
String ID: 1.2.11$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 0-1060636955
Opcode ID: 5898803286fb91328c27e444052bc4c6bf0b4f2544b3745be21024ddf00b3f18
Instruction ID: 81ba6d5c8f1248a4bf8633831c8d0870ff203eb057af17f3445057b1c6568c43
Opcode Fuzzy Hash: 5898803286fb91328c27e444052bc4c6bf0b4f2544b3745be21024ddf00b3f18
Instruction Fuzzy Hash: 8A51C4A3A0AE8285EA28BB119C403BAE391BB44FA4FD44135DD4D877A5EF7CE549C310

Function 00007FF715206710 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF715201023), ref: 00007FF7152067AF
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF715201023), ref: 00007FF7152067FF

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF715206827
Out of memory., xrefs: 00007FF715206830
win32_utils_to_utf8, xrefs: 00007FF715206837
Failed to get UTF-8 buffer size., xrefs: 00007FF715206840
WideCharToMultiByte, xrefs: 00007FF715206847

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: afc2dd2afb64664a3267dcee753a2a3a0610f2f78acc60b511ca11a4e71830e3
Instruction ID: 1f62598f57202aae57643a3366c1f0bb8260c9c56911d22c099d6fe0ba28ad0c
Opcode Fuzzy Hash: afc2dd2afb64664a3267dcee753a2a3a0610f2f78acc60b511ca11a4e71830e3
Instruction Fuzzy Hash: 91417E73A09F8282E624EF55AC4017AF7A5FB84BA0FA44135DA8D47BA4DF3CE459C710

Function 00007FF715206080 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF715206D00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF715206D3A

Part of subcall function 00007FF715216E58: SetConsoleCtrlHandler.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF7152192E4), ref: 00007FF715216EC5

Part of subcall function 00007FF715216E58: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF7152192E4), ref: 00007FF715216ED8

GetStartupInfoW.KERNEL32 ref: 00007FF715206107

Part of subcall function 00007FF715219244: _invalid_parameter_noinfo.LIBCMT ref: 00007FF715219258

Part of subcall function 00007FF7152169EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF715216A53

GetCommandLineW.KERNEL32 ref: 00007FF71520618F
CreateProcessW.KERNEL32 ref: 00007FF7152061D1
WaitForSingleObject.KERNEL32 ref: 00007FF7152061E5
GetExitCodeProcess.KERNEL32 ref: 00007FF7152061F5

Strings

Error creating child process!, xrefs: 00007FF715206201
CreateProcessW, xrefs: 00007FF715206208

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlErrorExitHandlerInfoLastLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 1742298069-3524285272
Opcode ID: 7d0fac17dad77a02351690ddb8e338c742b3cdcb7b369dffca0a917d32ab735f
Instruction ID: d3403b3354ef3634c40d24a686c09e4b7ef584d1a00b6da52774e4a2e9d00e45
Opcode Fuzzy Hash: 7d0fac17dad77a02351690ddb8e338c742b3cdcb7b369dffca0a917d32ab735f
Instruction Fuzzy Hash: 6C414873A08A8186D724EB64EC952AFF360FB95B60F904135D68D07AA5DF7CE15CCB10

Function 00007FF715206E10 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00007FF715202D05,?,?,?,?,?,?), ref: 00007FF715206E51

Part of subcall function 00007FF715201CA0: GetLastError.KERNEL32(?,?,00000000,00007FF715206853,?,?,?,?,?,?,?,?,?,?,?,00007FF715201023), ref: 00007FF715201CC7

WideCharToMultiByte.KERNEL32(00000000,00007FF715202D05,?,?,?,?,?,?), ref: 00007FF715206EC5

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF715206ECF
Out of memory., xrefs: 00007FF715206E8B
win32_utils_to_utf8, xrefs: 00007FF715206E92
Failed to get UTF-8 buffer size., xrefs: 00007FF715206E5E
WideCharToMultiByte, xrefs: 00007FF715206E65, 00007FF715206ED6

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 1717984340-27947307
Opcode ID: 25a2b4d0b75b9139cfa9768a4c0383f4afcc382229157aa7b187247db13e667f
Instruction ID: e473cff638580eb94202245dc56d2088ff68772dd3aa7af62af3dcf0f4bffa46
Opcode Fuzzy Hash: 25a2b4d0b75b9139cfa9768a4c0383f4afcc382229157aa7b187247db13e667f
Instruction Fuzzy Hash: 28218FA6A09F0295EB18EF96EC41169B7A1AB84FE0BE44135DA4D437A5EF3CF509C310

Function 00007FF71520F0BC Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71520F0FC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71520F4A8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71520F753

Strings

p, xrefs: 00007FF71520F182
p, xrefs: 00007FF71520F1FA
f, xrefs: 00007FF71520F1F2

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 5260fc6e70538eab79462ef4c698ef4c5cb929645a3d65cb86eb2fac62676952
Instruction ID: 9e5ae27fea0da95bef51d4cbb8fbd6b36883c8f2b841b00b10cfc1ef876c1305
Opcode Fuzzy Hash: 5260fc6e70538eab79462ef4c698ef4c5cb929645a3d65cb86eb2fac62676952
Instruction Fuzzy Hash: 9812D6A3E4E94386FB687E14E844A7AF651EB40F74FC44035D6E9466E4DF3CE4488B60

Function 00007FF715206F00 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF715206F95
MultiByteToWideChar.KERNEL32 ref: 00007FF715206FD7

Strings

Out of memory., xrefs: 00007FF715207005
Failed to decode wchar_t from UTF-8, xrefs: 00007FF715206FFC
win32_utils_from_utf8, xrefs: 00007FF71520700C
Failed to get wchar_t buffer size., xrefs: 00007FF715207015
MultiByteToWideChar, xrefs: 00007FF71520701C

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: eddc79caa78543f1771b3e8c455aa905f049565d913bb1e43e358d4f8aa5132d
Instruction ID: 0af5f930f8faaf1d7f3902fbe7368da505cb816bdc4ee01b952695b9c549048f
Opcode Fuzzy Hash: eddc79caa78543f1771b3e8c455aa905f049565d913bb1e43e358d4f8aa5132d
Instruction Fuzzy Hash: C2419473A09E4282E614EF15AC4017BA6A6FB44FA0FA40135DE8D47BB4DF3CD419C710

Function 00007FF715205590 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF715206D00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF715206D3A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7152058DF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF7152055EF

Strings

LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF715205603
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF71520564A
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7152055C6

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 2001182103-3498232454
Opcode ID: de250e4eb811c83aaabcbc9518ee9c2d417fa195ef671e140211cc389dbbb758
Instruction ID: 49c52e3bb4005dbfb443465adf44a9177d3254a324b69a213ebd4e20c3022375
Opcode Fuzzy Hash: de250e4eb811c83aaabcbc9518ee9c2d417fa195ef671e140211cc389dbbb758
Instruction Fuzzy Hash: 27315A97B1AE4241FA6CBB11DD553BAD251AF98FE0FC40431DA4E427A6EF6CE10C8720

Function 00007FF71520BDA4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF71520C056,?,?,?,00007FF71520BD50,?,?,?,?,00007FF71520B975), ref: 00007FF71520BE29
GetLastError.KERNEL32(?,?,?,00007FF71520C056,?,?,?,00007FF71520BD50,?,?,?,?,00007FF71520B975), ref: 00007FF71520BE37
LoadLibraryExW.KERNEL32(?,?,?,00007FF71520C056,?,?,?,00007FF71520BD50,?,?,?,?,00007FF71520B975), ref: 00007FF71520BE61
FreeLibrary.KERNEL32(?,?,?,00007FF71520C056,?,?,?,00007FF71520BD50,?,?,?,?,00007FF71520B975), ref: 00007FF71520BEA7
GetProcAddress.KERNEL32(?,?,?,00007FF71520C056,?,?,?,00007FF71520BD50,?,?,?,?,00007FF71520B975), ref: 00007FF71520BEB3

Strings

api-ms-, xrefs: 00007FF71520BE49

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7b4ce622ac2bf00ccd49ce3f979f48c000ff92067871b628f576bc45d5db7497
Instruction ID: ce3197800198c3643bf12acf10135f0cf7e2986becf906c7767dd91d52c1a77f
Opcode Fuzzy Hash: 7b4ce622ac2bf00ccd49ce3f979f48c000ff92067871b628f576bc45d5db7497
Instruction Fuzzy Hash: CD3185A3A1BE4191EE29AF129C00679A394FF48FB0FD94535DE1D467A0EF7CE4498324

Function 00007FF715206D00 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF715206D3A

Part of subcall function 00007FF715201CA0: GetLastError.KERNEL32(?,?,00000000,00007FF715206853,?,?,?,?,?,?,?,?,?,?,?,00007FF715201023), ref: 00007FF715201CC7

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF715206DC0

Strings

Out of memory., xrefs: 00007FF715206D82
Failed to decode wchar_t from UTF-8, xrefs: 00007FF715206DCA
win32_utils_from_utf8, xrefs: 00007FF715206D89
Failed to get wchar_t buffer size., xrefs: 00007FF715206D47
MultiByteToWideChar, xrefs: 00007FF715206D4E, 00007FF715206DD1

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 1717984340-876015163
Opcode ID: a3c41d32fee06f0bc4f7d3f8d4da313dc285a05c580e1254b017ed9c43e64460
Instruction ID: d9b99946e978942e5fb8e423a8fc60f27ae5b82ef1c74b19c1430acfbb9b5552
Opcode Fuzzy Hash: a3c41d32fee06f0bc4f7d3f8d4da313dc285a05c580e1254b017ed9c43e64460
Instruction Fuzzy Hash: 4C2195A7B09E4241EB58EB15FC40066E761EF84BE4BD84131DB4C93B79EF2CE5598710

Function 00007FF71521A6C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7152223D7,?,?,?,00007FF71521CC70,?,?,00000000,00007FF71521321F,?,?,?,00007FF7152193D4), ref: 00007FF71521A6CF
FlsGetValue.KERNEL32(?,?,?,00007FF7152223D7,?,?,?,00007FF71521CC70,?,?,00000000,00007FF71521321F,?,?,?,00007FF7152193D4), ref: 00007FF71521A6E4
FlsSetValue.KERNEL32(?,?,?,00007FF7152223D7,?,?,?,00007FF71521CC70,?,?,00000000,00007FF71521321F,?,?,?,00007FF7152193D4), ref: 00007FF71521A705
FlsSetValue.KERNEL32(?,?,?,00007FF7152223D7,?,?,?,00007FF71521CC70,?,?,00000000,00007FF71521321F,?,?,?,00007FF7152193D4), ref: 00007FF71521A732
FlsSetValue.KERNEL32(?,?,?,00007FF7152223D7,?,?,?,00007FF71521CC70,?,?,00000000,00007FF71521321F,?,?,?,00007FF7152193D4), ref: 00007FF71521A743
FlsSetValue.KERNEL32(?,?,?,00007FF7152223D7,?,?,?,00007FF71521CC70,?,?,00000000,00007FF71521321F,?,?,?,00007FF7152193D4), ref: 00007FF71521A754
SetLastError.KERNEL32(?,?,?,00007FF7152223D7,?,?,?,00007FF71521CC70,?,?,00000000,00007FF71521321F,?,?,?,00007FF7152193D4), ref: 00007FF71521A76F

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 18b7faeee27d6baa02fe511a9168d04a385ef3bb053123a9e3f810302c557934
Instruction ID: b109b64ca43634906d5ebd9aa494a6e33fb6048dc10ecce72221bdd0b5c0e7e5
Opcode Fuzzy Hash: 18b7faeee27d6baa02fe511a9168d04a385ef3bb053123a9e3f810302c557934
Instruction Fuzzy Hash: AB2171A6B08E4242F55C77219E9513FE2925F48FB0FC04634D93E076F6DF6CB44A46A0

Function 00007FF715226C0C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF715226C3D
GetLastError.KERNEL32 ref: 00007FF715226C49
CloseHandle.KERNEL32 ref: 00007FF715226C61
CreateFileW.KERNEL32 ref: 00007FF715226C8C
WriteConsoleW.KERNEL32 ref: 00007FF715226CAB

Strings

CONOUT$, xrefs: 00007FF715226C6D

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 98c69cb4885b5889e332a18a4983e0895d1cd665dce4f498ff52cfc2961821a3
Instruction ID: 64c5b473b3ccfdb207719f2e59bb2e314d89734ed944918fd19cb473dc64fb25
Opcode Fuzzy Hash: 98c69cb4885b5889e332a18a4983e0895d1cd665dce4f498ff52cfc2961821a3
Instruction Fuzzy Hash: CC118467B18E4186E354AF52EC54325A2A0FB88FF4F800234E91D87BA4DFBCD5088750

Function 00007FF71521A838 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF715215A21,?,?,?,?,00007FF71521DEBF,?,?,00000000,00007FF71521A956,?,?,?), ref: 00007FF71521A847
FlsSetValue.KERNEL32(?,?,?,00007FF715215A21,?,?,?,?,00007FF71521DEBF,?,?,00000000,00007FF71521A956,?,?,?), ref: 00007FF71521A87D
FlsSetValue.KERNEL32(?,?,?,00007FF715215A21,?,?,?,?,00007FF71521DEBF,?,?,00000000,00007FF71521A956,?,?,?), ref: 00007FF71521A8AA
FlsSetValue.KERNEL32(?,?,?,00007FF715215A21,?,?,?,?,00007FF71521DEBF,?,?,00000000,00007FF71521A956,?,?,?), ref: 00007FF71521A8BB
FlsSetValue.KERNEL32(?,?,?,00007FF715215A21,?,?,?,?,00007FF71521DEBF,?,?,00000000,00007FF71521A956,?,?,?), ref: 00007FF71521A8CC
SetLastError.KERNEL32(?,?,?,00007FF715215A21,?,?,?,?,00007FF71521DEBF,?,?,00000000,00007FF71521A956,?,?,?), ref: 00007FF71521A8E7

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: c9dc37af4f87961d25fbc0ce5a48ddfdaab7547aa572f2f47d6c4ba6d73b68d7
Instruction ID: 7c74bb245ae05f867d751aa732a5345310d39b002d44e7527c8b9930a0e85338
Opcode Fuzzy Hash: c9dc37af4f87961d25fbc0ce5a48ddfdaab7547aa572f2f47d6c4ba6d73b68d7
Instruction Fuzzy Hash: E8116FA2E09E4246F65C77219D9503BE2815F48FB0FD44734D86E177F5DFACA40A8660

Function 00007FF71520D2FC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71520D324
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF71520D40C
__std_exception_copy.LIBVCRUNTIME ref: 00007FF71520D558

Strings

csm, xrefs: 00007FF71520D45E
csm, xrefs: 00007FF71520D346

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record__std_exception_copy
String ID: csm$csm
API String ID: 851805269-3733052814
Opcode ID: 52ad06c5ff560891a60d9582bb7a5039c5fa8aa60573b1efc2ba76cab93e59d4
Instruction ID: 586edaec496fa913be7fc1aa5b89e30841edf942a6113fd6a6edb2ed4875b961
Opcode Fuzzy Hash: 52ad06c5ff560891a60d9582bb7a5039c5fa8aa60573b1efc2ba76cab93e59d4
Instruction Fuzzy Hash: 296196B390AB4186DB68AF15D84436CB7A0FB44F64F844135DA4D47BA5CF3CE458C710

Function 00007FF7152189A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7152189C5
GetProcAddress.KERNEL32 ref: 00007FF7152189DB
FreeLibrary.KERNEL32 ref: 00007FF715218A02

Strings

CorExitProcess, xrefs: 00007FF7152189D4
mscoree.dll, xrefs: 00007FF7152189BC

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e0fb2b492cc132a12b5115bfc8c6ad36574ad2c1dfa8dd6a2f5920aa30e5d553
Instruction ID: 308df8eb9cd8f5a94c0fa0e25260d447e494211f6d4a76e526f479aefbef0896
Opcode Fuzzy Hash: e0fb2b492cc132a12b5115bfc8c6ad36574ad2c1dfa8dd6a2f5920aa30e5d553
Instruction Fuzzy Hash: 73F044A7619F0241EB18AB24AC843799320AF49F71FD40335C56E456F4CFACD58DC720

Function 00007FF71522835C Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF715228384
_set_statfp.LIBCMT ref: 00007FF71522839F
_set_statfp.LIBCMT ref: 00007FF7152283BB
_set_statfp.LIBCMT ref: 00007FF7152283F7

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: beeff95c91d67a6708c331f286cb52cad831ded3722a78dd98caf9bb932e4956
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: 0A113DABE18F4201F66C3528DD8637990417F64B70E984634FB6E466FA8FECE8484124

Function 00007FF71521A900 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF715219B1F,?,?,00000000,00007FF715219DBA,?,?,?,?,?,00007FF715211476), ref: 00007FF71521A91F
FlsSetValue.KERNEL32(?,?,?,00007FF715219B1F,?,?,00000000,00007FF715219DBA,?,?,?,?,?,00007FF715211476), ref: 00007FF71521A93E
FlsSetValue.KERNEL32(?,?,?,00007FF715219B1F,?,?,00000000,00007FF715219DBA,?,?,?,?,?,00007FF715211476), ref: 00007FF71521A966
FlsSetValue.KERNEL32(?,?,?,00007FF715219B1F,?,?,00000000,00007FF715219DBA,?,?,?,?,?,00007FF715211476), ref: 00007FF71521A977
FlsSetValue.KERNEL32(?,?,?,00007FF715219B1F,?,?,00000000,00007FF715219DBA,?,?,?,?,?,00007FF715211476), ref: 00007FF71521A988

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 0cb0ecc62ce8febc4c1cd3f07cadcb41c3a2023019720235fc3b27c624f1e212
Instruction ID: 00bc291ae7394afc8f14d6877f6b51c0cad2531b6a69b7fd07eb8c5a362f5f41
Opcode Fuzzy Hash: 0cb0ecc62ce8febc4c1cd3f07cadcb41c3a2023019720235fc3b27c624f1e212
Instruction Fuzzy Hash: DE1190A2B08E4201FA5C77229DD117FE2915F89FB0E844735E87F067F6DF6CA8498660

Function 00007FF71521A794 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7152223D7,?,?,?,00007FF71521CC70,?,?,00000000,00007FF71521321F), ref: 00007FF71521A7A5
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7152223D7,?,?,?,00007FF71521CC70,?,?,00000000,00007FF71521321F), ref: 00007FF71521A7C4
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7152223D7,?,?,?,00007FF71521CC70,?,?,00000000,00007FF71521321F), ref: 00007FF71521A7EC
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7152223D7,?,?,?,00007FF71521CC70,?,?,00000000,00007FF71521321F), ref: 00007FF71521A7FD
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7152223D7,?,?,?,00007FF71521CC70,?,?,00000000,00007FF71521321F), ref: 00007FF71521A80E

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 472a203f570dff355be6dd52579cd86c3993db08607a52614a1bc7ae05160aed
Instruction ID: a89324a9de16b424b8e9369bba42f8a05476c10688ab0005cdeeac64776e21f3
Opcode Fuzzy Hash: 472a203f570dff355be6dd52579cd86c3993db08607a52614a1bc7ae05160aed
Instruction Fuzzy Hash: F5111C92E0990745F95C77219CA147BA1924F49F70ED44B35D93D0A2F2DF6CB44E82B0

Function 00007FF71521F164 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71521F443

Part of subcall function 00007FF715225028: _invalid_parameter_noinfo.LIBCMT ref: 00007FF715225045

Strings

UTF-8, xrefs: 00007FF71521F3C2
ccs, xrefs: 00007FF71521F37E
UTF-16LEUNICODE, xrefs: 00007FF71521F3E1

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: b792a72b0c262d60afe5143e3ce56eb9234b3c315f2f73cbf77dd6b0b88ef1dd
Instruction ID: a390a9543f0a38ae47e91ef3b73ed1c27e4c1bcdd1d09feece7a7835c9a0ae2c
Opcode Fuzzy Hash: b792a72b0c262d60afe5143e3ce56eb9234b3c315f2f73cbf77dd6b0b88ef1dd
Instruction Fuzzy Hash: A981E9F3E0CA8385F76CBE15CDD097AA6A0AB21F64FD54035DA39571A4CB2DE40A8731

Function 00007FF71520CFA4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF71520CFF0
_CallSETranslator.LIBVCRUNTIME ref: 00007FF71520D03F

Strings

MOC, xrefs: 00007FF71520D004
RCC, xrefs: 00007FF71520D00D

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 320b973d2360f702f6492bdafd9a57bf4472b6d8b40771194c4154b694ecb360
Instruction ID: c44ed07aedbc1ffa03ea82fd7f6be27bb298d087be1752f51378398d54d3c8e3
Opcode Fuzzy Hash: 320b973d2360f702f6492bdafd9a57bf4472b6d8b40771194c4154b694ecb360
Instruction Fuzzy Hash: 42518DB7A0AB458AE724EF65D8803ADB7A0F744B98F844125EF4D17B69CF38E049C710

Function 00007FF715202CA0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF715202799,?,?,?,?,?,?), ref: 00007FF715202CD1

Part of subcall function 00007FF715201CA0: GetLastError.KERNEL32(?,?,00000000,00007FF715206853,?,?,?,?,?,?,?,?,?,?,?,00007FF715201023), ref: 00007FF715201CC7

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF715202D0A
Failed to get executable path., xrefs: 00007FF715202CDB
GetModuleFileNameW, xrefs: 00007FF715202CE2

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2776309574-1977442011
Opcode ID: 0d9338abfd3054d072f33e15734b76f7292a07630b574cb69ce4fb167e8b756c
Instruction ID: c9980fdf8bb21d7b7d50f56510accbf375dad9bd08033b6f0a07958aaca21d5b
Opcode Fuzzy Hash: 0d9338abfd3054d072f33e15734b76f7292a07630b574cb69ce4fb167e8b756c
Instruction Fuzzy Hash: 420171A3B1EE4251FA6DB720DC453B59251AF4CFA4FC00032E94E86AA6EF5CE54DC720

Function 00007FF71521BB40 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF71521BBC7
WriteFile.KERNEL32 ref: 00007FF71521BE8E
WriteFile.KERNEL32 ref: 00007FF71521BED7
GetLastError.KERNEL32 ref: 00007FF71521BF98

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 4bb75c92a1ab2e7fd0df41a8cbac080d743b3a607fa80f295853e8c214f2ad95
Instruction ID: 2ea77b84898e349ff50ac7100b009022cb1b131cbc4ff9fb3f1ad0637dd77eac
Opcode Fuzzy Hash: 4bb75c92a1ab2e7fd0df41a8cbac080d743b3a607fa80f295853e8c214f2ad95
Instruction Fuzzy Hash: EBD123A3B08A8589E714DF75DC801AEB7B1F745BA8B944231DE4D97BA9CF38D00AC710

Function 00007FF71521E8D0 Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF71521E9BD
_get_daylight.LIBCMT ref: 00007FF71521E9CE
_get_daylight.LIBCMT ref: 00007FF71521E9DF
_isindst.LIBCMT ref: 00007FF71521EAA5

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: cfcf0323b73ea728397c9886ef4302b6457bc383625769a9df7878215742c1e9
Instruction ID: 3983a0c24d954775d63931205d9c5cf6dc03a090df94a1ffb79107b1fdb4eaa4
Opcode Fuzzy Hash: cfcf0323b73ea728397c9886ef4302b6457bc383625769a9df7878215742c1e9
Instruction Fuzzy Hash: 7051F7B3F04A128EFB2CEB649D815BDAB65BB40768F900135EE1D56AF5CB38A449C710

Function 00007FF715225648 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715225689
_invalid_parameter_noinfo.LIBCMT ref: 00007FF715225709
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71522575D
_get_daylight.LIBCMT ref: 00007FF7152257B5

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: d8d8fce7de822db2a4474f97e36a13ce103c8888522bff190dc61e27e7a4e771
Instruction ID: ac00c85c882185fc21fb0220b48a6bccb0292b201414acc598138ec3fe86d5bb
Opcode Fuzzy Hash: d8d8fce7de822db2a4474f97e36a13ce103c8888522bff190dc61e27e7a4e771
Instruction Fuzzy Hash: E551B4BBF48A0286F72D6A28DC84379E5809B40F34FD9C035C94B5E2F5CF6CE8489661

Function 00007FF7152141EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF71521421F
GetFileInformationByHandle.KERNEL32 ref: 00007FF715214281
GetLastError.KERNEL32 ref: 00007FF715214312
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF715214124), ref: 00007FF71521435E

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 0ae7b5227a693bd4cdc0f439dd7087ea1d18e56f445419d08ed96828b75df31f
Instruction ID: 392e3d01a3d278c708394b4c2ac8c165415da551c70c8d5a058139e69920db55
Opcode Fuzzy Hash: 0ae7b5227a693bd4cdc0f439dd7087ea1d18e56f445419d08ed96828b75df31f
Instruction Fuzzy Hash: 6E5193A3E08A4189FB18EF71DC903BE63A1AB44F68FA44135DE0D57658DF78D489C7A0

Function 00007FF715214098 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7152140C5
CreateFileW.KERNEL32 ref: 00007FF715214104
CloseHandle.KERNEL32 ref: 00007FF715214139

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 2914ba268addd75aa9a28fbb9c98da1b3a2d57cd915208efa484a858712485bb
Instruction ID: 52287b9cc3896d76c7c395ab8bc93a89af5148d876e527c171265b1f5d7cd1b6
Opcode Fuzzy Hash: 2914ba268addd75aa9a28fbb9c98da1b3a2d57cd915208efa484a858712485bb
Instruction Fuzzy Hash: 2241CBA3E18B8143E318AB219D9037AB350FBA5B74F504334D65C03AE6DF7CA5E88750

Function 00007FF7152248F4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF715220860: _invalid_parameter_noinfo.LIBCMT ref: 00007FF715220893

_get_daylight.LIBCMT ref: 00007FF715224A0C
_get_daylight.LIBCMT ref: 00007FF715224A1D

Strings

?, xrefs: 00007FF71522499D

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 5c3d20ecd8b8f8d4138e819684951d977da0ba85eb2e496d796a0fddbf7c8408
Instruction ID: f87d989f54baded7e33d9405071b8a29ec8d764f5f62a7362932c86c8bcfaa67
Opcode Fuzzy Hash: 5c3d20ecd8b8f8d4138e819684951d977da0ba85eb2e496d796a0fddbf7c8408
Instruction Fuzzy Hash: 6941F6B7A08B8246FB28AB25DC5137AD660EB80FB4F944235EE5C06AE5DF3CD4458750

Function 00007FF715217F24 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715217F56

Part of subcall function 00007FF715219EC8: HeapFree.KERNEL32(?,?,?,00007FF715221DDA,?,?,?,00007FF715221E17,?,?,00000000,00007FF7152222E8,?,?,00000000,00007FF71522221B), ref: 00007FF715219EDE
Part of subcall function 00007FF715219EC8: GetLastError.KERNEL32(?,?,?,00007FF715221DDA,?,?,?,00007FF715221E17,?,?,00000000,00007FF7152222E8,?,?,00000000,00007FF71522221B), ref: 00007FF715219EE8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF715209F55), ref: 00007FF715217F74

Strings

C:\Users\user\Desktop\FSJs1TlAyf.exe, xrefs: 00007FF715217F62

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\FSJs1TlAyf.exe
API String ID: 3580290477-787965512
Opcode ID: acbca15cd44fabff596ac91c3d18800840816a6c626c598ef6f49ccff3c34a57
Instruction ID: 266ed03299f504d9d8336f4d3116979a6d07a9cc40a83910fb0ce9aad39da5f6
Opcode Fuzzy Hash: acbca15cd44fabff596ac91c3d18800840816a6c626c598ef6f49ccff3c34a57
Instruction Fuzzy Hash: 084185B7A08E1685EB19EF21DCC00BAA794EB44FA0F955035E94D43BA5DF3CE449C320

Function 00007FF71521C1EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF71521C303
GetLastError.KERNEL32 ref: 00007FF71521C325

Strings

U, xrefs: 00007FF71521C2AF

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 65841838ba5035cfd428734c9ea552cf83108e5d474ae49afaa43364d676ac32
Instruction ID: 596c0d3c606cb213181ce4a7a9c80f4a1359e0eb418ed984a28c924afe60021d
Opcode Fuzzy Hash: 65841838ba5035cfd428734c9ea552cf83108e5d474ae49afaa43364d676ac32
Instruction Fuzzy Hash: EB41E9B3718A8182DB14DF65EC443AAA7A0FB88B94F804031DE4D877A8DF3CD545C750

Function 00007FF71521E538 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF71521E578
GetCurrentDirectoryW.KERNEL32 ref: 00007FF71521E5CA

Strings

:, xrefs: 00007FF71521E58E

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e2fe067896e50c3c1ec6b5d97d2340bd8d163c4be3586bda63525948b241b892
Instruction ID: 8cc4cd4d86741ccf96f81e4ba2a0e6a1b154d28f3d83de26c6e6258b78c8084d
Opcode Fuzzy Hash: e2fe067896e50c3c1ec6b5d97d2340bd8d163c4be3586bda63525948b241b892
Instruction Fuzzy Hash: 1C21E6B3B08A8185EB28AB11DC8416EB3A1FB84F54FC54135D64D43694DF7CE948CB61

Function 00007FF71520DE40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF71520DE84
RaiseException.KERNEL32 ref: 00007FF71520DECA

Strings

csm, xrefs: 00007FF71520DEB7

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d1de4137e22356e05c572dc18bab9e471ef67eb3cdc81db5d824458242951ede
Instruction ID: 8fac35b2de6ff95c93938482ead5f8b29b7b268c39542539c1eecdb908fb4fbb
Opcode Fuzzy Hash: d1de4137e22356e05c572dc18bab9e471ef67eb3cdc81db5d824458242951ede
Instruction Fuzzy Hash: 9D118F7360AF4182EB549F15E840269B7A5FB88FA4F984230EF8C07B64DF7CD4558B00

Function 00007FF71521F00C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71521F03C

Strings

:, xrefs: 00007FF71521F054

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: :
API String ID: 3215553584-336475711
Opcode ID: 5c4970f09abed39c6753eb42c82a62cc26ac4b61f4eb473f848091fe78b923c2
Instruction ID: ac6622f10390a4c9b1a8c5d27d8b847c43e8f2879011e9e1795552245690b86c
Opcode Fuzzy Hash: 5c4970f09abed39c6753eb42c82a62cc26ac4b61f4eb473f848091fe78b923c2
Instruction Fuzzy Hash: E801A2A3A18A0281F728BB609C9217FA3A0EF58B64FC00136D56E466A5DF2CD54C8B34

Function 00007FF715228CBC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

__C_specific_handler.LIBVCRUNTIME ref: 00007FF715228CCC

Part of subcall function 00007FF71520B760: __except_validate_context_record.LIBVCRUNTIME ref: 00007FF71520B78B
Part of subcall function 00007FF71520B760: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FF71520B820
Part of subcall function 00007FF71520B760: RtlUnwindEx.KERNEL32 ref: 00007FF71520B86F

Strings

f, xrefs: 00007FF715228CD1
csm, xrefs: 00007FF715228CD7

Memory Dump Source

Source File: 00000000.00000002.2042765592.00007FF715201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715200000, based on PE: true

Associated: 00000000.00000002.2042748000.00007FF715200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042797646.00007FF71522A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71523C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042820898.00007FF71524B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042859028.00007FF71524D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715200000_FSJs1TlAyf.jbxd

Similarity

API ID: C_specific_handlerCurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 3112662972-629598281
Opcode ID: d3260eec85eef3f17ec74c0d8d1e811eaf18040ea1dd95a5080735d095d66c32
Instruction ID: adff18a431ac40a9a291737b147e4f494844083aacead646e4d0888af0f4be99
Opcode Fuzzy Hash: d3260eec85eef3f17ec74c0d8d1e811eaf18040ea1dd95a5080735d095d66c32
Instruction Fuzzy Hash: C0E065A7909B8681E67C3F25A98517DA690AF09F64F94C071EF4C0A6B7CF7CD4948312

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FSJs1TlAyf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: FSJs1TlAyf.exePID: 6088, Parent PID: 1028

General

Chronological Activities

Analysis Process: conhost.exePID: 5676, Parent PID: 6088

General

Chronological Activities

Disassembly

Analysis Process: FSJs1TlAyf.exePID: 6088, Parent PID: 1028COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF71521AFEC Relevance: 10.8, APIs: 7, Instructions: 286COMMONLIBRARYCODE

Windows Analysis Report
FSJs1TlAyf.exe

Function 00007FF71521AFEC Relevance: 10.8, APIs: 7, Instructions: 286
COMMONLIBRARYCODE

Function 00007FF7152017A0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Function 00007FF715225918 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FF715201000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274
COMMON

Function 00007FF71521DED0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Function 00007FF71521C51C Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Function 00007FF715209FEC Relevance: 6.1, APIs: 4, Instructions: 102
COMMON

Function 00007FF71521893C Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Function 00007FF71520E228 Relevance: 3.2, APIs: 2, Instructions: 175
COMMONLIBRARYCODE

Function 00007FF71521BFCC Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Function 00007FF71521B9B0 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Function 00007FF71521B6CC Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Function 00007FF71521A0D8 Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Function 00007FF71521B438 Relevance: 1.6, APIs: 1, Instructions: 105
COMMONLIBRARYCODE

Function 00007FF7152062B0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON