Edit tour

Windows Analysis Report
AB5tAhygtM.dll

Overview

General Information

Sample name:	AB5tAhygtM.dll renamed because original name is a hash value
Original sample name:	6655c5686b9b0292cf5121fc6346341bb888704b421a85a15011456a9a2c192a.dll
Analysis ID:	1524368
MD5:	1e6c67456dd21d7fb2967364cf4735af
SHA1:	42a3d252faa7d7457c7f708ec6f44f3c1afd843e
SHA256:	6655c5686b9b0292cf5121fc6346341bb888704b421a85a15011456a9a2c192a
Tags:	CeranaKeeperdlluser-JAMESWT_MHT
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6764 cmdline: loaddll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6932 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7004 cmdline: rundll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6956 cmdline: rundll32.exe C:\Users\user\Desktop\AB5tAhygtM.dll,ModuleMain MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7116 cmdline: rundll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll",ModuleMain MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: AB5tAhygtM.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: AB5tAhygtM.dll

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 90.9% probability

Source: AB5tAhygtM.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: AB5tAhygtM.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDF0C06 FindFirstFileExW,_free,	3_2_6CDF0C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDC2A10 lstrlenW,lstrcatW,lstrlenW,FindFirstFileW,GetLastError,FindClose,	3_2_6CDC2A10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDC3420 lstrcatW,lstrlenW,lstrcpyW,FindFirstFileW,lstrcatW,_memcpy_s,FindNextFileW,	3_2_6CDC3420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDC30F0 lstrlenW,lstrcatW,lstrlenW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,FindNextFileW,FindClose,GetFileAttributesW,SetFileAttributesW,RemoveDirectoryW,GetLastError,SetFileAttributesW,GetLastError,	3_2_6CDC30F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D080C06 FindFirstFileExW,_free,	5_2_6D080C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D052A10 lstrlenW,lstrcatW,lstrlenW,FindFirstFileW,GetLastError,FindClose,	5_2_6D052A10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D053420 lstrcatW,lstrlenW,lstrcpyW,FindFirstFileW,lstrcatW,_memcpy_s,FindNextFileW,	5_2_6D053420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D0530F0 lstrlenW,lstrcatW,lstrlenW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,FindNextFileW,FindClose,GetFileAttributesW,SetFileAttributesW,RemoveDirectoryW,GetLastError,SetFileAttributesW,GetLastError,	5_2_6D0530F0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CDC1200 GetLogicalDriveStringsW,GetDriveTypeW,GetDiskFreeSpaceExW,

3_2_6CDC1200

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDE6D29	3_2_6CDE6D29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDDAFD0	3_2_6CDDAFD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDF38D4	3_2_6CDF38D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDCB8B0	3_2_6CDCB8B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDE6B00	3_2_6CDE6B00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDEE7E0	3_2_6CDEE7E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDDB760	3_2_6CDDB760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDDB01E	3_2_6CDDB01E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDDB230	3_2_6CDDB230
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDF2226	3_2_6CDF2226
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDF2352	3_2_6CDF2352
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D076D29	5_2_6D076D29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D06AFD0	5_2_6D06AFD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D05B8B0	5_2_6D05B8B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D0838D4	5_2_6D0838D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D076B00	5_2_6D076B00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D06B760	5_2_6D06B760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D07E7E0	5_2_6D07E7E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D06B01E	5_2_6D06B01E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D082352	5_2_6D082352
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D082226	5_2_6D082226
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D06B230	5_2_6D06B230

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D072C80 appears 32 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CDE2C80 appears 32 times

Source: AB5tAhygtM.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal60.winDLL@10/0@0/0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CDC1200 GetLogicalDriveStringsW,GetDriveTypeW,GetDiskFreeSpaceExW,

3_2_6CDC1200

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CDC66B0 CreateToolhelp32Snapshot,Process32First,CloseHandle,CloseHandle,Process32Next,CloseHandle,

3_2_6CDC66B0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:120:WilError_03

Source: AB5tAhygtM.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AB5tAhygtM.dll,ModuleMain

Source: AB5tAhygtM.dll

ReversingLabs: Detection: 31%

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_5-19696

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AB5tAhygtM.dll,ModuleMain
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll",ModuleMain
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AB5tAhygtM.dll,ModuleMain	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll",ModuleMain	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: AB5tAhygtM.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: AB5tAhygtM.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CDCCF60 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_6CDCCF60

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDE2CC6 push ecx; ret	3_2_6CDE2CD9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDF4168 push ecx; ret	3_2_6CDF4166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D072CC6 push ecx; ret	5_2_6D072CD9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D084168 push ecx; ret	5_2_6D084166

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 1.6 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 1.6 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDF0C06 FindFirstFileExW,_free,	3_2_6CDF0C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDC2A10 lstrlenW,lstrcatW,lstrlenW,FindFirstFileW,GetLastError,FindClose,	3_2_6CDC2A10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDC3420 lstrcatW,lstrlenW,lstrcpyW,FindFirstFileW,lstrcatW,_memcpy_s,FindNextFileW,	3_2_6CDC3420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDC30F0 lstrlenW,lstrcatW,lstrlenW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,FindNextFileW,FindClose,GetFileAttributesW,SetFileAttributesW,RemoveDirectoryW,GetLastError,SetFileAttributesW,GetLastError,	3_2_6CDC30F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D080C06 FindFirstFileExW,_free,	5_2_6D080C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D052A10 lstrlenW,lstrcatW,lstrlenW,FindFirstFileW,GetLastError,FindClose,	5_2_6D052A10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D053420 lstrcatW,lstrlenW,lstrcpyW,FindFirstFileW,lstrcatW,_memcpy_s,FindNextFileW,	5_2_6D053420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D0530F0 lstrlenW,lstrcatW,lstrlenW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,FindNextFileW,FindClose,GetFileAttributesW,SetFileAttributesW,RemoveDirectoryW,GetLastError,SetFileAttributesW,GetLastError,	5_2_6D0530F0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CDC1200 GetLogicalDriveStringsW,GetDriveTypeW,GetDiskFreeSpaceExW,

3_2_6CDC1200

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CDE5874 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_6CDE5874

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CDCCF60 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_6CDCCF60

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDEBD10 mov eax, dword ptr fs:[00000030h]	3_2_6CDEBD10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDE8899 mov eax, dword ptr fs:[00000030h]	3_2_6CDE8899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D07BD10 mov eax, dword ptr fs:[00000030h]	5_2_6D07BD10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D078899 mov eax, dword ptr fs:[00000030h]	5_2_6D078899

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CDECD0A GetProcessHeap,

3_2_6CDECD0A

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDE5874 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6CDE5874
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDE2B02 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6CDE2B02
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDDA450 SetUnhandledExceptionFilter,	3_2_6CDDA450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDE2157 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6CDE2157
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D075874 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6D075874
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D072B02 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6D072B02
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D06A450 SetUnhandledExceptionFilter,	5_2_6D06A450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D072157 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_6D072157

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CDE2CDC cpuid

3_2_6CDE2CDC

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CDC7FA0 CreateNamedPipeA,CreateEventA,ConnectNamedPipe,GetLastError,WaitForSingleObject,CloseHandle,

3_2_6CDC7FA0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CDE2733 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_6CDE2733

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: cmd.exe /c		3_2_6CDC5F20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: cmd.exe /c		5_2_6D055F20

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	12 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AB5tAhygtM.dll	32%	ReversingLabs	Win32.Trojan.Generic
AB5tAhygtM.dll	100%	Avira	TR/Agent.ajqud

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524368
Start date and time:	2024-10-02 18:15:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AB5tAhygtM.dll renamed because original name is a hash value
Original Sample Name:	6655c5686b9b0292cf5121fc6346341bb888704b421a85a15011456a9a2c192a.dll
Detection:	MAL
Classification:	mal60.winDLL@10/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 6 Number of non-executed functions: 179
Cookbook Comments:	Found application associated with file extension: .dll Stop behavior analysis, all processes terminated

Warnings

Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: AB5tAhygtM.dll

Simulations

Behavior and APIs

Time	Type	Description
12:16:22	API Interceptor	1x Sleep call for process: loaddll32.exe modified

File type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Entropy (8bit):	6.480361478505443
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AB5tAhygtM.dll
File size:	280'576 bytes
MD5:	1e6c67456dd21d7fb2967364cf4735af
SHA1:	42a3d252faa7d7457c7f708ec6f44f3c1afd843e
SHA256:	6655c5686b9b0292cf5121fc6346341bb888704b421a85a15011456a9a2c192a
SHA512:	b155f06c3688e87093c9099cb54ecfee28f266ae193cb421afea690ed5ff5670008ec10f16d8cfd950a426f3bba591e42a454dbe4346918b296a1b4132ca42cc
SSDEEP:	6144:zz11tl29svfzBgdhAZihii86QP+KTBk2NhVGU:f1t/vfzBgdhRu6QP/Te2NhVb
TLSH:	CD548D10F141C136E8FB047B8EFA99BE956CBB21039490C793CC2A6E5F264F17A3155B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........bJ5..$f..$f..$f.g'g..$f.g!g;.$f.g g..$f.k g..$f.k'g..$f.k!g..$f.g%g..$f..%f..$f.j-g..$f.j$g..$f.j&g..$fRich..$f...............

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1002269e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x64181471 [Mon Mar 20 08:08:17 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	373fbafe0063f9900a2de867dbe96fa1

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FC930CD0367h
call 00007FC930CD0439h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FC930CD0218h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FC930CCFC78h
mov dword ptr [esi], 1003636Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 10036374h
mov dword ptr [ecx], 1003636Ch
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FC930CCFC2Dh
push 10041534h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FC930CD1073h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FC930CD0322h
push 1004163Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FC930CD1056h
int3
jmp 00007FC930CD5641h
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [100361E8h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [1003612Ch]
xor dword ptr [ebp-04h], eax
call dword ptr [10036130h]
xor dword ptr [ebp-04h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x41b60	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x41ba8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x46000	0x1fd4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3f9e0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3fab8	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3fa18	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36000	0x2b4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x34b80	0x34c00	f06874a8f9fd5c51cf7714bb8d25f642	False	0.46019697867298576	data	6.349757647880202	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x36000	0xcb12	0xcc00	06b08a20aacf8437cbb8b274307b965d	False	0.5280522365196079	data	5.891693036481658	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x43000	0x255c	0xc00	54fedaa6507a806ffee94ebd0affafc9	False	0.2431640625	data	3.223015662132781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x46000	0x1fd4	0x2000	bdafd52ce01017805fd7a22199c3f91e	False	0.79296875	data	6.631484854475961	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	FindClose, GetFileAttributesW, SetFileAttributesW, GetLastError, lstrcatW, DeleteFileW, CreateThread, CreateProcessW, CopyFileW, lstrcpyW, lstrcmpW, MoveFileW, ReadFile, WriteFile, WaitForSingleObject, Sleep, SetFilePointerEx, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, SetFilePointer, lstrcatA, CreateFileA, CreatePipe, PeekNamedPipe, SetEvent, GetStartupInfoA, DeleteCriticalSection, CreateProcessA, CreateEventA, Process32First, TerminateProcess, OpenProcess, CreateToolhelp32Snapshot, LoadLibraryA, SetFileTime, GetProcAddress, FormatMessageA, GetEnvironmentVariableW, TerminateThread, GetTickCount, CreateNamedPipeA, lstrcpyA, ConnectNamedPipe, ReleaseSemaphore, WaitForMultipleObjects, CreateSemaphoreA, GlobalAlloc, GlobalFree, GlobalLock, GlobalUnlock, SetEndOfFile, UnmapViewOfFile, CreateFileMappingA, GetFileSize, MapViewOfFile, ResetEvent, GetCommandLineW, ExitProcess, WideCharToMultiByte, SetUnhandledExceptionFilter, GetCurrentProcess, GetCurrentThreadId, GetCurrentProcessId, GetModuleFileNameW, LocalAlloc, LocalFree, WriteConsoleW, HeapReAlloc, HeapSize, GetStringTypeW, SetStdHandle, GetConsoleMode, RemoveDirectoryW, lstrlenW, FindNextFileW, FindFirstFileW, GetStartupInfoW, CreateDirectoryW, GetDriveTypeW, CloseHandle, GetDiskFreeSpaceExW, GetLogicalDriveStringsW, CreateFileW, Process32Next, GetConsoleCP, FlushFileBuffers, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, MultiByteToWideChar, GetCommandLineA, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, GetFileType, GetStdHandle, LCMapStringW, HeapFree, HeapAlloc, GetModuleHandleExW, LoadLibraryExW, FreeLibrary, TlsFree, UnhandledExceptionFilter, IsProcessorFeaturePresent, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetModuleHandleW, RtlUnwind, RaiseException, InterlockedFlushSList, SetLastError, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, DecodePointer
USER32.dll	wsprintfA, GetDC, EnumDisplaySettingsA, ReleaseDC
GDI32.dll	DeleteDC, BitBlt, SelectObject, CreateCompatibleDC, RealizePalette, GetStockObject, GetDIBits, GetDeviceCaps, SelectPalette, DeleteObject, CreateDCA, GetObjectA
SHELL32.dll	CommandLineToArgvW
ole32.dll	StgCreateDocfile, CreateStreamOnHGlobal
gdiplus.dll	GdipSetWorldTransform, GdipCloneBitmapArea, GdipLoadImageFromStreamICM, GdipFree, GdipTranslateMatrix, GdipCreateBitmapFromGraphics, GdipGetImageGraphicsContext, GdipDisposeImage, GdipGetImageEncodersSize, GdipDeleteGraphics, GdipGetImageWidth, GdipSaveImageToStream, GdipDeleteMatrix, GdipLoadImageFromStream, GdiplusStartup, GdiplusShutdown, GdipGetImageHeight, GdipCreateMatrix, GdipAlloc, GdipCloneImage, GdipTransformMatrixPoints, GdipGetImageEncoders, GdipDrawImage
dbghelp.dll	MiniDumpWriteDump

Exports

Name	Ordinal	Address
ModuleMain	1	0x1001a720

Target ID:	0
Start time:	12:16:19
Start date:	02/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll"
Imagebase:	0xad0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:16:19
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:16:19
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:16:19
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\AB5tAhygtM.dll,ModuleMain
Imagebase:	0x190000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:16:19
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll",#1
Imagebase:	0x190000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:16:22
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AB5tAhygtM.dll",ModuleMain
Imagebase:	0x190000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.3%
Total number of Nodes:	1740
Total number of Limit Nodes:	27

Executed Functions

Function 6CDDA720 Relevance: 4.5, APIs: 3, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(00000000), ref: 6CDDA742
CommandLineToArgvW.SHELL32(00000000), ref: 6CDDA749

Part of subcall function 6CDDA450: SetUnhandledExceptionFilter.KERNEL32(6CDDA940,EBE653FE), ref: 6CDDA480

ExitProcess.KERNEL32 ref: 6CDDA764

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CommandLine$ArgvExceptionExitFilterProcessUnhandled
String ID:
API String ID: 3999336801-0
Opcode ID: 966a434d503bcdb4d0a79381f6d6ebba43f28f1bfa453ef1bc6e8f1de02ea438
Instruction ID: af8e29981ce91b6bdfdcd28ae2e6341279a0acfbdecf35a61808c1686a8c03a7
Opcode Fuzzy Hash: 966a434d503bcdb4d0a79381f6d6ebba43f28f1bfa453ef1bc6e8f1de02ea438
Instruction Fuzzy Hash: 21E0C9B5E00208BBDB00DFE5D849B8EBBFCAB49305F408059E614D3240D73466058FA5

Function 6CDEE098 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CDE994C: RtlAllocateHeap.NTDLL(00000008,?,6CDDA587,?,6CDE98A2,00000001,00000364,FFFFFFFF,000000FF,?,6CDDA587,?,6CDE7998,6CDEA642), ref: 6CDE998D

_free.LIBCMT ref: 6CDEE104

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: a7018ca1b7dab01fa89ae2cc2327009ac45932cccc635d3d6545fe49a90cdd94
Instruction ID: f5a01060069596db4a8a8165446458d5dca5e9d4291f3b1860820b7022dc2f16
Opcode Fuzzy Hash: a7018ca1b7dab01fa89ae2cc2327009ac45932cccc635d3d6545fe49a90cdd94
Instruction Fuzzy Hash: A501F972204305ABE321CF69DC8599AFBE9FB89374F25061DE59483AC0EB30A945C7B4

Function 6CDE994C Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,6CDDA587,?,6CDE98A2,00000001,00000364,FFFFFFFF,000000FF,?,6CDDA587,?,6CDE7998,6CDEA642), ref: 6CDE998D

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 57206669541daca6991e3f557c9b072927fd4bd6a81eced77e88ca5725aa5e60
Instruction ID: d5d5f5474d16e3986afc4b13ee4029a3a83d8c9e91a4a1f933435695b14f5b6b
Opcode Fuzzy Hash: 57206669541daca6991e3f557c9b072927fd4bd6a81eced77e88ca5725aa5e60
Instruction Fuzzy Hash: E5F0E931607625A6EB110B269C04BDE3759EF8E774B156116E81CEAAB0CB20D400C6F1

Non-executed Functions

Function 6CDC30F0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 193stringfileCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 6CDC3120
lstrcatW.KERNEL32(?,?), ref: 6CDC3157
lstrlenW.KERNEL32(?), ref: 6CDC3164
lstrcpyW.KERNEL32(?,*.*), ref: 6CDC31D4
FindFirstFileW.KERNEL32(?,?), ref: 6CDC31E8
lstrcmpW.KERNEL32(?,6CDFBA58), ref: 6CDC3220
lstrcmpW.KERNEL32(?,6CDFBA5C), ref: 6CDC323D
lstrcatW.KERNEL32(?,?), ref: 6CDC326C
lstrcatW.KERNEL32(?,?), ref: 6CDC32C3
FindNextFileW.KERNEL32(000000FF,?), ref: 6CDC3376
FindClose.KERNEL32(000000FF), ref: 6CDC338B
GetFileAttributesW.KERNEL32(?), ref: 6CDC33AA
SetFileAttributesW.KERNEL32(?,00000090), ref: 6CDC33BF
RemoveDirectoryW.KERNEL32(?), ref: 6CDC33C9
GetLastError.KERNEL32 ref: 6CDC33D3
SetFileAttributesW.KERNEL32(?,00000000), ref: 6CDC33E9
GetLastError.KERNEL32 ref: 6CDC33F8

Strings

*.*, xrefs: 6CDC31C1

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: File$AttributesFindlstrcat$ErrorLastlstrcmplstrlen$CloseDirectoryFirstNextRemovelstrcpy
String ID: *.*
API String ID: 270640561-438819550
Opcode ID: 0d77bc36600086101a088d4dc78554990d4d1a4dca69f05d5ab0d5f0fdbb6896
Instruction ID: da022de1fc3de8ff29452108978eb18463e2996818b8d0eec0da2ee2ccaf93d5
Opcode Fuzzy Hash: 0d77bc36600086101a088d4dc78554990d4d1a4dca69f05d5ab0d5f0fdbb6896
Instruction Fuzzy Hash: 119181B4604218DBDB10CF64C844FEEB77ABF89308F1082D9E92997650DB369EA5CF51

Function 6CDCCF60 Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 370libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000), ref: 6CDCD026
GetProcAddress.KERNEL32(00000000,00000000), ref: 6CDCD0E1
GetProcAddress.KERNEL32(00000000,00000000), ref: 6CDCD187

Part of subcall function 6CDE2278: ___report_securityfailure.LIBCMT ref: 6CDE227D

GetProcAddress.KERNEL32(00000000,00000000), ref: 6CDCD2B8
GetProcAddress.KERNEL32(00000000,00000000), ref: 6CDCD36C
GetProcAddress.KERNEL32(00000000,00000000), ref: 6CDCD4D5

Strings

@@@@@, xrefs: 6CDCD35C
@, xrefs: 6CDCD00D
@, xrefs: 6CDCD0C4
@@@@@@, xrefs: 6CDCD4C5
@@@@, xrefs: 6CDCD2A8
@@@, xrefs: 6CDCD177
p, xrefs: 6CDCD4A8

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad___report_securityfailure
String ID: @$@$@@@$@@@@$@@@@@$@@@@@@$p
API String ID: 1632341849-4092788838
Opcode ID: e26611c22b354305a7b30c3fbc6d4136173b5dd937654292d6a0f5e0ca89d273
Instruction ID: 8df59eb4067628834a2bf19e9e7caaeb9651f0b94531a3b5719770541013f8a9
Opcode Fuzzy Hash: e26611c22b354305a7b30c3fbc6d4136173b5dd937654292d6a0f5e0ca89d273
Instruction Fuzzy Hash: 8802A370A092C98AFB18CFACD2183DDBEA69B91304F28407DC5498F7D5D7FA6A45C361

Function 6CDC5F20 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 285stringprocesspipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 6CDC5F68
GetStartupInfoA.KERNEL32(00000044), ref: 6CDC5F9D
lstrcatA.KERNEL32(?,cmd.exe /c ), ref: 6CDC5FF0
lstrcatA.KERNEL32(?,?), ref: 6CDC6001
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CDC602A

Strings

cmd.exe /c , xrefs: 6CDC5FE4
D, xrefs: 6CDC5F8C

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: Createlstrcat$InfoPipeProcessStartup
String ID: D$cmd.exe /c
API String ID: 2132647166-3768262801
Opcode ID: 838439182e4ae7c472be70e0ef6698683efa2fcba7fd13d294841983c55282c0
Instruction ID: 3b321c0fc0256f3af4f2d1a6df455fd892f743c3d05ceec0f562303566542bb7
Opcode Fuzzy Hash: 838439182e4ae7c472be70e0ef6698683efa2fcba7fd13d294841983c55282c0
Instruction Fuzzy Hash: B3D14BB4A04218DBDB24CF24C854BEDBBB9AF49308F0082D8E95D9B390D7759AC5CF91

Function 6CDC3420 Relevance: 16.3, APIs: 7, Strings: 2, Instructions: 546COMMON

Download Yara Rule

Strings

*.*, xrefs: 6CDC3633
count : %d, xrefs: 6CDC3AE9

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID: *.*$count : %d
API String ID: 0-284877241
Opcode ID: 00be15ce84df67415605dac2f8227f4e1bad6f9313a337325ac852bb832ff36b
Instruction ID: b22fc094cd1f147ef3a8f9fbb20af564fa6b606a35d78df5be4bf1da83c60b97
Opcode Fuzzy Hash: 00be15ce84df67415605dac2f8227f4e1bad6f9313a337325ac852bb832ff36b
Instruction Fuzzy Hash: 564214B0A402298FCB24CB14CC90BDEB7B9BF89318F1041D9D649A7391DB749E85CF5A

Function 6CDCB8B0 Relevance: 11.0, APIs: 7, Instructions: 516memoryCOMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(?,?,00000000,EBE653FE), ref: 6CDCB90D
GlobalAlloc.KERNEL32(00000000,?), ref: 6CDCB919
CreateStreamOnHGlobal.OLE32(?,00000000,?), ref: 6CDCB94C

Part of subcall function 6CDCA2D0: GdipLoadImageFromStreamICM.GDIPLUS(?,-00000004), ref: 6CDCA2FB

GdiplusShutdown.GDIPLUS(?,00000010), ref: 6CDCC255

Part of subcall function 6CDCA4A0: GdipGetImageHeight.GDIPLUS(?,00000000), ref: 6CDCA4C5

Part of subcall function 6CDCA450: GdipGetImageWidth.GDIPLUS(?,00000000), ref: 6CDCA475

Part of subcall function 6CDCA050: GdipCreateMatrix.GDIPLUS(00000000), ref: 6CDCA06E

Part of subcall function 6CDCA0C0: GdipTranslateMatrix.GDIPLUS(?,?,?,?), ref: 6CDCA0E7

Part of subcall function 6CDCA180: GdipGetImageGraphicsContext.GDIPLUS(?,00000000), ref: 6CDCA1AB

__dtol3.LIBCMT ref: 6CDCBEC5
__dtol3.LIBCMT ref: 6CDCBED3

Part of subcall function 6CDCA570: GdipCreateBitmapFromGraphics.GDIPLUS(?,?,?,00000000,?,?,?,6CDF5118,000000FF), ref: 6CDCA5CC

Part of subcall function 6CDCA200: GdipSetWorldTransform.GDIPLUS(?), ref: 6CDCA213

Part of subcall function 6CDCA100: GdipTransformMatrixPoints.GDIPLUS(?,?,?), ref: 6CDCA115

GlobalFree.KERNEL32(?), ref: 6CDCC20C

Part of subcall function 6CDCC590: StgCreateDocfile.OLE32(00000000,00001012,00000000,00000000,EBE653FE), ref: 6CDCC5DD
Part of subcall function 6CDCC590: GetLastError.KERNEL32 ref: 6CDCC6A2

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: Gdip$CreateImage$GlobalMatrix$FromGdiplusGraphicsStreamTransform__dtol3$AllocBitmapContextDocfileErrorFreeHeightLastLoadPointsShutdownStartupTranslateWidthWorld
String ID:
API String ID: 117386901-0
Opcode ID: eb9897694fad3ba90f8c4aff4282a5cbdac5c2c25b1a5995c080c19364a74708
Instruction ID: 8138fd37da657aab0a3c8ba001eddc4e7eac1bf162ea19fdf1462ae7ad308ece
Opcode Fuzzy Hash: eb9897694fad3ba90f8c4aff4282a5cbdac5c2c25b1a5995c080c19364a74708
Instruction Fuzzy Hash: 1C520731D0062CDACB66CB66C891BDDF379BF59340F048689E549772A1EB306AC8DF61

Function 6CDC7FA0 Relevance: 9.1, APIs: 6, Instructions: 104pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeA.KERNEL32(00000000,40000000,00000000,00000001,00000400,00000400,00000000,00000000), ref: 6CDC7FF7
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6CDC8016
ConnectNamedPipe.KERNEL32(000000FF,?), ref: 6CDC8058
GetLastError.KERNEL32 ref: 6CDC8062

Part of subcall function 6CDC7F60: CloseHandle.KERNEL32(6CDCDA21,00002710,?,6CDC7E40,00002508,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC7F7D

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CreateNamedPipe$CloseConnectErrorEventHandleLast
String ID:
API String ID: 2388497103-0
Opcode ID: f08f78aa82f98f89bb59f9bb9c5bedbc52ff7108b0ae736b824a4c1e4bff9f9f
Instruction ID: 4320c7148b2f44c1593bd5a5c2ae0f6ee4de20985744b2b7455416240145c769
Opcode Fuzzy Hash: f08f78aa82f98f89bb59f9bb9c5bedbc52ff7108b0ae736b824a4c1e4bff9f9f
Instruction Fuzzy Hash: FE411AB0E00208EBDB04CFA5D881FDDBBB9BF49324F20465AE625B76D0D7716A40CB61

Function 6CDC2A10 Relevance: 9.1, APIs: 6, Instructions: 92stringfileCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 6CDC2A3D
lstrcatW.KERNEL32(?,?), ref: 6CDC2AB8
lstrlenW.KERNEL32(?), ref: 6CDC2AC5
FindFirstFileW.KERNEL32(?,?), ref: 6CDC2B38
GetLastError.KERNEL32 ref: 6CDC2B4D
FindClose.KERNEL32(000000FF), ref: 6CDC2B68

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: Findlstrlen$CloseErrorFileFirstLastlstrcat
String ID:
API String ID: 2856486079-0
Opcode ID: 7b2f56460a4bf72c04840bf44a73fab7d9a619830ff055a5822925d6167fa991
Instruction ID: 7018caa8f072ff3aa1a737d9a06472928d872020818de670d43798177d6f418f
Opcode Fuzzy Hash: 7b2f56460a4bf72c04840bf44a73fab7d9a619830ff055a5822925d6167fa991
Instruction Fuzzy Hash: D041D5B4A04318CBCF20CF64D898BAD77B9EF46308F1082D9EA5997691DB359E80CF55

Function 6CDC66B0 Relevance: 9.1, APIs: 6, Instructions: 72processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 6CDC66EE
Process32First.KERNEL32(?,00000128), ref: 6CDC6708
CloseHandle.KERNEL32(?), ref: 6CDC676C

Part of subcall function 6CDC67B0: OpenProcess.KERNEL32(001FFFFF,00000000,FFFFFFFF), ref: 6CDC67CC
Part of subcall function 6CDC67B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 6CDC67E1

CloseHandle.KERNEL32(?), ref: 6CDC673A
Process32Next.KERNEL32(?,00000128), ref: 6CDC6784
CloseHandle.KERNEL32(?), ref: 6CDC6795

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CloseHandle$ProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3051378104-0
Opcode ID: 37df7bc309c2354e0e9861e862bc31e798399d362e16d8066d7e1abbe5c92a4e
Instruction ID: 9b0ce89c2dd342c56ae9299c00b222b47675fe9654d52c92db99388f9cc51ebe
Opcode Fuzzy Hash: 37df7bc309c2354e0e9861e862bc31e798399d362e16d8066d7e1abbe5c92a4e
Instruction Fuzzy Hash: 34218DB4B00218ABDF10EF60DD44BED77B9AF49304F0045C8E649DBA81DA34AA66CF61

Function 6CDC1200 Relevance: 4.6, APIs: 3, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 6CDC1130: Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 6CDC1169

GetLogicalDriveStringsW.KERNEL32(00000100,?), ref: 6CDC1246
GetDriveTypeW.KERNEL32(?), ref: 6CDC12BB
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 6CDC1307

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: Drive$Affinity::operator!=Concurrency::details::DiskFreeHardwareLogicalSpaceStringsType
String ID:
API String ID: 1757737928-0
Opcode ID: 637585f1727e9a1d58f5e77aff46f14c61651521987d62e80f5a2e467591a075
Instruction ID: 13cc4238841ca9cccc0f66dfda4ff7f36e0834d42ecca960a7f230cd68674846
Opcode Fuzzy Hash: 637585f1727e9a1d58f5e77aff46f14c61651521987d62e80f5a2e467591a075
Instruction Fuzzy Hash: DC51F574E012299BCB24DFA4D988B99B7B5BF5C304F1082D9D509A7351E734AEC4CF51

Function 6CDE5874 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CDE596C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CDE5976
UnhandledExceptionFilter.KERNEL32(?), ref: 6CDE5983

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 30b9b90899bcf074f2d28bfce22b56b3b2d1468db43553ffb7401f17407b6404
Instruction ID: 0dd0345dd168c231ba05634282e3614b8685ab7d10c32f281bfee0d87cdbc46c
Opcode Fuzzy Hash: 30b9b90899bcf074f2d28bfce22b56b3b2d1468db43553ffb7401f17407b6404
Instruction Fuzzy Hash: 7931D4749012299BCB21DF64D9897CDBBB8BF08314F5041EAE91CA7260E7709B858F55

Function 6CDE8899 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6CDE8898,?,?,?,?,?,6CDE7D32), ref: 6CDE88BB
TerminateProcess.KERNEL32(00000000,?,6CDE8898,?,?,?,?,?,6CDE7D32), ref: 6CDE88C2
ExitProcess.KERNEL32 ref: 6CDE88D4

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b6fb774022b638a6bd638c53dee2e106fdc2b5b0a04207613fd797ef6d05d753
Instruction ID: 60628f365ddd03b5c0b418c337ef2d8c0ddb267da1240636a75f92eaf984547d
Opcode Fuzzy Hash: b6fb774022b638a6bd638c53dee2e106fdc2b5b0a04207613fd797ef6d05d753
Instruction Fuzzy Hash: D3E04631140508ABCF012F28EC48A8C3F3DFB0A346F214416FA15D6A31CB35E982CB51

Function 6CDEE7E0 Relevance: 3.5, APIs: 2, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e768423e87e0488d155602b3877f3a4d4812ba10f35847b57dd0dd41e3f8bf3b
Instruction ID: e9a6b041fccba66fdda991c657c8ae16828474d50c967e3b4848131431816c6f
Opcode Fuzzy Hash: e768423e87e0488d155602b3877f3a4d4812ba10f35847b57dd0dd41e3f8bf3b
Instruction Fuzzy Hash: 28025E71E01219DFDF14CFA9D88069EBBF1FF88314F258269D819A7B94D730AA01CB90

Function 6CDF0C06 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(00000140,?,00000140,00000000,?,?,?,?,?,?,00000000,00000140), ref: 6CDF0C4E
_free.LIBCMT ref: 6CDF0C5F

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: FileFindFirst_free
String ID:
API String ID: 689657435-0
Opcode ID: cec34a41670aa4116604e4a38f6a388ac0002c8328b46fcf64d2a0d13c735442
Instruction ID: 99a4ffb6b5de7a294de3a84b2b946e133fc8b9cea3c3f096fd50e8cd32ec1e05
Opcode Fuzzy Hash: cec34a41670aa4116604e4a38f6a388ac0002c8328b46fcf64d2a0d13c735442
Instruction Fuzzy Hash: DD01FB71C01159AFCF119FA89D05AEEBFB9FB09294F104165EA28E3260E7318A61DB91

Function 6CDF38D4 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6CDF38CF,?,?,00000008,?,?,6CDF3563,00000000), ref: 6CDF3B01

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 5ea8a0b664eee8baaea155728f0c4e93d8ccd50d6906ef061d111a90d6362d0b
Instruction ID: cf3e310a786c503b26c291d7e471c7d134b97aa7766b86d788e1e7b7d5a5d856
Opcode Fuzzy Hash: 5ea8a0b664eee8baaea155728f0c4e93d8ccd50d6906ef061d111a90d6362d0b
Instruction Fuzzy Hash: 37B13831611608DFD705CF28C496B657BA0FF05368F268658E8E9CF6B1C335E992CB41

Function 6CDDA450 Relevance: 1.7, APIs: 1, Instructions: 155COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(6CDDA940,EBE653FE), ref: 6CDDA480

Part of subcall function 6CDDA420: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,6CDDA512,00000000,00000000,?,6CDDA512,?,?,00000100), ref: 6CDDA439

Part of subcall function 6CDCD8A0: InitializeCriticalSection.KERNEL32(-00014F25,?,?,?,?,EBE653FE,?,?,?,?,?,00000000,6CDF525F,000000FF,?,6CDDA61B), ref: 6CDCD963
Part of subcall function 6CDCD8A0: InitializeCriticalSection.KERNEL32(-00014F3D,?,?,EBE653FE,?,?,?,?,?,00000000,6CDF525F,000000FF,?,6CDDA61B), ref: 6CDCD973
Part of subcall function 6CDCD8A0: InitializeCriticalSection.KERNEL32(-00014F55,?,?,EBE653FE,?,?,?,?,?,00000000,6CDF525F,000000FF,?,6CDDA61B), ref: 6CDCD982

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalInitializeSection$ByteCharExceptionFilterMultiUnhandledWide
String ID:
API String ID: 1854652003-0
Opcode ID: ccccaf0f22b7675cb15fd390c45e2f435d20f9e97eefb47feadb508cb57b9aeb
Instruction ID: c111640db029fca378eb7022d81f521c02d2068aa300badafe6856fc7817050a
Opcode Fuzzy Hash: ccccaf0f22b7675cb15fd390c45e2f435d20f9e97eefb47feadb508cb57b9aeb
Instruction Fuzzy Hash: CC516FB1E002189BDB14DF64CC41BDDB7B8AB48308F4085EDE60867791DBB46B88CFA5

Function 6CDDB760 Relevance: 1.6, Strings: 1, Instructions: 378COMMON

Download Yara Rule

Strings

, xrefs: 6CDDB7F9

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6733b8c9c7a77bf5c2b396d0c5ee1ffcc4a3b0c4165d0667381d1402247bad94
Instruction ID: e3fb4aea0688e4d250e62945953d433b604d7c381ff079c03251d234c92cde48
Opcode Fuzzy Hash: 6733b8c9c7a77bf5c2b396d0c5ee1ffcc4a3b0c4165d0667381d1402247bad94
Instruction Fuzzy Hash: 3B0280B1A00209DFDB18DF5CC551A6DB7B2FF84344F6182BCD612AB785D634AB12EB84

Function 6CDDB230 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

, xrefs: 6CDDB293

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4f34cfa1c1386cb9cd492dc50e0acebe2c933d552dbdfac325c79aebe2ae507d
Instruction ID: 222ee886cd95b54f99e1acdc30be4fc45f17c48c540465790464d6ca869570fc
Opcode Fuzzy Hash: 4f34cfa1c1386cb9cd492dc50e0acebe2c933d552dbdfac325c79aebe2ae507d
Instruction Fuzzy Hash: EBF16D71900219DFEB18DF5CC541BADB7B2FF84344F6182B9D612AB785C634AB12EB84

Function 6CDE6D29 Relevance: 1.5, Strings: 1, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 6CDE6E9C

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0602973c8348926d14db4c4d52be7a6099397672f203efc74e5928c6cbd81c24
Instruction ID: a498df954f7df05b505060c9ac8c29e7f20db21e122b254f76ba39bb8e6fb4f8
Opcode Fuzzy Hash: 0602973c8348926d14db4c4d52be7a6099397672f203efc74e5928c6cbd81c24
Instruction Fuzzy Hash: B8518D60605A4CEADB208B68C8527AE37E59F0EB0CF94461DD791CBEF1D715E9478322

Function 6CDE6B00 Relevance: 1.5, Strings: 1, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 6CDE6C73

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 190da6d08d3742a4bc67a58751aadbb8d6133a82a09750eceb8583532665fccc
Instruction ID: ff06a9ff66b9c3fa1c1da9d60eabc22a68703a8e86f357fe36563a18341a7bf1
Opcode Fuzzy Hash: 190da6d08d3742a4bc67a58751aadbb8d6133a82a09750eceb8583532665fccc
Instruction Fuzzy Hash: A0518B70645A4CD6DB10AB2888607FF3BEADB1E30CF240619D795CBFB1D611DA0B8366

Function 6CDECD0A Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6CDECD0A

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: c38ab069228f69a84ec9083003953a565755d72603e57629f5805ae0dc5d412e
Instruction ID: 62c22c7bfd51528a3a12d74212d2be8a94e8412a367a9ce203f0524201f5ec5c
Opcode Fuzzy Hash: c38ab069228f69a84ec9083003953a565755d72603e57629f5805ae0dc5d412e
Instruction Fuzzy Hash: ADA02230300202CFAF008F30A30830C3AFCBB832CB300802FA228C2002EB30C0308B80

Function 6CDDAFD0 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3fdef121e712e85f8aca1e58f09848c50b3d34f4ea610ed7c79a969d03c2c6a
Instruction ID: 37675a6117765e3f2b43d40d74a26758740a5717f6b22012d4174bdc15b144cc
Opcode Fuzzy Hash: e3fdef121e712e85f8aca1e58f09848c50b3d34f4ea610ed7c79a969d03c2c6a
Instruction Fuzzy Hash: 17815D71600249AFDB08DF29C891BAA3BA2FF89354F10C16DFD298F695D234E651DF84

Function 6CDDB01E Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7623a9441ac869241e450a9134a09c6abc2b9583dd523e29ca60dd7655be095c
Instruction ID: f1d7206fef55be965ab1a4344f6dcd93f7abd43273d994795f9b833b8f383e06
Opcode Fuzzy Hash: 7623a9441ac869241e450a9134a09c6abc2b9583dd523e29ca60dd7655be095c
Instruction Fuzzy Hash: 49512970110249AFDB08DF2DC491AA97BA2FF85394F14C16EFE298F685C238E651DF84

Function 6CDF2352 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aaf34044b757032f7c8f5584b7b3528ae721adfc6b52e0a391e92367490ca29
Instruction ID: 347ef642304e59c212c193d2b2505166489e863c4fa4f055cf1c33bee83dedc7
Opcode Fuzzy Hash: 5aaf34044b757032f7c8f5584b7b3528ae721adfc6b52e0a391e92367490ca29
Instruction Fuzzy Hash: 2E21A473F20538477B0CC47E8C56279B6E1C78C501745427AE8A6DA2C1D968D927E2E4

Function 6CDF2226 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 312c2737cabb85fc57b4bcbe01e7f3393355f9094cc98c53bf1aee16ee81ced4
Instruction ID: 0581084866548f13769b5b891d88fef638b00d8b4858b38fcc4058238380f46d
Opcode Fuzzy Hash: 312c2737cabb85fc57b4bcbe01e7f3393355f9094cc98c53bf1aee16ee81ced4
Instruction Fuzzy Hash: D6118223F30C295B275C816D8C1727AA2D2EBDC25030F533AE866EB284E954DE239290

Function 6CDEBD10 Relevance: .0, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2357ccda04ebdad8f9ed0823f690bbb3a9e885cd6e0b45a8cc48df8e37af03f3
Instruction ID: ea776b81210e7b9b0124b734c972071d6735c3f9f509ebcee86b5a7d2607f5d9
Opcode Fuzzy Hash: 2357ccda04ebdad8f9ed0823f690bbb3a9e885cd6e0b45a8cc48df8e37af03f3
Instruction Fuzzy Hash: 6FE04F32912328EBC711DB8885409D9B3ACE709A10B1105D6F505D3611C270AE00C7D4

Function 6CDD9D70 Relevance: 34.7, APIs: 23, Instructions: 237
synchronizationsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(-00000090), ref: 6CDD9DB8
GetTickCount.KERNEL32 ref: 6CDD9DDF
LeaveCriticalSection.KERNEL32(-00000090,-00000004), ref: 6CDD9E16
LeaveCriticalSection.KERNEL32(-00000090,-00000004), ref: 6CDD9E49
GetTickCount.KERNEL32 ref: 6CDD9E66
EnterCriticalSection.KERNEL32(-000000A8), ref: 6CDD9E8F
WaitForSingleObject.KERNEL32(?,0000000A), ref: 6CDD9EAD
ResetEvent.KERNEL32(?), ref: 6CDD9EC5
LeaveCriticalSection.KERNEL32(-000000A8), ref: 6CDD9ED6
GetTickCount.KERNEL32 ref: 6CDD9EFC
LeaveCriticalSection.KERNEL32(-000000A8,-00000004,00000000), ref: 6CDD9F34
LeaveCriticalSection.KERNEL32(-000000A8,-00000004,00000000), ref: 6CDD9F65
EnterCriticalSection.KERNEL32(-000000C0), ref: 6CDD9FB5
WaitForSingleObject.KERNEL32(?,0000000A), ref: 6CDD9FD3
ResetEvent.KERNEL32(?), ref: 6CDD9FE7
LeaveCriticalSection.KERNEL32(-000000C0), ref: 6CDD9FF8
WaitForSingleObject.KERNEL32(?,0000000A), ref: 6CDDA01B
ResetEvent.KERNEL32(?), ref: 6CDDA02F
LeaveCriticalSection.KERNEL32(-000000C0), ref: 6CDDA040
GetTickCount.KERNEL32 ref: 6CDDA06C
LeaveCriticalSection.KERNEL32(-000000C0,-00000004,00000000), ref: 6CDDA0A4
LeaveCriticalSection.KERNEL32(-000000C0,-00000004,00000000), ref: 6CDDA0D2
Sleep.KERNEL32(0000000A), ref: 6CDDA0F2

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$CountTick$EnterEventObjectResetSingleWait$Sleep
String ID:
API String ID: 22041548-0
Opcode ID: 5372543f279e06e60563c1d8d97e476ab4f1d1ebd1ae57cc02df7f348e169b86
Instruction ID: 541293147d03debad2d29c3fa0a50d0b2a12773015879e94bb7a4b06781fc11b
Opcode Fuzzy Hash: 5372543f279e06e60563c1d8d97e476ab4f1d1ebd1ae57cc02df7f348e169b86
Instruction Fuzzy Hash: 1FA18DB4B40204EFEB04DB68D998B6E7B79FF8630CF108119E5029B791DB36E455CBA1

Function 6CDCC280 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 239
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 6CDCC328
GetDeviceCaps.GDI32(00000000,0000000C), ref: 6CDCC337
GetDeviceCaps.GDI32(00000000,0000000E), ref: 6CDCC345
DeleteDC.GDI32(00000000), ref: 6CDCC355
GetObjectA.GDI32(?,00000018,?), ref: 6CDCC3A1
GlobalAlloc.KERNEL32(00000042,00000028), ref: 6CDCC42D
GlobalLock.KERNEL32(00000000), ref: 6CDCC43A
GetStockObject.GDI32(0000000F), ref: 6CDCC452
GetDC.USER32(00000000), ref: 6CDCC463
SelectPalette.GDI32(00000000,00000000,00000000), ref: 6CDCC476
RealizePalette.GDI32(00000000), ref: 6CDCC483
GetDIBits.GDI32(00000000,?,00000000,?,00000028,00000000,00000000), ref: 6CDCC4A8
SelectPalette.GDI32(00000000,00000000,00000001), ref: 6CDCC4BE
RealizePalette.GDI32(00000000), ref: 6CDCC4C8
ReleaseDC.USER32(00000000,00000000), ref: 6CDCC4D4
GlobalUnlock.KERNEL32(00000000), ref: 6CDCC560
GlobalFree.KERNEL32(00000000), ref: 6CDCC56A

Strings

(, xrefs: 6CDCC3B2
DISPLAY, xrefs: 6CDCC323

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: GlobalPalette$CapsDeviceObjectRealizeSelect$AllocBitsCreateDeleteFreeLockReleaseStockUnlock
String ID: ($DISPLAY
API String ID: 2569495461-216271742
Opcode ID: a2780b55b0967e9ad717de92a10b6c6a6cd00460d55c13b33b459266880e7ca9
Instruction ID: 787d01638777dd8b72b537169d9a11e1a16f6815f76e7a930099747149fa1569
Opcode Fuzzy Hash: a2780b55b0967e9ad717de92a10b6c6a6cd00460d55c13b33b459266880e7ca9
Instruction Fuzzy Hash: 17A1F4B5E00208DBEB14CFE4D844B9EBBB9FF89304F208129E619AB394D7759945CF54

Function 6CDC7040 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 247pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 6CDC70A7
GetLastError.KERNEL32 ref: 6CDC70BC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 6CDC7109
GetLastError.KERNEL32 ref: 6CDC711E

Strings

, xrefs: 6CDC720B
, xrefs: 6CDC7312

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CreateErrorLastPipe
String ID: $
API String ID: 269057482-227171996
Opcode ID: a51509cdcd6c489f86354b7bd775885f4577445af34942864efe998ea691a228
Instruction ID: 60f443fc48f8899da423918ea0b6ddfea95038dc511ca50115af362350c1695d
Opcode Fuzzy Hash: a51509cdcd6c489f86354b7bd775885f4577445af34942864efe998ea691a228
Instruction Fuzzy Hash: B4B18CB0B002189BEB24CF64C95579EBBB9EF49304F1040BDD60D9B791DB795A84CF29

Function 6CDCCC50 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 227windowmemoryCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 6CDCCD7B
GlobalAlloc.KERNEL32(00000042,00000028), ref: 6CDCCDF9
GlobalLock.KERNEL32(00000000), ref: 6CDCCE06
GetStockObject.GDI32(0000000F), ref: 6CDCCE1E
GetDC.USER32(00000000), ref: 6CDCCE2F
SelectPalette.GDI32(00000000,00000000,00000000), ref: 6CDCCE42
RealizePalette.GDI32(00000000), ref: 6CDCCE4F
GetDIBits.GDI32(00000000,?,00000000,?,00000028,00000000,00000000), ref: 6CDCCE74
SelectPalette.GDI32(00000000,00000000,00000001), ref: 6CDCCE8A
RealizePalette.GDI32(00000000), ref: 6CDCCE94
ReleaseDC.USER32(00000000,00000000), ref: 6CDCCEA0
GlobalUnlock.KERNEL32(00000000), ref: 6CDCCF35
GlobalFree.KERNEL32(00000000), ref: 6CDCCF3F

Strings

(, xrefs: 6CDCCD81
DISPLAY, xrefs: 6CDCCC6C

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: GlobalPalette$ObjectRealizeSelect$AllocBitsFreeLockReleaseStockUnlock
String ID: ($DISPLAY
API String ID: 4021622762-216271742
Opcode ID: 96d930b94b5284b2c62cf0ef5c46817281f6484d59d421d957996a2483160853
Instruction ID: c69ba7741bf049234c773a4bc3c8f083f83e889f0484299df87ca9d32dd0e72c
Opcode Fuzzy Hash: 96d930b94b5284b2c62cf0ef5c46817281f6484d59d421d957996a2483160853
Instruction Fuzzy Hash: 80A1B2B4E002189FDB14CFA9D884BDEBBB9FF88304F208129EA19AB350D7759945CF51

Function 6CDED1F3 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6CDED237

Part of subcall function 6CDF0219: _free.LIBCMT ref: 6CDF0236
Part of subcall function 6CDF0219: _free.LIBCMT ref: 6CDF0248
Part of subcall function 6CDF0219: _free.LIBCMT ref: 6CDF025A
Part of subcall function 6CDF0219: _free.LIBCMT ref: 6CDF026C
Part of subcall function 6CDF0219: _free.LIBCMT ref: 6CDF027E
Part of subcall function 6CDF0219: _free.LIBCMT ref: 6CDF0290
Part of subcall function 6CDF0219: _free.LIBCMT ref: 6CDF02A2
Part of subcall function 6CDF0219: _free.LIBCMT ref: 6CDF02B4
Part of subcall function 6CDF0219: _free.LIBCMT ref: 6CDF02C6
Part of subcall function 6CDF0219: _free.LIBCMT ref: 6CDF02D8
Part of subcall function 6CDF0219: _free.LIBCMT ref: 6CDF02EA
Part of subcall function 6CDF0219: _free.LIBCMT ref: 6CDF02FC
Part of subcall function 6CDF0219: _free.LIBCMT ref: 6CDF030E

_free.LIBCMT ref: 6CDED22C

Part of subcall function 6CDE99A9: HeapFree.KERNEL32(00000000,00000000,?,6CDF03AA,6CDDA587,00000000,6CDDA587,?,?,6CDF03D1,6CDDA587,00000007,6CDDA587,?,6CDED38B,6CDDA587), ref: 6CDE99BF
Part of subcall function 6CDE99A9: GetLastError.KERNEL32(6CDDA587,?,6CDF03AA,6CDDA587,00000000,6CDDA587,?,?,6CDF03D1,6CDDA587,00000007,6CDDA587,?,6CDED38B,6CDDA587,6CDDA587), ref: 6CDE99D1

_free.LIBCMT ref: 6CDED24E
_free.LIBCMT ref: 6CDED263
_free.LIBCMT ref: 6CDED26E
_free.LIBCMT ref: 6CDED290
_free.LIBCMT ref: 6CDED2A3
_free.LIBCMT ref: 6CDED2B1
_free.LIBCMT ref: 6CDED2BC
_free.LIBCMT ref: 6CDED2F4
_free.LIBCMT ref: 6CDED2FB
_free.LIBCMT ref: 6CDED318
_free.LIBCMT ref: 6CDED330

Strings

(7l, xrefs: 6CDED209

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: (7l
API String ID: 161543041-474830763
Opcode ID: 639672c489d1a7d916833241796462f78419e5fd7577c68ca4cfc58fa62456fb
Instruction ID: 1e7a6ed5f5f4d25c094ea0b7c5cd2c041d1a00d772bf80c4bd133c5d1f0627bd
Opcode Fuzzy Hash: 639672c489d1a7d916833241796462f78419e5fd7577c68ca4cfc58fa62456fb
Instruction Fuzzy Hash: 57315A71605605EFEB218B79DC40B8AB3E8FF88358F205519E468D7AB0DF72E8448725

Function 6CDC8230 Relevance: 24.1, APIs: 16, Instructions: 131synchronizationthreadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00002710,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC824D
SetEvent.KERNEL32(?,00002710,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC8269
SetEvent.KERNEL32(?,00002710,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC8285
SetEvent.KERNEL32(?,00002710,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC82A1
WaitForSingleObject.KERNEL32(?,000003E8,00002710,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC82C2
TerminateThread.KERNEL32(?,00000000,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC82DB
CloseHandle.KERNEL32(?,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC82EB
WaitForSingleObject.KERNEL32(?,000003E8,00002710,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC830C
TerminateThread.KERNEL32(?,00000000,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC8325
CloseHandle.KERNEL32(?,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC8335
CloseHandle.KERNEL32(?,00002710,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC8351
CloseHandle.KERNEL32(?,00002710,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC836D
CloseHandle.KERNEL32(?,00002710,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC8389
CloseHandle.KERNEL32(?,00002710,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC83A5
CloseHandle.KERNEL32(?,00002710,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC83C1
CloseHandle.KERNEL32(?,00002710,?,6CDC7E2F,00002710,?,6CDC7A4F,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC83DD

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CloseHandle$Event$ObjectSingleTerminateThreadWait
String ID:
API String ID: 1594280071-0
Opcode ID: 35731d590245691e84e2ae4684ee2bfd956f600aa5fafb316396223d9aeb8118
Instruction ID: 876ed0d3a31e1b33841e16a120639a7dcfef8da10e6cca4c99d14f14fa954622
Opcode Fuzzy Hash: 35731d590245691e84e2ae4684ee2bfd956f600aa5fafb316396223d9aeb8118
Instruction Fuzzy Hash: 3A61D674641108EFDB04CB90D58CFEDB3B6BB48309F3446A8E5199B792C775AE82DB80

Function 6CDCAB40 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 332COMMON

Download Yara Rule

APIs

EnumDisplaySettingsA.USER32(00000000,000000FF,?), ref: 6CDCAC51

Strings

(, xrefs: 6CDCADD6
DISPLAY, xrefs: 6CDCAC20
6, xrefs: 6CDCAEEC

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: DisplayEnumSettings
String ID: ($6$DISPLAY
API String ID: 3434046153-2676095719
Opcode ID: 3eb19e57366e75cfa6b5729c83bd4525574193d7a4cb612da4b2db0230faf57c
Instruction ID: 4de505bf2df0dcd712cd96d8fa57531cd932d4e977050625b17ac59d3275ef29
Opcode Fuzzy Hash: 3eb19e57366e75cfa6b5729c83bd4525574193d7a4cb612da4b2db0230faf57c
Instruction Fuzzy Hash: 0FE125B4E002199BDB24CF65CC85BDEB7B8AF58304F1081E9E65CA7650E7709E85CF91

Function 6CDD9740 Relevance: 18.1, APIs: 12, Instructions: 142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000048,EBE653FE,00000000,?,6CDD9ACD,00000001), ref: 6CDD976F
LeaveCriticalSection.KERNEL32(?), ref: 6CDD9786
EnterCriticalSection.KERNEL32(?), ref: 6CDD9793
LeaveCriticalSection.KERNEL32(?), ref: 6CDD9866
DeleteCriticalSection.KERNEL32(?), ref: 6CDD988A
DeleteCriticalSection.KERNEL32(?), ref: 6CDD9897
DeleteCriticalSection.KERNEL32(?), ref: 6CDD98A4
DeleteCriticalSection.KERNEL32(?), ref: 6CDD98B4
DeleteCriticalSection.KERNEL32(?), ref: 6CDD98C4
DeleteCriticalSection.KERNEL32(?), ref: 6CDD98D3
CloseHandle.KERNEL32(?), ref: 6CDD98E0
CloseHandle.KERNEL32(?), ref: 6CDD98ED

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Delete$CloseEnterHandleLeave
String ID:
API String ID: 547864322-0
Opcode ID: d92b77d799a36fe69ec0482de33277333a77fe2edc368078ec5d6b54fb30bc8e
Instruction ID: a3f95e863a08539642b8d26d001789fe2d92541933c413b55d0f6116aa1685de
Opcode Fuzzy Hash: d92b77d799a36fe69ec0482de33277333a77fe2edc368078ec5d6b54fb30bc8e
Instruction Fuzzy Hash: C25139B4A0021ADFDF04DFA8DC94ABFB779BF45308F104619E422ABB91CB35A405CB65

Function 6CDD9B70 Relevance: 15.1, APIs: 10, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 6CDD9D30: EnterCriticalSection.KERNEL32(-00000048,?,?,6CDD9B89,6CDCDD1A,?,00000010,00000002), ref: 6CDD9D41
Part of subcall function 6CDD9D30: LeaveCriticalSection.KERNEL32(-00000048,?,6CDD9B89,6CDCDD1A,?,00000010,00000002), ref: 6CDD9D5F

EnterCriticalSection.KERNEL32(-00000078,?,?,6CDCDD1A,?,00000010,00000002), ref: 6CDD9BB8
LeaveCriticalSection.KERNEL32(-00000078), ref: 6CDD9CAC

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 18e80323893dd72ff22c35e7392824682fb08c2de54e00189609b1fb0b95ee32
Instruction ID: c823dcda3ff4f4baa5be4e4135eba1f11c71fb23fd9204050b71d71a50c146ae
Opcode Fuzzy Hash: 18e80323893dd72ff22c35e7392824682fb08c2de54e00189609b1fb0b95ee32
Instruction Fuzzy Hash: 163199B0B00208EFDB04DBB8E954FAE7BB9FB9630DF104519E4159B751CB36A418CBA4

Function 6CDE95C2 Relevance: 15.1, APIs: 10, Instructions: 70COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6CDE95D8

Part of subcall function 6CDE99A9: HeapFree.KERNEL32(00000000,00000000,?,6CDF03AA,6CDDA587,00000000,6CDDA587,?,?,6CDF03D1,6CDDA587,00000007,6CDDA587,?,6CDED38B,6CDDA587), ref: 6CDE99BF
Part of subcall function 6CDE99A9: GetLastError.KERNEL32(6CDDA587,?,6CDF03AA,6CDDA587,00000000,6CDDA587,?,?,6CDF03D1,6CDDA587,00000007,6CDDA587,?,6CDED38B,6CDDA587,6CDDA587), ref: 6CDE99D1

_free.LIBCMT ref: 6CDE95E4
_free.LIBCMT ref: 6CDE95EF
_free.LIBCMT ref: 6CDE95FA
_free.LIBCMT ref: 6CDE9605
_free.LIBCMT ref: 6CDE9610
_free.LIBCMT ref: 6CDE961B
_free.LIBCMT ref: 6CDE9626
_free.LIBCMT ref: 6CDE9631
_free.LIBCMT ref: 6CDE963F

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0d9ddbf12ffc119118f743e0ad67a0f35845041ab24e3aed87dee8b00e1673ca
Instruction ID: e2db9c4133f2bfd015c0f4fbc86539f7943801d0db636f5e513c6d286c9ed572
Opcode Fuzzy Hash: 0d9ddbf12ffc119118f743e0ad67a0f35845041ab24e3aed87dee8b00e1673ca
Instruction Fuzzy Hash: 2621D676911108EFCB01DF95DC80DDE7BB8FF88204F0091A6E6199B631DB72EA48CB91

Function 6CDD11D0 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 305COMMON

Download Yara Rule

APIs

_swprintf.LIBCMTD ref: 6CDD1529
_memcpy_s.LIBCPMTD ref: 6CDD15AB

Part of subcall function 6CDD9B70: EnterCriticalSection.KERNEL32(-00000090), ref: 6CDD9BEC
Part of subcall function 6CDD9B70: SetEvent.KERNEL32(?), ref: 6CDD9BFB
Part of subcall function 6CDD9B70: LeaveCriticalSection.KERNEL32(-00000090,00000010), ref: 6CDD9C1E

_memcpy_s.LIBCPMTD ref: 6CDD12F9

Part of subcall function 6CDD9B70: EnterCriticalSection.KERNEL32(-00000078,?,?,6CDCDD1A,?,00000010,00000002), ref: 6CDD9BB8
Part of subcall function 6CDD9B70: LeaveCriticalSection.KERNEL32(-00000078), ref: 6CDD9CAC

Part of subcall function 6CDD5400: EnterCriticalSection.KERNEL32(?), ref: 6CDD5418
Part of subcall function 6CDD5400: LeaveCriticalSection.KERNEL32(?,0000001E), ref: 6CDD5445

_swprintf.LIBCMTD ref: 6CDD1277

Part of subcall function 6CDC5C90: __vswprintf_s_l.LIBCONCRTD ref: 6CDC5CAE

Part of subcall function 6CDCEFD0: lstrcatA.KERNEL32(00000000,00000000,?,6CDCF449), ref: 6CDCEFEC

_memcpy_s.LIBCPMTD ref: 6CDD14A6

Strings

TwoPipeShell [%d] Create Error!, xrefs: 6CDD1518
TwoPipeShell [%d] Create Error! It's Already Exists!, xrefs: 6CDD1266

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave_memcpy_s$_swprintf$Event__vswprintf_s_llstrcat
String ID: TwoPipeShell [%d] Create Error!$TwoPipeShell [%d] Create Error! It's Already Exists!
API String ID: 3699697941-232176239
Opcode ID: 3dee85c900c7530c2174dd0636183481c91da27bada5cdca03bdcf3b284aa3fd
Instruction ID: 2712f33dd930104b36dcc98b86e07b483579a237e40d79f2e0c62ffb466ade9c
Opcode Fuzzy Hash: 3dee85c900c7530c2174dd0636183481c91da27bada5cdca03bdcf3b284aa3fd
Instruction Fuzzy Hash: 1AD13EB5A002189FDB14DF54CC91BDAB376FF88304F104599E9099B7A0DB32AE95CFA1

Function 6CDD0640 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 267stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000,00000021,?,?,EBE653FE), ref: 6CDD06D3
_memcpy_s.LIBCPMTD ref: 6CDD079E
_memcpy_s.LIBCPMTD ref: 6CDD0810
_memcpy_s.LIBCPMTD ref: 6CDD0842

Part of subcall function 6CDC6800: FormatMessageA.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 6CDC685D

Part of subcall function 6CDCEFD0: lstrcatA.KERNEL32(00000000,00000000,?,6CDCF449), ref: 6CDCEFEC

_swprintf.LIBCMTD ref: 6CDD08BF
_memcpy_s.LIBCPMTD ref: 6CDD0941

Strings

Download [%S] error! Is running Download, xrefs: 6CDD08AE

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: _memcpy_s$FormatMessage_swprintflstrcatlstrlen
String ID: Download [%S] error! Is running Download
API String ID: 1768301414-4225480886
Opcode ID: 8ecddcb21d754c507057c3051793e7cb2f99e27555b6e4eb6db27a2acd097398
Instruction ID: f827334de98ff4eae8db5dd06ede1e7b5e988e645b90e7d2b0cf75176f139331
Opcode Fuzzy Hash: 8ecddcb21d754c507057c3051793e7cb2f99e27555b6e4eb6db27a2acd097398
Instruction Fuzzy Hash: F8B141B5A002089FDB04DF54CC91FAAB376FF89304F148598E9199B791DB32AE54CFA1

Function 6CDD1FE0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 188fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(0000FFEF,?,00000008,0000FFEF,00000000), ref: 6CDD203B
SetFilePointerEx.KERNEL32(00000008,?,?,6CDD2382,00000001), ref: 6CDD2077
SetFilePointerEx.KERNEL32(00000008,?,?,6CDD2382,00000001), ref: 6CDD20A9
ReadFile.KERNEL32(00000000,6CE04548,?,00000000,00000000), ref: 6CDD212A

Strings

$8l, xrefs: 6CDD20C8
fkpioefpoea$@^Tf0-0-gepwf09IJGEJ0IFAPKO456SG894E, xrefs: 6CDD219F
$8l, xrefs: 6CDD2168

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: File$PointerRead
String ID: $8l$$8l$fkpioefpoea$@^Tf0-0-gepwf09IJGEJ0IFAPKO456SG894E
API String ID: 3154509469-3171088924
Opcode ID: 2638eae6ddc648f3abbf81b84d255e44acb354295f4b2896a3a309f0d4b6a471
Instruction ID: 3dd74927ead999c24b52fd43d5d166a1498bb6db6a360f8d3cb02955b084b136
Opcode Fuzzy Hash: 2638eae6ddc648f3abbf81b84d255e44acb354295f4b2896a3a309f0d4b6a471
Instruction Fuzzy Hash: 4C8108B5E00209EFDB04CFD8D985AEEBBB5BF88308F208219E515B7754D735A945CBA0

Function 6CDD2230 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 188fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000), ref: 6CDD2283
GetLastError.KERNEL32 ref: 6CDD2292

Part of subcall function 6CDC6800: FormatMessageA.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 6CDC685D

SetFilePointerEx.KERNEL32(000000FF,?,?,?,00000002), ref: 6CDD22D6
SetFilePointerEx.KERNEL32(000000FF,?,?,00000000,00000000), ref: 6CDD22EC
CloseHandle.KERNEL32(000000FF), ref: 6CDD247B

Strings

GetDecodeLog Error !, xrefs: 6CDD23DC

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: File$Pointer$CloseCreateErrorFormatHandleLastMessage
String ID: GetDecodeLog Error !
API String ID: 2400116906-3583251517
Opcode ID: c106fdf91c1337fd2aa68e5a7cb95779dbbdb893abd13d735609159a52776d3d
Instruction ID: 10528e866a3da55c6575a76c246f4541c9a9c3b3a005417eae6d876ce1fb320b
Opcode Fuzzy Hash: c106fdf91c1337fd2aa68e5a7cb95779dbbdb893abd13d735609159a52776d3d
Instruction Fuzzy Hash: E38105B1E00209DBDB04CF98D888BEEBBB5FF48308F148219E515A7791D775A945CFA1

Function 6CDC6460 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 113libraryloaderCOMMON

Download Yara Rule

APIs

std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 6CDC6473
LoadLibraryA.KERNEL32(Kernel32.dll), ref: 6CDC64B0
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 6CDC65C0
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 6CDC65D1

Strings

Wow64RevertWow64FsRedirection, xrefs: 6CDC65C9, 6CDC65CC
Kernel32.dll, xrefs: 6CDC64AC, 6CDC64AF
Wow64DisableWow64FsRedirection, xrefs: 6CDC65B8, 6CDC65BB

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: AddressProc$Iterator_baseIterator_base::_LibraryLoadstd::_
String ID: Kernel32.dll$Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection
API String ID: 4189866332-1575494070
Opcode ID: 844d1ebeb4f5173d365654c8726589fe8cb83cc4234850d0d5a14add93d57ec4
Instruction ID: 97499ecb6b3aa00040aee3d0cdf7c079fb2e24bf209bc39dd1245a66a3e39d3a
Opcode Fuzzy Hash: 844d1ebeb4f5173d365654c8726589fe8cb83cc4234850d0d5a14add93d57ec4
Instruction Fuzzy Hash: 3C617D20D0C2C8D9EB12C7E8D5487DEBFB65F26748F084099D5887B282C7BB1659C77A

Function 6CDCB4A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDCB0C0: DeleteObject.GDI32(00000000), ref: 6CDCB129

WaitForSingleObject.KERNEL32(?,00000001), ref: 6CDCB4DD

Strings

./img_src/QScreen_%d.bmp, xrefs: 6CDCB5B2

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: Object$DeleteSingleWait
String ID: ./img_src/QScreen_%d.bmp
API String ID: 1609116822-2525806235
Opcode ID: 1f98cf342bed310e66ccdf9c0093fe9c9902d734bbb0ac39191debfb27661d11
Instruction ID: 7304c81f512702decfda8c158aaa96f2038cc9f2d267d49a21a8d99e736d446a
Opcode Fuzzy Hash: 1f98cf342bed310e66ccdf9c0093fe9c9902d734bbb0ac39191debfb27661d11
Instruction Fuzzy Hash: BF3139B0748214EBDB54CB65D880BAA7379BB59308F100198E6C59B7E0DB72EDC1CF55

Function 6CDC2D00 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73stringprocessCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32(00000044), ref: 6CDC2D44
lstrcatW.KERNEL32(?,cmd.exe /c ), ref: 6CDC2D9F
lstrcatW.KERNEL32(?,?), ref: 6CDC2DB0
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CDC2DD9
GetLastError.KERNEL32 ref: 6CDC2DF5

Strings

D, xrefs: 6CDC2D33
cmd.exe /c , xrefs: 6CDC2D93

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: lstrcat$CreateErrorInfoLastProcessStartup
String ID: D$cmd.exe /c
API String ID: 3475696678-3768262801
Opcode ID: bd6bcc57c2415ccd77afd7093fb091577c294806958cd3d2832c698a925bb1c5
Instruction ID: c7c617f7d569daf6a7b31e5707efe88cc456eaa891b0a7933b59657d46d6b645
Opcode Fuzzy Hash: bd6bcc57c2415ccd77afd7093fb091577c294806958cd3d2832c698a925bb1c5
Instruction Fuzzy Hash: 553151F0B04258ABEB20CF60CC45BDD7779EB49704F1044D9E719A7281EBB56A84CF6A

Function 6CDC80E0 Relevance: 12.1, APIs: 8, Instructions: 98threadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00002710,?,6CDC7A57,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC80EF
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,6CDC7A57,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC8106
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,6CDC7A57,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC811D
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,6CDC7A57,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC8134
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,6CDC7A57,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC814B
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,6CDC7A57,?,?,6CDC8695,6CDCDA21,?,?,6CDCDA21,00002710), ref: 6CDC8162
CreateThread.KERNEL32(00000000,00000000,6CDC8460,00002710,00000000,00000000), ref: 6CDC8182
CreateThread.KERNEL32(00000000,00000000,6CDC8450,00002710,00000000,00000000), ref: 6CDC81A2

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: Create$Event$Thread
String ID:
API String ID: 2525963256-0
Opcode ID: 7b20de3deb91d227fa0c0b67060c0a26ff17f030fb5a7bae509172e565ecbcdf
Instruction ID: 9b90c620ec748bbb3d54178c981d93fb5ee496e3e5a06f39648b2abbbd8b2d39
Opcode Fuzzy Hash: 7b20de3deb91d227fa0c0b67060c0a26ff17f030fb5a7bae509172e565ecbcdf
Instruction Fuzzy Hash: 1B41C574781204FFEB10CB90DD4AFA9B3B6AB04706F3001A9EA096F6D1D7B12E81DB55

Function 6CDD95F0 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,EBE653FE,00000000,6CDCDB18,6CDF5A9E,000000FF,?,6CDD99A4,6CDCDB18), ref: 6CDD9661
InitializeCriticalSection.KERNEL32(?,?,6CDD99A4,6CDCDB18), ref: 6CDD966E
InitializeCriticalSection.KERNEL32(?,?,6CDD99A4,6CDCDB18), ref: 6CDD967B
InitializeCriticalSection.KERNEL32(?,?,6CDD99A4,6CDCDB18), ref: 6CDD968B
InitializeCriticalSection.KERNEL32(?,?,6CDD99A4,6CDCDB18), ref: 6CDD969A
InitializeCriticalSection.KERNEL32(?,?,6CDD99A4,6CDCDB18), ref: 6CDD96AA
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,6CDD99A4,6CDCDB18), ref: 6CDD96F4
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,6CDD99A4,6CDCDB18), ref: 6CDD9708

Part of subcall function 6CDD9CD0: EnterCriticalSection.KERNEL32(-0000005E,?,?,6CDD9720,6CDCDB18,?,6CDD99A4,6CDCDB18), ref: 6CDD9CDE
Part of subcall function 6CDD9CD0: LeaveCriticalSection.KERNEL32(-0000005E,?,6CDD9720,6CDCDB18,?,6CDD99A4,6CDCDB18), ref: 6CDD9CF4

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Initialize$CreateEvent$EnterLeave
String ID:
API String ID: 465080375-0
Opcode ID: 0f27bd0097d0c56c8bdf31f71ee96f1dca921777d999b4e951defed5d0042080
Instruction ID: ed997ea473404a59a87aafdb0cdda0c8d36e015528e69d6937893077d7ac7f32
Opcode Fuzzy Hash: 0f27bd0097d0c56c8bdf31f71ee96f1dca921777d999b4e951defed5d0042080
Instruction Fuzzy Hash: 164149B4A0021A9FDB14CFA8CC94FAEB775FF45318F104A59E526AB7C1CB75A801CB64

Function 6CDD26F0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 253COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 6CDD28EA
_memcpy_s.LIBCPMTD ref: 6CDD2849

Part of subcall function 6CDCEFD0: lstrcatA.KERNEL32(00000000,00000000,?,6CDCF449), ref: 6CDCEFEC

_memcpy_s.LIBCPMTD ref: 6CDD298B

Strings

Screen Start error!, xrefs: 6CDD27E3
Screen Start With XOR error!, xrefs: 6CDD2884
Screen Start error, Class is NULL!, xrefs: 6CDD2925

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: _memcpy_s$lstrcat
String ID: Screen Start With XOR error!$Screen Start error!$Screen Start error, Class is NULL!
API String ID: 3156544786-2901572510
Opcode ID: 1917839f3258c842a6c40e45019cd46af37dd0407bf7addb401c90ec4a22c2b5
Instruction ID: 8563cacf0917ce3ab93135f6222fc1e367287eb2cfa7ac155775657952575925
Opcode Fuzzy Hash: 1917839f3258c842a6c40e45019cd46af37dd0407bf7addb401c90ec4a22c2b5
Instruction Fuzzy Hash: B3B15BB4A00209DFCB04DF68D890AEEB7B5FF49308F148659F8159B3A1DB31E955CBA0

Function 6CDE34D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6CDE34FB
___except_validate_context_record.LIBVCRUNTIME ref: 6CDE3503
_ValidateLocalCookies.LIBCMT ref: 6CDE3591
__IsNonwritableInCurrentImage.LIBCMT ref: 6CDE35BC
_ValidateLocalCookies.LIBCMT ref: 6CDE3611

Strings

csm, xrefs: 6CDE35A6

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e027b9cb145871593d77df1dd660f4bb2a9c6de46bef1738866fc7c3f23c9c04
Instruction ID: 4aee808aee5fe166e675ee203ad12bec9f1f6cfedf6a06bc57c971af3e588a15
Opcode Fuzzy Hash: e027b9cb145871593d77df1dd660f4bb2a9c6de46bef1738866fc7c3f23c9c04
Instruction Fuzzy Hash: C7415434E05209DBCF00CF69C884AAEBBF5AF49328F148155E9299B771D731D915CB90

Function 6CDC78A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,\\.\pipe\), ref: 6CDC78E3
lstrcatA.KERNEL32(?,0000005C), ref: 6CDC78F1
lstrcpyA.KERNEL32(?,\\.\pipe\), ref: 6CDC7905
lstrcatA.KERNEL32(?,pipe\), ref: 6CDC7919

Strings

\\.\pipe\, xrefs: 6CDC78DB, 6CDC78DE
pipe\, xrefs: 6CDC790B, 6CDC790E

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: lstrcatlstrcpy
String ID: \\.\pipe\$pipe\
API String ID: 3905823039-868360898
Opcode ID: 0b35af9af6e64d4d4aced2215bed1037e189fc099573aa1d49a84304a122b0e5
Instruction ID: a8df176a47f6938bdbbdaee191ff04416b97a62a7d9df65567682f4b0a3e884a
Opcode Fuzzy Hash: 0b35af9af6e64d4d4aced2215bed1037e189fc099573aa1d49a84304a122b0e5
Instruction Fuzzy Hash: DE41EEB4A00249DFDB04CF94C598BEFBBF5AF58304F2441A8E5086B391C77A6A45CBB5

Function 6CDE9A17 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 6CDE9A6D
ext-ms-, xrefs: 6CDE9A81

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 8d704fbde6091bad227e0a1ce78a5a2131fab613181b350ad7422d110527123e
Instruction ID: d68bd423579234e358c1993e04b9a86ce1cb5685e98146422365ecb1d6064107
Opcode Fuzzy Hash: 8d704fbde6091bad227e0a1ce78a5a2131fab613181b350ad7422d110527123e
Instruction Fuzzy Hash: FF21DB71B07631FBD721AB659CC0BCE3778AF4A764F150511ED65E7AA0E630E901C6D0

Function 6CDF03B8 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CDF0380: _free.LIBCMT ref: 6CDF03A5

_free.LIBCMT ref: 6CDF0406

Part of subcall function 6CDE99A9: HeapFree.KERNEL32(00000000,00000000,?,6CDF03AA,6CDDA587,00000000,6CDDA587,?,?,6CDF03D1,6CDDA587,00000007,6CDDA587,?,6CDED38B,6CDDA587), ref: 6CDE99BF
Part of subcall function 6CDE99A9: GetLastError.KERNEL32(6CDDA587,?,6CDF03AA,6CDDA587,00000000,6CDDA587,?,?,6CDF03D1,6CDDA587,00000007,6CDDA587,?,6CDED38B,6CDDA587,6CDDA587), ref: 6CDE99D1

_free.LIBCMT ref: 6CDF0411
_free.LIBCMT ref: 6CDF041C
_free.LIBCMT ref: 6CDF0470
_free.LIBCMT ref: 6CDF047B
_free.LIBCMT ref: 6CDF0486
_free.LIBCMT ref: 6CDF0491

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a27d45a320cfdaef14d7d4f740b74aae9e16b72bb56c33c5b9f1cb88268fc740
Instruction ID: afa85249c7b64c4965be372df485f93db6efeec81d256e1c5464ab9bd55af684
Opcode Fuzzy Hash: a27d45a320cfdaef14d7d4f740b74aae9e16b72bb56c33c5b9f1cb88268fc740
Instruction Fuzzy Hash: EA11B132501B44BBD760A7B0CC45FCB77DCBF04388F408814E6A9A7AB0CBA5B4094671

Function 6CDD1F40 Relevance: 10.6, APIs: 7, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 6CDD1F54
MapViewOfFile.KERNEL32(000000FF,00000006,00000000,00000000,00000000,?,6CDD2474,000000FF,00000000), ref: 6CDD1F69
GetFileSize.KERNEL32(000000FF,00000000,?,6CDD2474,000000FF,00000000), ref: 6CDD1F78
UnmapViewOfFile.KERNEL32(00000000,?,?,?,?,6CDD2474,000000FF,00000000), ref: 6CDD1FAB
CloseHandle.KERNEL32(000000FF,?,?,?,?,6CDD2474,000000FF,00000000), ref: 6CDD1FB5
SetFilePointer.KERNEL32(000000FF,6CDD2474,00000000,00000000,?,?,?,?,6CDD2474,000000FF,00000000), ref: 6CDD1FC7
SetEndOfFile.KERNEL32(000000FF,?,?,?,?,6CDD2474,000000FF,00000000), ref: 6CDD1FD1

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: File$View$CloseCreateHandleMappingPointerSizeUnmap
String ID:
API String ID: 2211241848-0
Opcode ID: 2ae008600de12144e561dc29da672a0ebef713a50b9593e3808b43e6fdf6fa2e
Instruction ID: 66063914bdcf789599260a9bda3cbf4e46c74af06181e71ff959bc8cf97429f7
Opcode Fuzzy Hash: 2ae008600de12144e561dc29da672a0ebef713a50b9593e3808b43e6fdf6fa2e
Instruction Fuzzy Hash: 7611ECB9A40208BBEF10DFA4DC45F9E7B78FB48700F108545FB15EB281D671AA018B54

Function 6CDC5720 Relevance: 9.3, APIs: 6, Instructions: 261sleepfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000005), ref: 6CDC5818
SetFilePointerEx.KERNEL32(000000FF,?,?,00000000,00000000), ref: 6CDC58B2
ReadFile.KERNEL32(000000FF,000000FF,00000000,00000000,00000000), ref: 6CDC5934
GetLastError.KERNEL32 ref: 6CDC593E
CloseHandle.KERNEL32(000000FF), ref: 6CDC595F

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: File$CloseErrorHandleLastPointerReadSleep
String ID:
API String ID: 4017491889-0
Opcode ID: adfdfe73fd784d19992194fdb8f51725a54ff5af1dda6481317814d46e439507
Instruction ID: 1480f38e2617427393ad6f2ae490da3ad62c3bac4bbf106b2f121b9373fe76b6
Opcode Fuzzy Hash: adfdfe73fd784d19992194fdb8f51725a54ff5af1dda6481317814d46e439507
Instruction Fuzzy Hash: CAC1F8B4E00219CFDB04CFD9C994BAEBBB6BF48314F208659D425AB790D774A942CF61

Function 6CDC9550 Relevance: 9.2, APIs: 6, Instructions: 222COMMON

Download Yara Rule

APIs

std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6CDC95B9
allocator.LIBCONCRTD ref: 6CDC960C
_Find_unchecked.LIBCPMTD ref: 6CDC96A4
_Find_unchecked.LIBCPMTD ref: 6CDC96B8
_Find_unchecked.LIBCPMTD ref: 6CDC9766

Part of subcall function 6CDC9400: _Deallocate.LIBCONCRTD ref: 6CDC9412

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: Find_unchecked$DeallocateMutex_baseMutex_base::~_allocatorstd::_
String ID:
API String ID: 565782535-0
Opcode ID: d62bbacb975abbd80a5b30e74483aa1233af9884f31577fcd89f8eab63e22884
Instruction ID: 983064919bd82d208c8b1c9a261992c16b75aff7a426461475009d47b78a1b33
Opcode Fuzzy Hash: d62bbacb975abbd80a5b30e74483aa1233af9884f31577fcd89f8eab63e22884
Instruction Fuzzy Hash: 8C91BCB5E04109EFCB04DFD4D890CEEB3BAEF89348B11465DD515AB764DB30AA05CBA1

Function 6CDED7F3 Relevance: 9.2, APIs: 6, Instructions: 168fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000001,00000020,?,?,?,?,?,?,?,?,6CDEDF89,00000008,00000001,00000020,0000002C), ref: 6CDED835
__fassign.LIBCMT ref: 6CDED8BF
__fassign.LIBCMT ref: 6CDED8DE
WriteFile.KERNEL32(?,00000020,00000000,?,00000000), ref: 6CDED92D
WriteFile.KERNEL32(?,6CDEDF89,00000001,?,00000000), ref: 6CDED967

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: FileWrite__fassign$Console
String ID:
API String ID: 3692784241-0
Opcode ID: c8d993dd3ad44c6e9811712495ddaa30f9c211e05d766f6e48869ddd700db0fc
Instruction ID: 1461d7906c7f1961439e621fcd0f39ad649d46846f52ac3582e99ad8307cf387
Opcode Fuzzy Hash: c8d993dd3ad44c6e9811712495ddaa30f9c211e05d766f6e48869ddd700db0fc
Instruction Fuzzy Hash: 99518CB2A00248AFDF00DFA8DC81AEEBBF8EF4D314F14412AE565E7651D7309945CB61

Function 6CDC7C10 Relevance: 9.1, APIs: 6, Instructions: 122pipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6CDC7C4B
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,6CDC87F7,?,00000000,0002BF20), ref: 6CDC7CCF

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CountNamedPeekPipeTick
String ID:
API String ID: 741616749-0
Opcode ID: 607dc3483fda248fd8e8206eedef4d61a447916969dae0abe8cb698496b42415
Instruction ID: d0f56d742cac891a843f64dc83b335ab13f2e3d140fe46fd07f568c55b4b3c75
Opcode Fuzzy Hash: 607dc3483fda248fd8e8206eedef4d61a447916969dae0abe8cb698496b42415
Instruction Fuzzy Hash: 34512B74A0021CEBCB26CF24C844FD9B3B9BB4D304F1241D8E5899B654CBB5AAC5DF61

Function 6CDE38AA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CDE36B4,6CDE28BA,6CDE23A9,?,6CDE25C6,?,00000001,?,?,00000001,?,6CE01620,0000000C,6CDE26BA), ref: 6CDE38B8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CDE38C6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CDE38DF
SetLastError.KERNEL32(00000000,6CDE25C6,?,00000001,?,?,00000001,?,6CE01620,0000000C,6CDE26BA,?,00000001,?), ref: 6CDE3931

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 722775b0082054691fffbebced8653149b9b75c0f936aa0577423a4ac82eab51
Instruction ID: 08b7d7ae34e2f94f4fd79815bd8743b8765ecab90fb6f3d64a50ba31aa6bc5b0
Opcode Fuzzy Hash: 722775b0082054691fffbebced8653149b9b75c0f936aa0577423a4ac82eab51
Instruction Fuzzy Hash: DC01753270EB11AEE72517B56C84BBA3678EB1E77C720032DE12097AF0EF1248155394

Function 6CDDA890 Relevance: 9.1, APIs: 6, Instructions: 55filethreadCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000002,00000000,00000002,00000080,00000000), ref: 6CDDA8B6
GetCurrentThreadId.KERNEL32 ref: 6CDDA8CB
GetCurrentProcessId.KERNEL32(000000FF,00000000,00000000,00000000,6CDDA820), ref: 6CDDA914
GetCurrentProcess.KERNEL32(00000000), ref: 6CDDA91B
MiniDumpWriteDump.DBGHELP(00000000), ref: 6CDDA922
CloseHandle.KERNEL32(000000FF), ref: 6CDDA92C

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: Current$DumpProcess$CloseCreateFileHandleMiniThreadWrite
String ID:
API String ID: 1764008985-0
Opcode ID: 01588b9ca5a6ecc8ac28b49ca7550316c3e6e59cadfdaefa1c9769887d3dbe35
Instruction ID: 2dfb3772dc79a4d0f9d9d1a6763f85651e3728306f14d91caaefae5d4c1e35a8
Opcode Fuzzy Hash: 01588b9ca5a6ecc8ac28b49ca7550316c3e6e59cadfdaefa1c9769887d3dbe35
Instruction Fuzzy Hash: D8111F70E40209EFEF00DFA0D849BAEBBB8FB09304F508119EA25A7680D7745545CF90

Function 6CDC2F40 Relevance: 9.0, APIs: 6, Instructions: 43fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000), ref: 6CDC2F61
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 6CDC2F73
CopyFileW.KERNEL32(00000000,?,?), ref: 6CDC2F86
GetLastError.KERNEL32 ref: 6CDC2F90
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 6CDC2FA3
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 6CDC2FB5

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: File$Attributes$CopyErrorLast
String ID:
API String ID: 2106489313-0
Opcode ID: 733250d87ea9ae963ecc856b1ccaca4732f68d151a48d254902f8de53575002c
Instruction ID: 587f204264dd6add9961f87f1e5c873c76f409d63ad3f553bd3a449b9c77611f
Opcode Fuzzy Hash: 733250d87ea9ae963ecc856b1ccaca4732f68d151a48d254902f8de53575002c
Instruction Fuzzy Hash: 1311D7B9604248FFDB00DFA4D858B9E7FB8BB49741F108188FE55D7340D6369A46CBA0

Function 6CDC2EC0 Relevance: 9.0, APIs: 6, Instructions: 41fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000), ref: 6CDC2EE1
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 6CDC2EF3
MoveFileW.KERNEL32(00000000,?), ref: 6CDC2F01
GetLastError.KERNEL32 ref: 6CDC2F0B
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 6CDC2F1E
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 6CDC2F30

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: File$Attributes$ErrorLastMove
String ID:
API String ID: 4019241439-0
Opcode ID: d4b12d95c75a7d81abf26faf56f2384962cb6f6566d5cf330f289effe37dc73a
Instruction ID: 67742af3b6dc00800aebaaff8c59535baaf53c98a1dc1057407096fe83c9bc2f
Opcode Fuzzy Hash: d4b12d95c75a7d81abf26faf56f2384962cb6f6566d5cf330f289effe37dc73a
Instruction Fuzzy Hash: 9A01E9B9604208FFDB10DFA4D449B9EBFB8BB49741F108188FE15D7340C6369585CBA0

Function 6CDC3070 Relevance: 9.0, APIs: 6, Instructions: 37fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000), ref: 6CDC3088
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 6CDC309A
DeleteFileW.KERNEL32(00000000), ref: 6CDC30A4
GetLastError.KERNEL32 ref: 6CDC30AE
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 6CDC30C1
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 6CDC30D3

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: File$Attributes$DeleteErrorLast
String ID:
API String ID: 2267219331-0
Opcode ID: 91041c4c82cb2602d89bfb1c860629fb503042c3b1ba109c625db226e2fb9d0c
Instruction ID: 29da0b43c6d68565b54ab906ad63cb4cb5b17018d9b74e9c5ac315b84d86cdc4
Opcode Fuzzy Hash: 91041c4c82cb2602d89bfb1c860629fb503042c3b1ba109c625db226e2fb9d0c
Instruction Fuzzy Hash: 470116B9A04208BBDB00DFA4D448A9EBF78BB49741F108188FE15D7340C6369686CBA0

Function 6CDCF000 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

Part of subcall function 6CDC1200: GetLogicalDriveStringsW.KERNEL32(00000100,?), ref: 6CDC1246
Part of subcall function 6CDC1200: GetDriveTypeW.KERNEL32(?), ref: 6CDC12BB
Part of subcall function 6CDC1200: GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 6CDC1307

Concurrency::task_options::get_scheduler.LIBCPMTD ref: 6CDCF078
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 6CDCF0BA
_swprintf.LIBCMTD ref: 6CDCF119

Part of subcall function 6CDC5C90: __vswprintf_s_l.LIBCONCRTD ref: 6CDC5CAE

_memcpy_s.LIBCPMTD ref: 6CDCF17B

Strings

%c:\, xrefs: 6CDCF10E

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: Drive$Affinity::operator!=Concurrency::details::Concurrency::task_options::get_schedulerDiskFreeHardwareLogicalSpaceStringsType__vswprintf_s_l_memcpy_s_swprintf
String ID: %c:\
API String ID: 2504515757-3142399695
Opcode ID: ec6990495a0a493a74fcd50cb762d14400c77d2768fa8ea6d8683bc6be17d267
Instruction ID: a408d17669a186ce6d7ef033e9d68d26514bf98c8b1a2d65536aa3471478e1af
Opcode Fuzzy Hash: ec6990495a0a493a74fcd50cb762d14400c77d2768fa8ea6d8683bc6be17d267
Instruction Fuzzy Hash: 86610C75A00209DFCB04DF94C890AEEB7B9FF48304F108559E416AB7A0DB35EE09CBA1

Function 6CDE891F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,6CDE88D0,?,?,6CDE8898,?,?), ref: 6CDE893F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CDE8952
FreeLibrary.KERNEL32(00000000,?,?,?,6CDE88D0,?,?,6CDE8898,?,?), ref: 6CDE8975

Strings

mscoree.dll, xrefs: 6CDE8938
CorExitProcess, xrefs: 6CDE894A

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b8c2cfd5e64ae62cf023924bb7f4db96db76995e97a17e3700427d56f8cc7e01
Instruction ID: f8993ea6d2511f91d66d43bd0fe8595590584cb259e0933ed77c149898a74248
Opcode Fuzzy Hash: b8c2cfd5e64ae62cf023924bb7f4db96db76995e97a17e3700427d56f8cc7e01
Instruction Fuzzy Hash: 6AF04F30A01518BFEF019BA5DC08B9EBFB8FF09715F500069FA15E2A60DB319A46CB91

Function 6CDEE355 Relevance: 7.7, APIs: 5, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6CDEE3D9
__alloca_probe_16.LIBCMT ref: 6CDEE49F
__freea.LIBCMT ref: 6CDEE50B

Part of subcall function 6CDEA5FF: HeapAlloc.KERNEL32(00000000,6CDDA587,?,?,6CDE212E,6CDDA587,?,6CDDA587,0001507C), ref: 6CDEA631

__freea.LIBCMT ref: 6CDEE514
__freea.LIBCMT ref: 6CDEE539

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: c8fdefa32a98e87d1bc93fa1c213803440fec1c7b01d4488aa4173e233138ac5
Instruction ID: 7ed7897348c04c3c5e95f5e86304dca5b6c264b861fd60dacf45dee3767be191
Opcode Fuzzy Hash: c8fdefa32a98e87d1bc93fa1c213803440fec1c7b01d4488aa4173e233138ac5
Instruction Fuzzy Hash: F851C272601616ABEB118F64CC44EEB3BA9EF88758F210168FD1897E60E731DD15C7E1

Function 6CDD4E50 Relevance: 7.6, APIs: 5, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,EBE653FE), ref: 6CDD4ED0
_DebugHeapAllocator.LIBCPMTD ref: 6CDD4EE2
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 6CDD4F2A
error_info_injector.LIBCPMTD ref: 6CDD4F96
LeaveCriticalSection.KERNEL32(?,?,?,00000004), ref: 6CDD4FB1

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Affinity::operator!=AllocatorConcurrency::details::DebugEnterHardwareHeapLeaveerror_info_injector
String ID:
API String ID: 176887040-0
Opcode ID: 14e1a135754d1f966993dea00ef83c7026e5e794cdd4d983f8ff84d9fe65e0d8
Instruction ID: 07afd466d1e4a52cb19d8624020172abc7af27ca3b30ccb0e24b615d4432df88
Opcode Fuzzy Hash: 14e1a135754d1f966993dea00ef83c7026e5e794cdd4d983f8ff84d9fe65e0d8
Instruction Fuzzy Hash: 3F51D5B0E04219EFDB04DFA4D891BEEBBB5FF48304F108129E511A77A0DB74A909CB61

Function 6CDD4C70 Relevance: 7.6, APIs: 5, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,EBE653FE), ref: 6CDD4CF0
_DebugHeapAllocator.LIBCPMTD ref: 6CDD4D02
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 6CDD4D4A
error_info_injector.LIBCPMTD ref: 6CDD4DB2
LeaveCriticalSection.KERNEL32(?,?,?,00000004), ref: 6CDD4DCD

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Affinity::operator!=AllocatorConcurrency::details::DebugEnterHardwareHeapLeaveerror_info_injector
String ID:
API String ID: 176887040-0
Opcode ID: 57e48dc58ffa0216b12d318317dfa761cad92aa10de2c3e97284becacd74bedc
Instruction ID: 6b8d016958733b7d393369d589cd7fb3e77a3746a14ff915eb54fc7e60f60a3c
Opcode Fuzzy Hash: 57e48dc58ffa0216b12d318317dfa761cad92aa10de2c3e97284becacd74bedc
Instruction Fuzzy Hash: B341C2B0E00209EFDB08DFA4D995BEEBBB5BF48304F104129E512A77A0DB746949CB61

Function 6CDD54C0 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,6CDD18F1,?,?,?,EBE653FE), ref: 6CDD54DC
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 6CDD5518
std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6CDD5527
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,?,?,00000004), ref: 6CDD5581
LeaveCriticalSection.KERNEL32(?,00000000,?,?,?,00000004,?,?,?,?,6CDD18F1,?,?,?,EBE653FE), ref: 6CDD5593

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Affinity::operator!=Concurrency::details::EnterHardwareMutex_baseMutex_base::~_std::_
String ID:
API String ID: 3020211749-0
Opcode ID: 8a8259e10709d0c0744cd4ef2756c93834453204860e9b4bcb3df52928d728b8
Instruction ID: 090204bc95b52ab925373ec5071b18ca121d10af30642dc4678786cb6543b747
Opcode Fuzzy Hash: 8a8259e10709d0c0744cd4ef2756c93834453204860e9b4bcb3df52928d728b8
Instruction Fuzzy Hash: 21210CB0E00109EBDB08DFD4D854FEEB7B5EF48309F104569E212A7790DB34AA49CBA0

Function 6CDD55B0 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(EBE652C2,?,?,?,?,?,6CDD1E39,EBE653FE,EBE653FE,EBE653FE), ref: 6CDD55CC
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 6CDD5608
std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6CDD5617
LeaveCriticalSection.KERNEL32(EBE652C2,?,EBE653FE,00000000,?,EBE653FE,EBE653FE,00000004), ref: 6CDD5671
LeaveCriticalSection.KERNEL32(EBE652C2,00000000,?,EBE653FE,EBE653FE,00000004,?,?,?,?,?,6CDD1E39,EBE653FE,EBE653FE,EBE653FE), ref: 6CDD5683

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Affinity::operator!=Concurrency::details::EnterHardwareMutex_baseMutex_base::~_std::_
String ID:
API String ID: 3020211749-0
Opcode ID: 8f25b166a96a07a5f76e86c1673f3a3f6faf97236697aafc309fe64e32989fac
Instruction ID: 72b192492c555f2f6c386175340654383f439dfebd9d3b55113868800816d17f
Opcode Fuzzy Hash: 8f25b166a96a07a5f76e86c1673f3a3f6faf97236697aafc309fe64e32989fac
Instruction Fuzzy Hash: FC211DB0E00109EBDB08DF94D854FEEBBB4EF49304F104169E612A7791DB34AA09CBA4

Function 6CDC2B90 Relevance: 7.6, APIs: 5, Instructions: 50filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 6CDC2BB0
SetFileTime.KERNEL32(000000FF,?,?,?), ref: 6CDC2BCF
GetLastError.KERNEL32 ref: 6CDC2BF1
CloseHandle.KERNEL32(000000FF), ref: 6CDC2C00
GetLastError.KERNEL32 ref: 6CDC2C08

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleTime
String ID:
API String ID: 1269242970-0
Opcode ID: d76bb3c8ccfa3520663851548d1a0278f99b50c2117862b342d8341fbea8b982
Instruction ID: a8998b190026fff6300270936b73157d76f3e03787254b6bdc09e276b7258dbc
Opcode Fuzzy Hash: d76bb3c8ccfa3520663851548d1a0278f99b50c2117862b342d8341fbea8b982
Instruction Fuzzy Hash: 41117074A08348AFDB11CFB4D849BDD7FB8AF19308F108298E951E76C0D675964ACB51

Function 6CDC6600 Relevance: 7.5, APIs: 5, Instructions: 49processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 6CDC6637
Process32First.KERNEL32(?,00000128), ref: 6CDC6651
CloseHandle.KERNEL32(?), ref: 6CDC666D
Process32Next.KERNEL32(?,00000128), ref: 6CDC6685
CloseHandle.KERNEL32(?), ref: 6CDC6696

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: dde9e25583804d6823fb7f0fa6f9e99677bbaf585030db92997a20ccf3be8ad5
Instruction ID: 94feefb4897bc81bb1ecdd3575b53d0d6f8b23ee1340801ba5d4a0ae02579c04
Opcode Fuzzy Hash: dde9e25583804d6823fb7f0fa6f9e99677bbaf585030db92997a20ccf3be8ad5
Instruction Fuzzy Hash: C1111571A50208EBDB20EF70D955BEEB7B8AB0D704F4041D9E609D7680DB30AA66CF91

Function 6CDF0317 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6CDF032F

Part of subcall function 6CDE99A9: HeapFree.KERNEL32(00000000,00000000,?,6CDF03AA,6CDDA587,00000000,6CDDA587,?,?,6CDF03D1,6CDDA587,00000007,6CDDA587,?,6CDED38B,6CDDA587), ref: 6CDE99BF
Part of subcall function 6CDE99A9: GetLastError.KERNEL32(6CDDA587,?,6CDF03AA,6CDDA587,00000000,6CDDA587,?,?,6CDF03D1,6CDDA587,00000007,6CDDA587,?,6CDED38B,6CDDA587,6CDDA587), ref: 6CDE99D1

_free.LIBCMT ref: 6CDF0341
_free.LIBCMT ref: 6CDF0353
_free.LIBCMT ref: 6CDF0365
_free.LIBCMT ref: 6CDF0377

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 481ac887ed7db7ea22f1379955a380609bc8de8049a683bbfa43d8db801709fa
Instruction ID: 02333d36ef7af1d7a8b0edfca8bd172b6d52c77df40d24100e28a51e905c6e9c
Opcode Fuzzy Hash: 481ac887ed7db7ea22f1379955a380609bc8de8049a683bbfa43d8db801709fa
Instruction Fuzzy Hash: 33F06271616B44EBCA10CB64F4C4C9B73F9FB553947651809F064D7E20C7B2F8908AE5

Function 6CDD1980 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

_swprintf.LIBCMTD ref: 6CDD1A35

Part of subcall function 6CDC5C90: __vswprintf_s_l.LIBCONCRTD ref: 6CDC5CAE

Part of subcall function 6CDCEFD0: lstrcatA.KERNEL32(00000000,00000000,?,6CDCF449), ref: 6CDCEFEC

_memcpy_s.LIBCPMTD ref: 6CDD1AB7
_memcpy_s.LIBCPMTD ref: 6CDD1C74

Part of subcall function 6CDD9B70: EnterCriticalSection.KERNEL32(-00000078,?,?,6CDCDD1A,?,00000010,00000002), ref: 6CDD9BB8
Part of subcall function 6CDD9B70: LeaveCriticalSection.KERNEL32(-00000078), ref: 6CDD9CAC

Part of subcall function 6CDD5460: EnterCriticalSection.KERNEL32(?), ref: 6CDD5478
Part of subcall function 6CDD5460: LeaveCriticalSection.KERNEL32(?,0000001E), ref: 6CDD54A5

Strings

TOnePipeShell [%d] Create Error! It's Already Exists!, xrefs: 6CDD1A24

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave_memcpy_s$__vswprintf_s_l_swprintflstrcat
String ID: TOnePipeShell [%d] Create Error! It's Already Exists!
API String ID: 1204231629-2958404492
Opcode ID: f6385eee31c04a047e12dc03d467b0ba50184640ab4cbd4a88ce00d7fd3d1fd2
Instruction ID: fe451609e7837ac8a43c027257e1081a6e77f1ad7b8832bc656bc30c5440bdde
Opcode Fuzzy Hash: f6385eee31c04a047e12dc03d467b0ba50184640ab4cbd4a88ce00d7fd3d1fd2
Instruction Fuzzy Hash: 83B10AB5A002189FCB15DF54CC91BAAB3B9FF48704F104599E9099B7A0DB31AF85CFA1

Function 6CDCF200 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 6CDCF392
_swprintf.LIBCMTD ref: 6CDCF3FE
_memcpy_s.LIBCPMTD ref: 6CDCF480

Part of subcall function 6CDCE880: EnterCriticalSection.KERNEL32(EBE653E6,00000000,?,6CDCF2A9,?,00000000,00000000,?,EBE653FE), ref: 6CDCE88E
Part of subcall function 6CDCE880: LeaveCriticalSection.KERNEL32(EBE653E6,?,6CDCF2A9,?,00000000,00000000,?,EBE653FE), ref: 6CDCE8A4

Part of subcall function 6CDC6800: FormatMessageA.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 6CDC685D

Part of subcall function 6CDCEFD0: lstrcatA.KERNEL32(00000000,00000000,?,6CDCF449), ref: 6CDCEFEC

Strings

Query [%S] error! Query is running, xrefs: 6CDCF3ED

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection_memcpy_s$EnterFormatLeaveMessage_swprintflstrcat
String ID: Query [%S] error! Query is running
API String ID: 1163548326-1242599298
Opcode ID: d67129f971030efb3b3f1eba192208feb8726278099a9e338bd5e6c6a543d3cd
Instruction ID: 26f1eaccfa6257b5cb3a01b47b6646c606c7781783a23b164570479726f44689
Opcode Fuzzy Hash: d67129f971030efb3b3f1eba192208feb8726278099a9e338bd5e6c6a543d3cd
Instruction Fuzzy Hash: 7E913EB5A002099FDB04DF64CC91BEEB3B6FF88304F104699E8159B790DB31AE55CBA1

Function 6CDD24A0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 6CDD1ED0: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 6CDD1EFD
Part of subcall function 6CDD1ED0: CloseHandle.KERNEL32(000000FF), ref: 6CDD1F10

_memcpy_s.LIBCPMTD ref: 6CDD2683

Part of subcall function 6CDD2230: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000), ref: 6CDD2283
Part of subcall function 6CDD2230: GetLastError.KERNEL32 ref: 6CDD2292

Part of subcall function 6CDCEFD0: lstrcatA.KERNEL32(00000000,00000000,?,6CDCF449), ref: 6CDCEFEC

_memcpy_s.LIBCPMTD ref: 6CDD25AD

Strings

Send keyboardData error, file is not exit! , xrefs: 6CDD25E8
Send keyboardData error, file is not exit!, xrefs: 6CDD2547

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CreateFile_memcpy_s$CloseErrorHandleLastlstrcat
String ID: Send keyboardData error, file is not exit!$Send keyboardData error, file is not exit!
API String ID: 1386899110-2965487200
Opcode ID: 230375f2b74d968314902cf25296b143e658b60b69f63531fd7ffd02b5379c6c
Instruction ID: 4dc06319e0152e12359a3e5dafa711e823df44c789ca9703ca7b960f58af7a8e
Opcode Fuzzy Hash: 230375f2b74d968314902cf25296b143e658b60b69f63531fd7ffd02b5379c6c
Instruction Fuzzy Hash: E3814AB5A00209DFCB04DF98D890EEEB7B5FF48318F148659E8159B3A1DB31E945CBA0

Function 6CDD1CF0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 6CDC5E10: EnterCriticalSection.KERNEL32(EBE653F6,EBE653FE,00000004,?), ref: 6CDC5E3A
Part of subcall function 6CDC5E10: WaitForSingleObject.KERNEL32(000000FF,000000FF), ref: 6CDC5E60
Part of subcall function 6CDC5E10: LeaveCriticalSection.KERNEL32(?), ref: 6CDC5E77

_swprintf.LIBCMTD ref: 6CDD1D86

Part of subcall function 6CDC5C90: __vswprintf_s_l.LIBCONCRTD ref: 6CDC5CAE

Part of subcall function 6CDCEFD0: lstrcatA.KERNEL32(00000000,00000000,?,6CDCF449), ref: 6CDCEFEC

_memcpy_s.LIBCPMTD ref: 6CDD1DF3
_memcpy_s.LIBCPMTD ref: 6CDD1E63

Strings

OnePipeShell [%d] Close error!, xrefs: 6CDD1D7B

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection_memcpy_s$EnterLeaveObjectSingleWait__vswprintf_s_l_swprintflstrcat
String ID: OnePipeShell [%d] Close error!
API String ID: 3217904910-2944261958
Opcode ID: e4ba52645dd56044d3d4369e6d3806a2a48ccc7a80f3ab5542f97a82d6f6ba56
Instruction ID: ba048ed0e1501a0214c3609c690d1fc28a728ec5a69b1933a50adf8da030d8a2
Opcode Fuzzy Hash: e4ba52645dd56044d3d4369e6d3806a2a48ccc7a80f3ab5542f97a82d6f6ba56
Instruction Fuzzy Hash: FC510DB4A00209DFDB04DF94C890FAEB7B5FF89308F108559E9159F7A5DB31A905CBA1

Function 6CDD29F0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 6CDD2AC2
_memcpy_s.LIBCPMTD ref: 6CDD2B63

Part of subcall function 6CDCEFD0: lstrcatA.KERNEL32(00000000,00000000,?,6CDCF449), ref: 6CDCEFEC

Strings

Screen Stop error!, xrefs: 6CDD2A5C
Screen Stop error, Class is NULL!, xrefs: 6CDD2AFD

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: _memcpy_s$lstrcat
String ID: Screen Stop error!$Screen Stop error, Class is NULL!
API String ID: 3156544786-797384994
Opcode ID: 0f36c8cd341d97d34779e2e5a212614df4f810458f3a434f0425d9f26d2bf044
Instruction ID: 966595b4fa1793d595451248b1d3e5804e775cdc133cdc508e24dc091b4b04cf
Opcode Fuzzy Hash: 0f36c8cd341d97d34779e2e5a212614df4f810458f3a434f0425d9f26d2bf044
Instruction Fuzzy Hash: 5D515AB4A00205DFDB04DF68D891EEEB7B5FF49308F108A59E8159B3A0DB31E955CBA0

Function 6CDD8EA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,EBE653FE), ref: 6CDD8ED4
_memcpy_s.LIBCPMTD ref: 6CDD8F79
LeaveCriticalSection.KERNEL32(?,?,?), ref: 6CDD8FB8

Strings

Deal output img error!, xrefs: 6CDD8F21

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave_memcpy_s
String ID: Deal output img error!
API String ID: 2615672426-2701914271
Opcode ID: 8736ed06052d27914f7e9e34e517181bf4fda042d87829740fad9dadbf92e63a
Instruction ID: c241c06be21fe7b9e60a624c52994acd0157cee202fd1789a073e32644d56e9d
Opcode Fuzzy Hash: 8736ed06052d27914f7e9e34e517181bf4fda042d87829740fad9dadbf92e63a
Instruction Fuzzy Hash: 00414E75A10148AFDB08CFA8DC90FEEB7BAFF48214F044619F515A7791DB31A905CBA4

Function 6CDE5A9A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6CDE5AC8
_free.LIBCMT ref: 6CDE5AEE

Strings

0l, xrefs: 6CDE5B55
@0l, xrefs: 6CDE5B07

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: _free
String ID: @0l$0l
API String ID: 269201875-1736274302
Opcode ID: ceef473eb37bcaae260a43c5f475f17a850dc3d3bdaf2c0f5f5cb887d3df4e6a
Instruction ID: 93a7e7bf1e3183df4f562f7586cd937664f451edd5589d4b3be5e89daf6bd432
Opcode Fuzzy Hash: ceef473eb37bcaae260a43c5f475f17a850dc3d3bdaf2c0f5f5cb887d3df4e6a
Instruction Fuzzy Hash: 7B110871B11210CBDB205B399C82FCA7775A749738F14131AE921CBAE0F7B1D85147C0

Function 6CDCD5E0 Relevance: 6.4, APIs: 5, Instructions: 145sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001), ref: 6CDCD605

Part of subcall function 6CDCDE10: EnterCriticalSection.KERNEL32(?,?,6CDCD7F9), ref: 6CDCDE26
Part of subcall function 6CDCDE10: LeaveCriticalSection.KERNEL32(?,?,6CDCD7F9), ref: 6CDCDE3E

EnterCriticalSection.KERNEL32(?), ref: 6CDCD6AF
LeaveCriticalSection.KERNEL32(?,00000000), ref: 6CDCD6D0
EnterCriticalSection.KERNEL32(?), ref: 6CDCD6E0

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$Leave$Sleep
String ID:
API String ID: 2452663664-0
Opcode ID: 4b4538e569982115c3fd32a39b1ab7c274445c6fc5b1c070a78553a372f93ef3
Instruction ID: b1a6f65d42fa1bcfd5cd532f0b2f141e8e48ebb9d22571a2ec87ae77813e45f8
Opcode Fuzzy Hash: 4b4538e569982115c3fd32a39b1ab7c274445c6fc5b1c070a78553a372f93ef3
Instruction Fuzzy Hash: 18513FB4E00109EFCB04CFD8D844AEEB7B9FF88304F148169E515AB351D735AA44CBA1

Function 6CDEACC0 Relevance: 6.3, APIs: 4, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6CDEAD47

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 5e6ba0af27dc66adfa9354b1179fd89244a3ffa8c59286eda5a176f6145826b5
Instruction ID: c559bb696e66496ddd5483ffc1b5042d11db861e5004315f01e9a32e1668d229
Opcode Fuzzy Hash: 5e6ba0af27dc66adfa9354b1179fd89244a3ffa8c59286eda5a176f6145826b5
Instruction Fuzzy Hash: ECB11471A052879FDB11CF68C8507EEBFF5EF49304F1581AAE8589BB61D7388906CB60

Function 6CDC54A0 Relevance: 6.1, APIs: 4, Instructions: 119fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?), ref: 6CDC5518
GetLastError.KERNEL32 ref: 6CDC5524

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 4a0f974021d391c5d3577ae8fa81abc9374c9f831e6fc4c93954bb644d94de0d
Instruction ID: 7839c2c06744b42324ab61499ad175e3595fd32262b616008b582d4edc63e883
Opcode Fuzzy Hash: 4a0f974021d391c5d3577ae8fa81abc9374c9f831e6fc4c93954bb644d94de0d
Instruction Fuzzy Hash: B051D6B4A0020ADFDB04CF98D990BAEB7B6FF8D304F208658E515A7790D735A941CFA1

Function 6CDC52A0 Relevance: 6.1, APIs: 4, Instructions: 89fileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(000000FF,?,000000FF,00000000,00000000), ref: 6CDC5310
WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 6CDC533B
GetLastError.KERNEL32 ref: 6CDC5345
CloseHandle.KERNEL32(?), ref: 6CDC5357

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: File$CloseErrorHandleLastPointerWrite
String ID:
API String ID: 2796458406-0
Opcode ID: 24783b588f8b7c176fd7fce63752465d1a6d957c2826b3d73974785034ab6eca
Instruction ID: a508d8ef29a1158e10a9c1078ec991a8184bc5c83c0aacceb6087e064b36908d
Opcode Fuzzy Hash: 24783b588f8b7c176fd7fce63752465d1a6d957c2826b3d73974785034ab6eca
Instruction Fuzzy Hash: EC41A9B4A00209DFCB04CF98C494B9EBBB5FF48314F108299E925AB391D771EA41CF95

Function 6CDE9708 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6CDE6141,?,?,?,?,6CDE7D32,?), ref: 6CDE970D
_free.LIBCMT ref: 6CDE9768
_free.LIBCMT ref: 6CDE979E
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,?,6CDE6141,?,?,?,?,6CDE7D32,?), ref: 6CDE97A9

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 3d1831859ca60387dca5579340e6373c670802711d22ded985e3ab43bcb0d155
Instruction ID: 98504a6d5d126116e1389d07185f7fb64d3ebfeeabd094c078aa3e774e784de1
Opcode Fuzzy Hash: 3d1831859ca60387dca5579340e6373c670802711d22ded985e3ab43bcb0d155
Instruction Fuzzy Hash: EA11A9B1307611BEEA013BB66CC4EDB35BCAB5E27DB201624F56496AB1DB914C1C4170

Function 6CDE9859 Relevance: 6.1, APIs: 4, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,6CDDA587,?,6CDE7998,6CDEA642,?,?,6CDE212E,6CDDA587,?,6CDDA587,0001507C), ref: 6CDE985E
_free.LIBCMT ref: 6CDE98B9
_free.LIBCMT ref: 6CDE98EF
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6CDDA587,?,6CDE7998,6CDEA642,?,?,6CDE212E,6CDDA587,?,6CDDA587,0001507C), ref: 6CDE98FA

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 91ed0e21f6641fc5eb9ea7fa7992b26aef113a3e07b23fe50222bca28bd303ba
Instruction ID: de3fe276fbcefafd777cdaaeeaf70640741aa9df7a3ef97196f6aab1eb6bc675
Opcode Fuzzy Hash: 91ed0e21f6641fc5eb9ea7fa7992b26aef113a3e07b23fe50222bca28bd303ba
Instruction Fuzzy Hash: B40188B1707201BAEA1127B55CC4EDB79BDAB5E37C7101235F52592AF1DB924C1581B0

Function 6CDE3B62 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 6CDE3B7C

Part of subcall function 6CDE3AC9: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 6CDE3AF8
Part of subcall function 6CDE3AC9: ___AdjustPointer.LIBCMT ref: 6CDE3B13

_UnwindNestedFrames.LIBCMT ref: 6CDE3B91
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 6CDE3BA2
CallCatchBlock.LIBVCRUNTIME ref: 6CDE3BCA

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 1d2cbf3fc5d85ee38127e2180f4d2801c9af14cf3da80acdaadcd3532b5d838e
Instruction ID: ad9848ba02c71b88631a613395e4424e2de57327ae2189f0c64c76a68a589731
Opcode Fuzzy Hash: 1d2cbf3fc5d85ee38127e2180f4d2801c9af14cf3da80acdaadcd3532b5d838e
Instruction Fuzzy Hash: CB01D332500148BBDF125F96CD41EEB7BA9EF8C758F044518FA18A6630C772E861DBA0

Function 6CDEC211 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105,6CE03F48), ref: 6CDEC23A
GetLastError.KERNEL32 ref: 6CDEC244
__dosmaperr.LIBCMT ref: 6CDEC24B
_mbstowcs.LIBCMT ref: 6CDEC260

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: ErrorFileLastModuleName__dosmaperr_mbstowcs
String ID:
API String ID: 2664030482-0
Opcode ID: 8ccfd428f5102ef04ab08e086118dfc2f1e0b69c17aa054a800e550ce2e6f4fe
Instruction ID: 73d7c2b4da4c52a61d3fa7f70831b4214b6e7fbea9104f347b4cf6f9f585ba96
Opcode Fuzzy Hash: 8ccfd428f5102ef04ab08e086118dfc2f1e0b69c17aa054a800e550ce2e6f4fe
Instruction Fuzzy Hash: B2F06D72A0020DABCF10DFA5DC49EDF7BBCEB59348F000459E619D7540EA709A558BA5

Function 6CDD1ED0 Relevance: 6.0, APIs: 4, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 6CDD1EFD
CloseHandle.KERNEL32(000000FF), ref: 6CDD1F10
GetLastError.KERNEL32 ref: 6CDD1F1F
GetLastError.KERNEL32 ref: 6CDD1F2C

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandle
String ID:
API String ID: 614986841-0
Opcode ID: ff74730eb56bc97493d37e8c3da902478c461a2abfdd4059c2ac30ff35ead0e7
Instruction ID: 7aa16cd124680402c08cf676908cb528a64c06b4b94ec2c4bbf91577af5188cd
Opcode Fuzzy Hash: ff74730eb56bc97493d37e8c3da902478c461a2abfdd4059c2ac30ff35ead0e7
Instruction Fuzzy Hash: F1011D75A40308FBDB10DFB4D849B8C7BB4FB05325F208245EA65AB6D0D770A641CB41

Function 6CDF1DCF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,0000002C,00000000,?,?,6CDF1583,?,00000001,?,00000001,?,6CDED9ED,00000020,00000000,00000001), ref: 6CDF1DE6
GetLastError.KERNEL32(?,6CDF1583,?,00000001,?,00000001,?,6CDED9ED,00000020,00000000,00000001,00000020,00000001,?,6CDEDF6E,00000008), ref: 6CDF1DF2

Part of subcall function 6CDF1DB8: CloseHandle.KERNEL32(FFFFFFFE,6CDF1E02,?,6CDF1583,?,00000001,?,00000001,?,6CDED9ED,00000020,00000000,00000001,00000020,00000001), ref: 6CDF1DC8

___initconout.LIBCMT ref: 6CDF1E02

Part of subcall function 6CDF1D7A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CDF1DA9,6CDF1569,00000001,?,6CDED9ED,00000020,00000000,00000001,00000020), ref: 6CDF1D8D

WriteConsoleW.KERNEL32(?,?,0000002C,00000000,?,6CDF1583,?,00000001,?,00000001,?,6CDED9ED,00000020,00000000,00000001,00000020), ref: 6CDF1E17

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b38144a2f0dbe5018660eb50085c417b1c8dd8846b0ee1834d29565cc34ba469
Instruction ID: f89d407443e0acbbb72af022d2e925dcc427b4041b7eec7b66664abbee944809
Opcode Fuzzy Hash: b38144a2f0dbe5018660eb50085c417b1c8dd8846b0ee1834d29565cc34ba469
Instruction Fuzzy Hash: 0EF0AC76640654BBCF221F96DC04ACE3F36FB4A3A6B094114FA2996930C732C9259BE0

Function 6CDE9146 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6CDE914F

Part of subcall function 6CDE99A9: HeapFree.KERNEL32(00000000,00000000,?,6CDF03AA,6CDDA587,00000000,6CDDA587,?,?,6CDF03D1,6CDDA587,00000007,6CDDA587,?,6CDED38B,6CDDA587), ref: 6CDE99BF
Part of subcall function 6CDE99A9: GetLastError.KERNEL32(6CDDA587,?,6CDF03AA,6CDDA587,00000000,6CDDA587,?,?,6CDF03D1,6CDDA587,00000007,6CDDA587,?,6CDED38B,6CDDA587,6CDDA587), ref: 6CDE99D1

_free.LIBCMT ref: 6CDE9162
_free.LIBCMT ref: 6CDE9173
_free.LIBCMT ref: 6CDE9184

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: cb0975accb1119e91522bdd5472b4f9eefc6d35b62aeaa39075d059593bf07f0
Instruction ID: b78f31ad707b06d39334806fd3835f48091a4d7cbb835032a5ce62e780f3ae99
Opcode Fuzzy Hash: cb0975accb1119e91522bdd5472b4f9eefc6d35b62aeaa39075d059593bf07f0
Instruction Fuzzy Hash: CBE0EC79B11AA29E9E12AF15EE004C93E32F7BA614301640FF42016720C7BB0536DFDA

Function 6CDE7CD2 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 6CDE7E3F

Strings

+, xrefs: 6CDE7D7A
-, xrefs: 6CDE7D6D

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 10c0253171a2ec4e6f472f94dc16206b29dc5e93729e83d4680e20ea9da39f78
Instruction ID: cdbc481e73a379b1ea44c8d7cc52f1ebffa5308b36507175d93f82e85c6f4dc0
Opcode Fuzzy Hash: 10c0253171a2ec4e6f472f94dc16206b29dc5e93729e83d4680e20ea9da39f78
Instruction Fuzzy Hash: E791C77090424AFEDF54CF69C4506EDBBB5EF0A328F168256E8B497BA2D33089058B61

Function 6CDE89C3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

H?l, xrefs: 6CDE8A06

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID: H?l
API String ID: 0-617157424
Opcode ID: 23b72a67afc0d4338f39f242450f2dc3809aab1de2e9f12e254a40eb8458dc3d
Instruction ID: 63c35ae111ea7047ff7f38f89889376d7bf90f1793cebbb8fe5277f724c4b8b4
Opcode Fuzzy Hash: 23b72a67afc0d4338f39f242450f2dc3809aab1de2e9f12e254a40eb8458dc3d
Instruction Fuzzy Hash: 22415E71E04764AFDB11DF9EDCC09DEBBB8EB8D314B10416BE80497660E7718A55CBA0

Function 6CDEB6B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6CDEB72D

Strings

dCl, xrefs: 6CDEB6FA
`Cl, xrefs: 6CDEB6E8

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: _free
String ID: `Cl$dCl
API String ID: 269201875-1368427432
Opcode ID: 9422df69a7965d7b7934e9982659c42c6f362d08f4c0d9d7a30be203fde8f364
Instruction ID: 77ad557a7b375b2bbb0a9fab2ee7c9ca42adfb4720074408848c7bd0d0f7035a
Opcode Fuzzy Hash: 9422df69a7965d7b7934e9982659c42c6f362d08f4c0d9d7a30be203fde8f364
Instruction Fuzzy Hash: 24119675505302EFE310AF2AD481B82B7F4EB4D758F20541EE589CBEA0E771F4448798

Function 6CDE297E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

h>l, xrefs: 6CDE29FA
\>l, xrefs: 6CDE29D9

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID:
String ID: \>l$h>l
API String ID: 0-3586915
Opcode ID: fb9d2daabb965b8a7ad64244d0eba6be517d17069719c6008181efd71d9731fc
Instruction ID: b1ca767e564db4b9bb9c30ced84d5e73045e5a0b9bbaedffc69c672ca37a1a66
Opcode Fuzzy Hash: fb9d2daabb965b8a7ad64244d0eba6be517d17069719c6008181efd71d9731fc
Instruction Fuzzy Hash: 3011E332E01716AACF00DF788805BCE77B55B0A72CF21425ADE11FBA90D37185058BE0

Function 6CDE2103 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 6CDE218A
___raise_securityfailure.LIBCMT ref: 6CDE2271

Strings

;lp;l, xrefs: 6CDE226C

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: ;lp;l
API String ID: 3761405300-2967272459
Opcode ID: 76a9edd060a83d5bb41906b0b221c906d89693e648e4b7f8a9100af111a726dc
Instruction ID: 8fee196e3eb21f01e4e568351ca2b47cc28dd10829659ddf4611e6905da072c0
Opcode Fuzzy Hash: 76a9edd060a83d5bb41906b0b221c906d89693e648e4b7f8a9100af111a726dc
Instruction Fuzzy Hash: FE2128B47813049ADB14CF29D185E40BBF0BB5E318F10441EE604CB390DBB299A1CFE4

Function 6CDC4D10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6CDC4D1D
std::_Xinvalid_argument.LIBCPMT ref: 6CDC4D3B

Part of subcall function 6CDE20D6: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6CDE20E2
Part of subcall function 6CDE20D6: __CxxThrowException@8.LIBVCRUNTIME ref: 6CDE20F0

Strings

list<T> too long, xrefs: 6CDC4D36

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: std::_$Exception@8Mutex_baseMutex_base::~_ThrowXinvalid_argumentstd::invalid_argument::invalid_argument
String ID: list<T> too long
API String ID: 2057655285-4027344264
Opcode ID: c9f287cf20f37714df57318bee88b8decbecfee6e3ee9e228ed4a9bfbaa7b5cb
Instruction ID: d2d8f643da1f1815c78df5635e1d0ba740f9efd17e0d9f0f7bb1bbb2df4af722
Opcode Fuzzy Hash: c9f287cf20f37714df57318bee88b8decbecfee6e3ee9e228ed4a9bfbaa7b5cb
Instruction Fuzzy Hash: A1F05831E04118AF8B08EFA8D9818DCBBB8AF08300B0042A9D80567B24DB30BE44CBD2

Function 6CDD7D10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6CDD7D1D
std::_Xinvalid_argument.LIBCPMT ref: 6CDD7D3B

Part of subcall function 6CDE20D6: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6CDE20E2
Part of subcall function 6CDE20D6: __CxxThrowException@8.LIBVCRUNTIME ref: 6CDE20F0

Strings

list<T> too long, xrefs: 6CDD7D36

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: std::_$Exception@8Mutex_baseMutex_base::~_ThrowXinvalid_argumentstd::invalid_argument::invalid_argument
String ID: list<T> too long
API String ID: 2057655285-4027344264
Opcode ID: 6d4ed3638c5ae685ad5ddbc38ddaded31e70bd28714d3fbdf1dbda035988bc6c
Instruction ID: 4525141f72fd8945508d385565d3fed578304331f2e7ce39ca55810939daec09
Opcode Fuzzy Hash: 6d4ed3638c5ae685ad5ddbc38ddaded31e70bd28714d3fbdf1dbda035988bc6c
Instruction Fuzzy Hash: 24F05831E04118EF8B08EFA8C9818DCBBB8AF08300B0142A9D80567B24DB30BE44CBD1

Function 6CDD3FD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6CDD3FDD
std::_Xinvalid_argument.LIBCPMT ref: 6CDD3FFB

Part of subcall function 6CDE20D6: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6CDE20E2
Part of subcall function 6CDE20D6: __CxxThrowException@8.LIBVCRUNTIME ref: 6CDE20F0

Strings

list<T> too long, xrefs: 6CDD3FF6

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: std::_$Exception@8Mutex_baseMutex_base::~_ThrowXinvalid_argumentstd::invalid_argument::invalid_argument
String ID: list<T> too long
API String ID: 2057655285-4027344264
Opcode ID: e0b73a14e70f9c11e861fcf42e486aa8e7570624ce519a44bc6bf41ad27c2bf5
Instruction ID: 3888133118effbfde4c03e92aa52c7186d26b3844a45d381202a04c682010ec0
Opcode Fuzzy Hash: e0b73a14e70f9c11e861fcf42e486aa8e7570624ce519a44bc6bf41ad27c2bf5
Instruction Fuzzy Hash: 8DF05831D04128AF8B08EFA8D9819DDBBB8AF08340B1182A9D80567B20DB30BE44CBD1

Function 6CDC20A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6CDC20AD
std::_Xinvalid_argument.LIBCPMT ref: 6CDC20CB

Part of subcall function 6CDE20D6: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6CDE20E2
Part of subcall function 6CDE20D6: __CxxThrowException@8.LIBVCRUNTIME ref: 6CDE20F0

Strings

list<T> too long, xrefs: 6CDC20C6

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: std::_$Exception@8Mutex_baseMutex_base::~_ThrowXinvalid_argumentstd::invalid_argument::invalid_argument
String ID: list<T> too long
API String ID: 2057655285-4027344264
Opcode ID: befe9dd3abdb9a183c4998c880bab710b3ed0d12791bfe6a2cf2c6c0dc396a88
Instruction ID: 65e219d95a9bbcbec4ea0f29eab66ae39bff0c4c04640fefaedd2fc4ff0a3557
Opcode Fuzzy Hash: befe9dd3abdb9a183c4998c880bab710b3ed0d12791bfe6a2cf2c6c0dc396a88
Instruction Fuzzy Hash: B4F05E31E05118AF8B08DFA8C9818DCBBB8AF04304F0042A5D80567B20DB307E44DBD1

Function 6CDCD8A0 Relevance: 5.2, APIs: 4, Instructions: 176sleepCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(-00014F25,?,?,?,?,EBE653FE,?,?,?,?,?,00000000,6CDF525F,000000FF,?,6CDDA61B), ref: 6CDCD963
InitializeCriticalSection.KERNEL32(-00014F3D,?,?,EBE653FE,?,?,?,?,?,00000000,6CDF525F,000000FF,?,6CDDA61B), ref: 6CDCD973
InitializeCriticalSection.KERNEL32(-00014F55,?,?,EBE653FE,?,?,?,?,?,00000000,6CDF525F,000000FF,?,6CDDA61B), ref: 6CDCD982
Sleep.KERNEL32(00000064,00002710,?,?,?,EBE653FE), ref: 6CDCDA3A

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalInitializeSection$Sleep
String ID:
API String ID: 1960909292-0
Opcode ID: 51994e7b6d3781a5c1fef0d4266b71e4249d4a2770071ef82d08d88df9841b40
Instruction ID: 283006201452a3d35989462a42a531a65240487dcd30c41dd2c004ec57d50b5d
Opcode Fuzzy Hash: 51994e7b6d3781a5c1fef0d4266b71e4249d4a2770071ef82d08d88df9841b40
Instruction Fuzzy Hash: 85816CB4A00209DFDB04DF94CC94BEEB7B9BF48308F104229E455AB7A0DB74A945CBA1

Function 6CDCE590 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDCE5B8
LeaveCriticalSection.KERNEL32(?), ref: 6CDCE5CE
EnterCriticalSection.KERNEL32(?), ref: 6CDCE600
LeaveCriticalSection.KERNEL32(?), ref: 6CDCE614

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4adf687b13f6a32cb5bf9d9c26976e39f4608cbbc3c12382226fd349e4987a5f
Instruction ID: e1608235e3972d259eb113dd5d3793debd82b252bbe9cdfc8b508daac51e3ec0
Opcode Fuzzy Hash: 4adf687b13f6a32cb5bf9d9c26976e39f4608cbbc3c12382226fd349e4987a5f
Instruction Fuzzy Hash: 241166B4E00209DFCF04DFB8E895AAEBBB5EF48304F104159EA05E7341D735AA44CBA5

Function 6CDCDE50 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6CDCD534), ref: 6CDCDE68
LeaveCriticalSection.KERNEL32(?,?,6CDCD534), ref: 6CDCDE86
EnterCriticalSection.KERNEL32(?,?,6CDCD534), ref: 6CDCDE96
LeaveCriticalSection.KERNEL32(?), ref: 6CDCDEC9

Memory Dump Source

Source File: 00000003.00000002.1655799969.000000006CDC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000003.00000002.1655787473.000000006CDC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655827033.000000006CDF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655842206.000000006CE03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1655855653.000000006CE06000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 791b428784e1ccfb4aab6107255ef299580db052e515131977e4c15b8c6e85c2
Instruction ID: 887ebf565d4064448687850363d29cdaede0102acae1a99141ab04af589866d5
Opcode Fuzzy Hash: 791b428784e1ccfb4aab6107255ef299580db052e515131977e4c15b8c6e85c2
Instruction Fuzzy Hash: 1F018174A00604EBDB14DBA4ED54FEEB779FF8830AF2041A8E605AB741C6359E149AA4

Analysis Process: rundll32.exePID: 7116, Parent PID: 6764COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1623
Total number of Limit Nodes:	23

Executed Functions

Function 6D06A720 Relevance: 4.5, APIs: 3, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(00000000), ref: 6D06A742
CommandLineToArgvW.SHELL32(00000000), ref: 6D06A749

Part of subcall function 6D06A450: SetUnhandledExceptionFilter.KERNEL32(6D06A940,D4C6F04B), ref: 6D06A480

ExitProcess.KERNEL32 ref: 6D06A764

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CommandLine$ArgvExceptionExitFilterProcessUnhandled
String ID:
API String ID: 3999336801-0
Opcode ID: a488f8b6ce3b642c63b7118de6b3fbcc072e61690133a63997eeda98bd071c87
Instruction ID: 7accf355fd8292ed6be55c8975d074b821e0a3579e102cf887f1216b9f975390
Opcode Fuzzy Hash: a488f8b6ce3b642c63b7118de6b3fbcc072e61690133a63997eeda98bd071c87
Instruction Fuzzy Hash: E8E0EDB5D10208AFCF00DFE4D859B8EBBF8AB4A306F418054E604D7241D7345604CFA5

Function 6D07E098 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6D07994C: RtlAllocateHeap.NTDLL(00000008,?,6D06A587,?,6D0798A2,00000001,00000364,FFFFFFFF,000000FF,?,6D06A587,?,6D077998,6D07A642), ref: 6D07998D

_free.LIBCMT ref: 6D07E104

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: a7018ca1b7dab01fa89ae2cc2327009ac45932cccc635d3d6545fe49a90cdd94
Instruction ID: 7a76a331f0b598d74f54e04f0706ab0bc60b20e328b7ff0fc5f090b54a1a5f8d
Opcode Fuzzy Hash: a7018ca1b7dab01fa89ae2cc2327009ac45932cccc635d3d6545fe49a90cdd94
Instruction Fuzzy Hash: F101D672204306ABF3318E69D885A9AFBE9FB85370F25061DE59487280EB70A945C678

Function 6D07994C Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,6D06A587,?,6D0798A2,00000001,00000364,FFFFFFFF,000000FF,?,6D06A587,?,6D077998,6D07A642), ref: 6D07998D

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0f7447ea4e9ec89a1f3ab5b92c363c7675303de3662307604fced5083582f047
Instruction ID: bce5a83c4b55708510a3c5cfd888308a20305b77872425517ba2750387f882fd
Opcode Fuzzy Hash: 0f7447ea4e9ec89a1f3ab5b92c363c7675303de3662307604fced5083582f047
Instruction Fuzzy Hash: 7DF0B4316556266AFB320B6AE804B6E379CEFC2770B058115E8189F180CBE0E400C6E9

Non-executed Functions

Function 6D0530F0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 193stringfileCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 6D053120
lstrcatW.KERNEL32(?,?), ref: 6D053157
lstrlenW.KERNEL32(?), ref: 6D053164
lstrcpyW.KERNEL32(?,*.*), ref: 6D0531D4
FindFirstFileW.KERNEL32(?,?), ref: 6D0531E8
lstrcmpW.KERNEL32(?,6D08BA58), ref: 6D053220
lstrcmpW.KERNEL32(?,6D08BA5C), ref: 6D05323D
lstrcatW.KERNEL32(?,?), ref: 6D05326C
lstrcatW.KERNEL32(?,?), ref: 6D0532C3
FindNextFileW.KERNEL32(000000FF,?), ref: 6D053376
FindClose.KERNEL32(000000FF), ref: 6D05338B
GetFileAttributesW.KERNEL32(?), ref: 6D0533AA
SetFileAttributesW.KERNEL32(?,00000090), ref: 6D0533BF
RemoveDirectoryW.KERNEL32(?), ref: 6D0533C9
GetLastError.KERNEL32 ref: 6D0533D3
SetFileAttributesW.KERNEL32(?,00000000), ref: 6D0533E9
GetLastError.KERNEL32 ref: 6D0533F8

Strings

*.*, xrefs: 6D0531C1

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: File$AttributesFindlstrcat$ErrorLastlstrcmplstrlen$CloseDirectoryFirstNextRemovelstrcpy
String ID: *.*
API String ID: 270640561-438819550
Opcode ID: 171d1675a64b1c950ec980c7b80789df2af28158989d37afc608c10d02088afd
Instruction ID: 363125560c53aaea8224e7ce5305745bf323156160f178003cb0500af77510f7
Opcode Fuzzy Hash: 171d1675a64b1c950ec980c7b80789df2af28158989d37afc608c10d02088afd
Instruction Fuzzy Hash: 849161749042199BEF20CF64C948BEE77B6BF8A305F4081D8E91D9B241DB369EA4CF54

Function 6D055F20 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 285stringprocesspipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 6D055F68
GetStartupInfoA.KERNEL32(00000044), ref: 6D055F9D
lstrcatA.KERNEL32(?,cmd.exe /c ), ref: 6D055FF0
lstrcatA.KERNEL32(?,?), ref: 6D056001
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6D05602A

Strings

D, xrefs: 6D055F8C
cmd.exe /c , xrefs: 6D055FE4

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: Createlstrcat$InfoPipeProcessStartup
String ID: D$cmd.exe /c
API String ID: 2132647166-3768262801
Opcode ID: d7901200be3566152df50cfa488c8fcb15f608a9987a454ec2525e707a2688e5
Instruction ID: 5bd5fec9146946a86755f8942181c3d097ed7be7ba6ae305d229a382f14e5ee4
Opcode Fuzzy Hash: d7901200be3566152df50cfa488c8fcb15f608a9987a454ec2525e707a2688e5
Instruction Fuzzy Hash: 26D13B74A042189FEB24CF24CD54BEABBB5BB49304F4082D8E94D9B381D7B59AD4CF94

Function 6D052A10 Relevance: 9.1, APIs: 6, Instructions: 92stringfileCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 6D052A3D
lstrcatW.KERNEL32(?,?), ref: 6D052AB8
lstrlenW.KERNEL32(?), ref: 6D052AC5
FindFirstFileW.KERNEL32(?,?), ref: 6D052B38
GetLastError.KERNEL32 ref: 6D052B4D
FindClose.KERNEL32(000000FF), ref: 6D052B68

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: Findlstrlen$CloseErrorFileFirstLastlstrcat
String ID:
API String ID: 2856486079-0
Opcode ID: 7c88eb2f2948738f5345ac701d191bb2f4c0e9b6c177ef7ca035e106af151906
Instruction ID: 5995c9e7c531bf2f4e9824842d60564ef7e7d39bef1f54aa39f0cc76ddc09b9a
Opcode Fuzzy Hash: 7c88eb2f2948738f5345ac701d191bb2f4c0e9b6c177ef7ca035e106af151906
Instruction Fuzzy Hash: 09418FB49043689FEF30CF34C998BAD77B0AF46301F5081D9EA595B282DB359A90CF95

Function 6D069D70 Relevance: 34.7, APIs: 23, Instructions: 237
synchronizationsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(-00000090), ref: 6D069DB8
GetTickCount.KERNEL32 ref: 6D069DDF
LeaveCriticalSection.KERNEL32(-00000090,-00000004), ref: 6D069E16
LeaveCriticalSection.KERNEL32(-00000090,-00000004), ref: 6D069E49
GetTickCount.KERNEL32 ref: 6D069E66
EnterCriticalSection.KERNEL32(-000000A8), ref: 6D069E8F
WaitForSingleObject.KERNEL32(?,0000000A), ref: 6D069EAD
ResetEvent.KERNEL32(?), ref: 6D069EC5
LeaveCriticalSection.KERNEL32(-000000A8), ref: 6D069ED6
GetTickCount.KERNEL32 ref: 6D069EFC
LeaveCriticalSection.KERNEL32(-000000A8,-00000004,00000000), ref: 6D069F34
LeaveCriticalSection.KERNEL32(-000000A8,-00000004,00000000), ref: 6D069F65
EnterCriticalSection.KERNEL32(-000000C0), ref: 6D069FB5
WaitForSingleObject.KERNEL32(?,0000000A), ref: 6D069FD3
ResetEvent.KERNEL32(?), ref: 6D069FE7
LeaveCriticalSection.KERNEL32(-000000C0), ref: 6D069FF8
WaitForSingleObject.KERNEL32(?,0000000A), ref: 6D06A01B
ResetEvent.KERNEL32(?), ref: 6D06A02F
LeaveCriticalSection.KERNEL32(-000000C0), ref: 6D06A040
GetTickCount.KERNEL32 ref: 6D06A06C
LeaveCriticalSection.KERNEL32(-000000C0,-00000004,00000000), ref: 6D06A0A4
LeaveCriticalSection.KERNEL32(-000000C0,-00000004,00000000), ref: 6D06A0D2
Sleep.KERNEL32(0000000A), ref: 6D06A0F2

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$CountTick$EnterEventObjectResetSingleWait$Sleep
String ID:
API String ID: 22041548-0
Opcode ID: 8f4ad04d462e69cb6820475e7536c84de734fe606f7b87056ef7f62da737f643
Instruction ID: cbf87ec476ffba49983adf62633f175d1032f249b69acf0e6a41c6ea53295bb6
Opcode Fuzzy Hash: 8f4ad04d462e69cb6820475e7536c84de734fe606f7b87056ef7f62da737f643
Instruction Fuzzy Hash: 88A1A074654240EFEF14DBA4C994B2E7BB5BF4B319F008158E9129F392C735E890CB69

Function 6D05C280 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 239
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 6D05C328
GetDeviceCaps.GDI32(00000000,0000000C), ref: 6D05C337
GetDeviceCaps.GDI32(00000000,0000000E), ref: 6D05C345
DeleteDC.GDI32(00000000), ref: 6D05C355
GetObjectA.GDI32(?,00000018,?), ref: 6D05C3A1
GlobalAlloc.KERNEL32(00000042,00000028), ref: 6D05C42D
GlobalLock.KERNEL32(00000000), ref: 6D05C43A
GetStockObject.GDI32(0000000F), ref: 6D05C452
GetDC.USER32(00000000), ref: 6D05C463
SelectPalette.GDI32(00000000,00000000,00000000), ref: 6D05C476
RealizePalette.GDI32(00000000), ref: 6D05C483
GetDIBits.GDI32(00000000,?,00000000,?,00000028,00000000,00000000), ref: 6D05C4A8
SelectPalette.GDI32(00000000,00000000,00000001), ref: 6D05C4BE
RealizePalette.GDI32(00000000), ref: 6D05C4C8
ReleaseDC.USER32(00000000,00000000), ref: 6D05C4D4
GlobalUnlock.KERNEL32(00000000), ref: 6D05C560
GlobalFree.KERNEL32(00000000), ref: 6D05C56A

Strings

(, xrefs: 6D05C3B2
DISPLAY, xrefs: 6D05C323

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: GlobalPalette$CapsDeviceObjectRealizeSelect$AllocBitsCreateDeleteFreeLockReleaseStockUnlock
String ID: ($DISPLAY
API String ID: 2569495461-216271742
Opcode ID: b60a7ff8149002c5b14c23b6892e49cf99dfabe7a532f2e318f1ec96b87d4042
Instruction ID: a032a1f9b455c561792a8b48011e169fab622497e26e8b5659e5076408408224
Opcode Fuzzy Hash: b60a7ff8149002c5b14c23b6892e49cf99dfabe7a532f2e318f1ec96b87d4042
Instruction Fuzzy Hash: 49A1F4B5D102089BDF14CFE8C844BAEBBB5FF8A300F108129E919AB390D7759945CF94

Function 6D057040 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 247pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 6D0570A7
GetLastError.KERNEL32 ref: 6D0570BC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 6D057109
GetLastError.KERNEL32 ref: 6D05711E

Strings

, xrefs: 6D057312
, xrefs: 6D05720B

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CreateErrorLastPipe
String ID: $
API String ID: 269057482-227171996
Opcode ID: ba994e167ff2a1ff2bdcb17086ae8152fb6896158f527bc85cbb070486cf5cef
Instruction ID: 034c253bda9b1bf25535dea54a21082e0cfcf25e768e4095955b85d8cbd5fc5a
Opcode Fuzzy Hash: ba994e167ff2a1ff2bdcb17086ae8152fb6896158f527bc85cbb070486cf5cef
Instruction Fuzzy Hash: 4FB19EB0A102189BEB24CF64C95579EBBB5EF8A304F1080BCD60D9B381DB755A84CF6D

Function 6D05CC50 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 227windowmemoryCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 6D05CD7B
GlobalAlloc.KERNEL32(00000042,00000028), ref: 6D05CDF9
GlobalLock.KERNEL32(00000000), ref: 6D05CE06
GetStockObject.GDI32(0000000F), ref: 6D05CE1E
GetDC.USER32(00000000), ref: 6D05CE2F
SelectPalette.GDI32(00000000,00000000,00000000), ref: 6D05CE42
RealizePalette.GDI32(00000000), ref: 6D05CE4F
GetDIBits.GDI32(00000000,?,00000000,?,00000028,00000000,00000000), ref: 6D05CE74
SelectPalette.GDI32(00000000,00000000,00000001), ref: 6D05CE8A
RealizePalette.GDI32(00000000), ref: 6D05CE94
ReleaseDC.USER32(00000000,00000000), ref: 6D05CEA0
GlobalUnlock.KERNEL32(00000000), ref: 6D05CF35
GlobalFree.KERNEL32(00000000), ref: 6D05CF3F

Strings

DISPLAY, xrefs: 6D05CC6C
(, xrefs: 6D05CD81

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: GlobalPalette$ObjectRealizeSelect$AllocBitsFreeLockReleaseStockUnlock
String ID: ($DISPLAY
API String ID: 4021622762-216271742
Opcode ID: 7d60e3368b3c297c0b78aa1b3a8db3d3993e9898bf5bfa8c970a50800537b1d3
Instruction ID: fb884f4072e0312b4b66149b8c1975134a48f91ef5205154651b118fb294e072
Opcode Fuzzy Hash: 7d60e3368b3c297c0b78aa1b3a8db3d3993e9898bf5bfa8c970a50800537b1d3
Instruction Fuzzy Hash: 94A1BFB4D002089FEF14CFA9C984B9EBBB5FF89304F208129E919AB390D7759945CF94

Function 6D07D1F3 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6D07D237

Part of subcall function 6D080219: _free.LIBCMT ref: 6D080236
Part of subcall function 6D080219: _free.LIBCMT ref: 6D080248
Part of subcall function 6D080219: _free.LIBCMT ref: 6D08025A
Part of subcall function 6D080219: _free.LIBCMT ref: 6D08026C
Part of subcall function 6D080219: _free.LIBCMT ref: 6D08027E
Part of subcall function 6D080219: _free.LIBCMT ref: 6D080290
Part of subcall function 6D080219: _free.LIBCMT ref: 6D0802A2
Part of subcall function 6D080219: _free.LIBCMT ref: 6D0802B4
Part of subcall function 6D080219: _free.LIBCMT ref: 6D0802C6
Part of subcall function 6D080219: _free.LIBCMT ref: 6D0802D8
Part of subcall function 6D080219: _free.LIBCMT ref: 6D0802EA
Part of subcall function 6D080219: _free.LIBCMT ref: 6D0802FC
Part of subcall function 6D080219: _free.LIBCMT ref: 6D08030E

_free.LIBCMT ref: 6D07D22C

Part of subcall function 6D0799A9: HeapFree.KERNEL32(00000000,00000000,?,6D0803AA,6D06A587,00000000,6D06A587,?,?,6D0803D1,6D06A587,00000007,6D06A587,?,6D07D38B,6D06A587), ref: 6D0799BF
Part of subcall function 6D0799A9: GetLastError.KERNEL32(6D06A587,?,6D0803AA,6D06A587,00000000,6D06A587,?,?,6D0803D1,6D06A587,00000007,6D06A587,?,6D07D38B,6D06A587,6D06A587), ref: 6D0799D1

_free.LIBCMT ref: 6D07D24E
_free.LIBCMT ref: 6D07D263
_free.LIBCMT ref: 6D07D26E
_free.LIBCMT ref: 6D07D290
_free.LIBCMT ref: 6D07D2A3
_free.LIBCMT ref: 6D07D2B1
_free.LIBCMT ref: 6D07D2BC
_free.LIBCMT ref: 6D07D2F4
_free.LIBCMT ref: 6D07D2FB
_free.LIBCMT ref: 6D07D318
_free.LIBCMT ref: 6D07D330

Strings

(7m, xrefs: 6D07D209

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: (7m
API String ID: 161543041-2267483508
Opcode ID: 908c44313ffa7d82fb497ef24bff1d127403afc394c0298d7f4d8f69bb42304e
Instruction ID: 7bbb9ad324f8663b261e61ed53ea414277651bd41b672142056cefdcbbe83666
Opcode Fuzzy Hash: 908c44313ffa7d82fb497ef24bff1d127403afc394c0298d7f4d8f69bb42304e
Instruction Fuzzy Hash: DA313971608606EFFB309A79EC40BAAB3E9FB80354F118419E568DF150DB72E841CB29

Function 6D058230 Relevance: 24.1, APIs: 16, Instructions: 131synchronizationthreadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00002710,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D05824D
SetEvent.KERNEL32(?,00002710,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D058269
SetEvent.KERNEL32(?,00002710,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D058285
SetEvent.KERNEL32(?,00002710,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D0582A1
WaitForSingleObject.KERNEL32(?,000003E8,00002710,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D0582C2
TerminateThread.KERNEL32(?,00000000,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D0582DB
CloseHandle.KERNEL32(?,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D0582EB
WaitForSingleObject.KERNEL32(?,000003E8,00002710,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D05830C
TerminateThread.KERNEL32(?,00000000,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D058325
CloseHandle.KERNEL32(?,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D058335
CloseHandle.KERNEL32(?,00002710,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D058351
CloseHandle.KERNEL32(?,00002710,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D05836D
CloseHandle.KERNEL32(?,00002710,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D058389
CloseHandle.KERNEL32(?,00002710,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D0583A5
CloseHandle.KERNEL32(?,00002710,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D0583C1
CloseHandle.KERNEL32(?,00002710,?,6D057E2F,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D0583DD

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CloseHandle$Event$ObjectSingleTerminateThreadWait
String ID:
API String ID: 1594280071-0
Opcode ID: 0598d5f2eae371d8e7b13f462520d5cffa13a7f4b7dad9b94c06f114da042eca
Instruction ID: 2ea68d677b5f5a9235f003a6ff92455b224f85863b70d65ec4cca0f2366705e9
Opcode Fuzzy Hash: 0598d5f2eae371d8e7b13f462520d5cffa13a7f4b7dad9b94c06f114da042eca
Instruction Fuzzy Hash: 6761A534650109EFDB04DB90C29CBEDB7F2BB49306F6546A8E8095B392C775AE81DF90

Function 6D05CF60 Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 370libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000), ref: 6D05D026
GetProcAddress.KERNEL32(00000000,00000000), ref: 6D05D0E1
GetProcAddress.KERNEL32(00000000,00000000), ref: 6D05D187

Part of subcall function 6D072278: ___report_securityfailure.LIBCMT ref: 6D07227D

GetProcAddress.KERNEL32(00000000,00000000), ref: 6D05D2B8
GetProcAddress.KERNEL32(00000000,00000000), ref: 6D05D36C
GetProcAddress.KERNEL32(00000000,00000000), ref: 6D05D4D5

Strings

@, xrefs: 6D05D00D
p, xrefs: 6D05D4A8
@@@@@@, xrefs: 6D05D4C5
@@@@, xrefs: 6D05D2A8
@@@, xrefs: 6D05D177
@, xrefs: 6D05D0C4
@@@@@, xrefs: 6D05D35C

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad___report_securityfailure
String ID: @$@$@@@$@@@@$@@@@@$@@@@@@$p
API String ID: 1632341849-4092788838
Opcode ID: 4c2388e9db182e0eb1c9f07c6cee47565a8a48c78933a0b9cf5aa1b6f5efcd60
Instruction ID: 5ab94d4d11b0d2c1a2c6a491d2c510dbd3280a5aca0e9d28065040f50b22e8e8
Opcode Fuzzy Hash: 4c2388e9db182e0eb1c9f07c6cee47565a8a48c78933a0b9cf5aa1b6f5efcd60
Instruction Fuzzy Hash: FC02A430A092C98AFB28CEACD2183DD7EA6DB91304F18407DC5498F7D5D7FAAA45C761

Function 6D05AB40 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 332COMMON

Download Yara Rule

APIs

EnumDisplaySettingsA.USER32(00000000,000000FF,?), ref: 6D05AC51

Strings

6, xrefs: 6D05AEEC
DISPLAY, xrefs: 6D05AC20
(, xrefs: 6D05ADD6

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: DisplayEnumSettings
String ID: ($6$DISPLAY
API String ID: 3434046153-2676095719
Opcode ID: 13115d74ad9b238d7f335f53ff5fbf6d4dadc6d14a4e8cc4f5b74b1031449c4a
Instruction ID: f04efabfd605850ed9ecd365400840cf61d5c3768710e5dad50dffc0b916fa10
Opcode Fuzzy Hash: 13115d74ad9b238d7f335f53ff5fbf6d4dadc6d14a4e8cc4f5b74b1031449c4a
Instruction Fuzzy Hash: AFE106B4D042199BEB24CF65CD85BEEB7B4AF59300F1081E8D64DA7241E771AE90CFA1

Function 6D069740 Relevance: 18.1, APIs: 12, Instructions: 142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000048,D4C6F04B,00000000,?,6D069ACD,00000001), ref: 6D06976F
LeaveCriticalSection.KERNEL32(?), ref: 6D069786
EnterCriticalSection.KERNEL32(?), ref: 6D069793
LeaveCriticalSection.KERNEL32(?), ref: 6D069866
DeleteCriticalSection.KERNEL32(?), ref: 6D06988A
DeleteCriticalSection.KERNEL32(?), ref: 6D069897
DeleteCriticalSection.KERNEL32(?), ref: 6D0698A4
DeleteCriticalSection.KERNEL32(?), ref: 6D0698B4
DeleteCriticalSection.KERNEL32(?), ref: 6D0698C4
DeleteCriticalSection.KERNEL32(?), ref: 6D0698D3
CloseHandle.KERNEL32(?), ref: 6D0698E0
CloseHandle.KERNEL32(?), ref: 6D0698ED

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$Delete$CloseEnterHandleLeave
String ID:
API String ID: 547864322-0
Opcode ID: cfb7fc2dd1cb29cdbf177e33d58ccbb0b403ebe34b0033b488ee59e52ab453a3
Instruction ID: 21b5e243bd508ae1f9d71232d5759c5d6bbb1d339c3d2c4fe6337cf457b3f05b
Opcode Fuzzy Hash: cfb7fc2dd1cb29cdbf177e33d58ccbb0b403ebe34b0033b488ee59e52ab453a3
Instruction Fuzzy Hash: B1512EB491025A8FDF08DFA8C994B7FB775FF46209F554518E922AB381CB34A410CB94

Function 6D069B70 Relevance: 15.1, APIs: 10, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 6D069D30: EnterCriticalSection.KERNEL32(-00000048,?,?,6D069B89,6D05DD1A,?,00000010,00000002), ref: 6D069D41
Part of subcall function 6D069D30: LeaveCriticalSection.KERNEL32(-00000048,?,6D069B89,6D05DD1A,?,00000010,00000002), ref: 6D069D5F

EnterCriticalSection.KERNEL32(-00000078,?,?,6D05DD1A,?,00000010,00000002), ref: 6D069BB8
LeaveCriticalSection.KERNEL32(-00000078), ref: 6D069CAC

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4e83373a47d69b6d1c546ecb9dc272437eaccbbd616bba9a3433ad7734c1f4bf
Instruction ID: cefb301cbe4c788dc39a0bd024f5ed4a90c53a9ebbf0bcefd8ff632928b27ec0
Opcode Fuzzy Hash: 4e83373a47d69b6d1c546ecb9dc272437eaccbbd616bba9a3433ad7734c1f4bf
Instruction Fuzzy Hash: ED31AB70914244EFEF14DBB8D944BAE7BB5BB4B31AF404518E4159F242CB35E844CFA8

Function 6D0795C2 Relevance: 15.1, APIs: 10, Instructions: 70COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D0795D8

Part of subcall function 6D0799A9: HeapFree.KERNEL32(00000000,00000000,?,6D0803AA,6D06A587,00000000,6D06A587,?,?,6D0803D1,6D06A587,00000007,6D06A587,?,6D07D38B,6D06A587), ref: 6D0799BF
Part of subcall function 6D0799A9: GetLastError.KERNEL32(6D06A587,?,6D0803AA,6D06A587,00000000,6D06A587,?,?,6D0803D1,6D06A587,00000007,6D06A587,?,6D07D38B,6D06A587,6D06A587), ref: 6D0799D1

_free.LIBCMT ref: 6D0795E4
_free.LIBCMT ref: 6D0795EF
_free.LIBCMT ref: 6D0795FA
_free.LIBCMT ref: 6D079605
_free.LIBCMT ref: 6D079610
_free.LIBCMT ref: 6D07961B
_free.LIBCMT ref: 6D079626
_free.LIBCMT ref: 6D079631
_free.LIBCMT ref: 6D07963F

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 87ebc9382e82b0bba1597af8ed91996ad38b12e4743dd00436c867407ec71bea
Instruction ID: c8d71f21cf934ef66a64191bd32183452133256bf684b8cd10fc6391c7effdff
Opcode Fuzzy Hash: 87ebc9382e82b0bba1597af8ed91996ad38b12e4743dd00436c867407ec71bea
Instruction Fuzzy Hash: 6121C776914108EFEB11DF99E880EDE7BB8FF88200F0181A6E6159F121DB72DA44CB85

Function 6D0611D0 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 305COMMON

Download Yara Rule

APIs

_swprintf.LIBCMTD ref: 6D061529
_memcpy_s.LIBCPMTD ref: 6D0615AB

Part of subcall function 6D069B70: EnterCriticalSection.KERNEL32(-00000090), ref: 6D069BEC
Part of subcall function 6D069B70: SetEvent.KERNEL32(?), ref: 6D069BFB
Part of subcall function 6D069B70: LeaveCriticalSection.KERNEL32(-00000090,00000010), ref: 6D069C1E

_memcpy_s.LIBCPMTD ref: 6D0612F9

Part of subcall function 6D069B70: EnterCriticalSection.KERNEL32(-00000078,?,?,6D05DD1A,?,00000010,00000002), ref: 6D069BB8
Part of subcall function 6D069B70: LeaveCriticalSection.KERNEL32(-00000078), ref: 6D069CAC

Part of subcall function 6D065400: EnterCriticalSection.KERNEL32(?), ref: 6D065418
Part of subcall function 6D065400: LeaveCriticalSection.KERNEL32(?,0000001E), ref: 6D065445

_swprintf.LIBCMTD ref: 6D061277

Part of subcall function 6D055C90: __vswprintf_s_l.LIBCONCRTD ref: 6D055CAE

Part of subcall function 6D05EFD0: lstrcatA.KERNEL32(00000000,00000000,?,6D05F449), ref: 6D05EFEC

_memcpy_s.LIBCPMTD ref: 6D0614A6

Strings

TwoPipeShell [%d] Create Error! It's Already Exists!, xrefs: 6D061266
TwoPipeShell [%d] Create Error!, xrefs: 6D061518

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave_memcpy_s$_swprintf$Event__vswprintf_s_llstrcat
String ID: TwoPipeShell [%d] Create Error!$TwoPipeShell [%d] Create Error! It's Already Exists!
API String ID: 3699697941-232176239
Opcode ID: 63de94be7b5c343690fc8c333ea3c0a3ad0a3bc671130f06caef8d1717221791
Instruction ID: 0b77e336f479a138cdd4dfc480e161191c6c36d60c97dd1413aed6bcde096c0e
Opcode Fuzzy Hash: 63de94be7b5c343690fc8c333ea3c0a3ad0a3bc671130f06caef8d1717221791
Instruction Fuzzy Hash: 52D12275A042589FEB14DF54CC91BAAB376FF89704F1045D8E9099B391DB32AEA0CF90

Function 6D060640 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 267stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000,00000021,?,?,D4C6F04B), ref: 6D0606D3
_memcpy_s.LIBCPMTD ref: 6D06079E
_memcpy_s.LIBCPMTD ref: 6D060810
_memcpy_s.LIBCPMTD ref: 6D060842

Part of subcall function 6D056800: FormatMessageA.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 6D05685D

Part of subcall function 6D05EFD0: lstrcatA.KERNEL32(00000000,00000000,?,6D05F449), ref: 6D05EFEC

_swprintf.LIBCMTD ref: 6D0608BF
_memcpy_s.LIBCPMTD ref: 6D060941

Strings

Download [%S] error! Is running Download, xrefs: 6D0608AE

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: _memcpy_s$FormatMessage_swprintflstrcatlstrlen
String ID: Download [%S] error! Is running Download
API String ID: 1768301414-4225480886
Opcode ID: 1bed5ebee9ac1a1a064618ec1d3e18943476defa8fb44f79328283a0d7219afc
Instruction ID: dbbba1a13b0bdc11b5087f788930b72a1879b9cb5f1b9435076bea372285f755
Opcode Fuzzy Hash: 1bed5ebee9ac1a1a064618ec1d3e18943476defa8fb44f79328283a0d7219afc
Instruction Fuzzy Hash: 12B131B56042089FEB04DF64CC91FAAB376FF89704F148598E9199B391DB31AD60CFA0

Function 6D061FE0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 188fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(0000FFEF,?,00000008,0000FFEF,00000000), ref: 6D06203B
SetFilePointerEx.KERNEL32(00000008,?,?,6D062382,00000001), ref: 6D062077
SetFilePointerEx.KERNEL32(00000008,?,?,6D062382,00000001), ref: 6D0620A9
ReadFile.KERNEL32(00000000,6D094548,?,00000000,00000000), ref: 6D06212A

Strings

$8m, xrefs: 6D0620C8
fkpioefpoea$@^Tf0-0-gepwf09IJGEJ0IFAPKO456SG894E, xrefs: 6D06219F
$8m, xrefs: 6D062168

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: File$PointerRead
String ID: $8m$$8m$fkpioefpoea$@^Tf0-0-gepwf09IJGEJ0IFAPKO456SG894E
API String ID: 3154509469-1104052929
Opcode ID: 59a3a9f7cbbd2055f77ca7f177ca34516a8d505c6f682d8d9dbc442f9a28d61c
Instruction ID: 963023ef0f252aaa6b0d103d0d3706ab244bb9bfb2718741511834b882f8214d
Opcode Fuzzy Hash: 59a3a9f7cbbd2055f77ca7f177ca34516a8d505c6f682d8d9dbc442f9a28d61c
Instruction Fuzzy Hash: 0881F8B5D04249AFEB14CFE8D984BEEBBB5BF89304F108219E515BB244D734A941CFA4

Function 6D062230 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 188fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000), ref: 6D062283
GetLastError.KERNEL32 ref: 6D062292

Part of subcall function 6D056800: FormatMessageA.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 6D05685D

SetFilePointerEx.KERNEL32(000000FF,?,?,?,00000002), ref: 6D0622D6
SetFilePointerEx.KERNEL32(000000FF,?,?,00000000,00000000), ref: 6D0622EC
CloseHandle.KERNEL32(000000FF), ref: 6D06247B

Strings

GetDecodeLog Error !, xrefs: 6D0623DC

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: File$Pointer$CloseCreateErrorFormatHandleLastMessage
String ID: GetDecodeLog Error !
API String ID: 2400116906-3583251517
Opcode ID: fd313ba1f185c375217ef9e75255bf6e2874853d7db787b0a861a65be8f7c027
Instruction ID: 239431a06efb2f430203fd2c90c05ef3c705cfb729b580dbd43869565fc6b6d0
Opcode Fuzzy Hash: fd313ba1f185c375217ef9e75255bf6e2874853d7db787b0a861a65be8f7c027
Instruction Fuzzy Hash: 5F8155B0D002099BDF14CFA8D884BAEBBB5FF49304F148219E914BB381D775A945CFA1

Function 6D056460 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 113libraryloaderCOMMON

Download Yara Rule

APIs

std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 6D056473
LoadLibraryA.KERNEL32(Kernel32.dll), ref: 6D0564B0
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 6D0565C0
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 6D0565D1

Strings

Wow64RevertWow64FsRedirection, xrefs: 6D0565C9, 6D0565CC
Kernel32.dll, xrefs: 6D0564AC, 6D0564AF
Wow64DisableWow64FsRedirection, xrefs: 6D0565B8, 6D0565BB

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: AddressProc$Iterator_baseIterator_base::_LibraryLoadstd::_
String ID: Kernel32.dll$Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection
API String ID: 4189866332-1575494070
Opcode ID: 9a944d79aceb9cfda87c0a8666b2b43848822be5950b889eb4b0f5fbc46ed102
Instruction ID: 1e69632b34f6503d8fb7c37a02f16a3710cf8f241bdb81373efc7e682e3c28c4
Opcode Fuzzy Hash: 9a944d79aceb9cfda87c0a8666b2b43848822be5950b889eb4b0f5fbc46ed102
Instruction Fuzzy Hash: D5617120D0C2C8D9EF12C7E8D5487DEBFB65F26748F084099D5882B282C7BB1659C776

Function 6D05B4A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6D05B0C0: DeleteObject.GDI32(00000000), ref: 6D05B129

WaitForSingleObject.KERNEL32(?,00000001), ref: 6D05B4DD

Strings

./img_src/QScreen_%d.bmp, xrefs: 6D05B5B2

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: Object$DeleteSingleWait
String ID: ./img_src/QScreen_%d.bmp
API String ID: 1609116822-2525806235
Opcode ID: 730569ca241d1d2f6af0152a286fb6b525d9c79dea85420ca256e0579535eaff
Instruction ID: 1ca1700ec08f386df07cb0aa0735434a89cb3c059b72c2ec73f724df0653b17d
Opcode Fuzzy Hash: 730569ca241d1d2f6af0152a286fb6b525d9c79dea85420ca256e0579535eaff
Instruction Fuzzy Hash: CF314870608208DBEB54DB65CD94BAEB3B5BB5A304F504198E98A9B381DBB1FDD1CF40

Function 6D052D00 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73stringprocessCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32(00000044), ref: 6D052D44
lstrcatW.KERNEL32(?,cmd.exe /c ), ref: 6D052D9F
lstrcatW.KERNEL32(?,?), ref: 6D052DB0
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6D052DD9
GetLastError.KERNEL32 ref: 6D052DF5

Strings

cmd.exe /c , xrefs: 6D052D93
D, xrefs: 6D052D33

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: lstrcat$CreateErrorInfoLastProcessStartup
String ID: D$cmd.exe /c
API String ID: 3475696678-3768262801
Opcode ID: 7bfc9af42f1ba9c7591785a654bce65f9a6523677a5314375b9ee23ef04cb6a0
Instruction ID: 4b461b293f137fd1fbcb3d9ac559252da681c43f313c00b4c7a020ce888b01b7
Opcode Fuzzy Hash: 7bfc9af42f1ba9c7591785a654bce65f9a6523677a5314375b9ee23ef04cb6a0
Instruction Fuzzy Hash: 6C3165B0A142589BEF60CF60CC45BDD7779AF4A705F4040D8E709AB281DBB56A84CF6D

Function 6D0580E0 Relevance: 12.1, APIs: 8, Instructions: 98threadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00002710,?,6D057A57,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D0580EF
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,6D057A57,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D058106
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,6D057A57,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D05811D
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,6D057A57,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D058134
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,6D057A57,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D05814B
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,6D057A57,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D058162
CreateThread.KERNEL32(00000000,00000000,6D058460,00002710,00000000,00000000), ref: 6D058182
CreateThread.KERNEL32(00000000,00000000,6D058450,00002710,00000000,00000000), ref: 6D0581A2

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: Create$Event$Thread
String ID:
API String ID: 2525963256-0
Opcode ID: da5d73bab80d9ddb3a68afb7d770329c7c4b546aac0feb7ba62dc88c4ba08168
Instruction ID: 0874fafe0799583b6e6b5135f5e13ff37266788c623543643a3f098e9726c048
Opcode Fuzzy Hash: da5d73bab80d9ddb3a68afb7d770329c7c4b546aac0feb7ba62dc88c4ba08168
Instruction Fuzzy Hash: CE419A34690205FFEB10DB90DD49BA977B1AB45706F7041A4EE096E2C1D7B12E81DE58

Function 6D0695F0 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,D4C6F04B,00000000,6D05DB18,6D085A9E,000000FF,?,6D0699A4,6D05DB18), ref: 6D069661
InitializeCriticalSection.KERNEL32(?,?,6D0699A4,6D05DB18), ref: 6D06966E
InitializeCriticalSection.KERNEL32(?,?,6D0699A4,6D05DB18), ref: 6D06967B
InitializeCriticalSection.KERNEL32(?,?,6D0699A4,6D05DB18), ref: 6D06968B
InitializeCriticalSection.KERNEL32(?,?,6D0699A4,6D05DB18), ref: 6D06969A
InitializeCriticalSection.KERNEL32(?,?,6D0699A4,6D05DB18), ref: 6D0696AA
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,6D0699A4,6D05DB18), ref: 6D0696F4
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,6D0699A4,6D05DB18), ref: 6D069708

Part of subcall function 6D069CD0: EnterCriticalSection.KERNEL32(-0000005E,?,?,6D069720,6D05DB18,?,6D0699A4,6D05DB18), ref: 6D069CDE
Part of subcall function 6D069CD0: LeaveCriticalSection.KERNEL32(-0000005E,?,6D069720,6D05DB18,?,6D0699A4,6D05DB18), ref: 6D069CF4

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$Initialize$CreateEvent$EnterLeave
String ID:
API String ID: 465080375-0
Opcode ID: 38b491f72df9c4f1cbe7be3128501c12eaf513593f40b5654144606039fa7e90
Instruction ID: 7e3b0730d0ad3e31a014eef65f66ec737a4f8b9a423babb657f468a12d364182
Opcode Fuzzy Hash: 38b491f72df9c4f1cbe7be3128501c12eaf513593f40b5654144606039fa7e90
Instruction Fuzzy Hash: CA4129B4A1425A9FDF14CF98CC94BAEB771FF4A315F114A18E926AB3C1CB756800CB54

Function 6D0626F0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 253COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 6D0628EA
_memcpy_s.LIBCPMTD ref: 6D062849

Part of subcall function 6D05EFD0: lstrcatA.KERNEL32(00000000,00000000,?,6D05F449), ref: 6D05EFEC

_memcpy_s.LIBCPMTD ref: 6D06298B

Strings

Screen Start With XOR error!, xrefs: 6D062884
Screen Start error, Class is NULL!, xrefs: 6D062925
Screen Start error!, xrefs: 6D0627E3

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: _memcpy_s$lstrcat
String ID: Screen Start With XOR error!$Screen Start error!$Screen Start error, Class is NULL!
API String ID: 3156544786-2901572510
Opcode ID: c2cc29aebec96aad951b13117b958cd2ea259eb8f6a52c7939611e60caabb7d0
Instruction ID: 9bd6b27a1ce68d1f76215868f51b9cb8a0690c7298d9a8fc6c55e66f592b27a4
Opcode Fuzzy Hash: c2cc29aebec96aad951b13117b958cd2ea259eb8f6a52c7939611e60caabb7d0
Instruction Fuzzy Hash: 52B17CB4A04249DFDB04CFA8D890BAEB7B5FF89304F148658E9159F391DB31E951CBA0

Function 6D0734D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6D0734FB
___except_validate_context_record.LIBVCRUNTIME ref: 6D073503
_ValidateLocalCookies.LIBCMT ref: 6D073591
__IsNonwritableInCurrentImage.LIBCMT ref: 6D0735BC
_ValidateLocalCookies.LIBCMT ref: 6D073611

Strings

csm, xrefs: 6D0735A6

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 21df24c02a4191ca0245b1509e2fc22f2c19e7a4f0335bcb38410e35ded522a5
Instruction ID: f684e1c0fe03c5c82fc46e0a6dfe86caa88387565559eabcb751ed0d7a8b4887
Opcode Fuzzy Hash: 21df24c02a4191ca0245b1509e2fc22f2c19e7a4f0335bcb38410e35ded522a5
Instruction Fuzzy Hash: 8441A434E04209EBEF10CF68C844BAEBBF5AF49328F518155E9299F251D731FA11CB95

Function 6D0578A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,\\.\pipe\), ref: 6D0578E3
lstrcatA.KERNEL32(?,0000005C), ref: 6D0578F1
lstrcpyA.KERNEL32(?,\\.\pipe\), ref: 6D057905
lstrcatA.KERNEL32(?,pipe\), ref: 6D057919

Strings

pipe\, xrefs: 6D05790B, 6D05790E
\\.\pipe\, xrefs: 6D0578DB, 6D0578DE

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: lstrcatlstrcpy
String ID: \\.\pipe\$pipe\
API String ID: 3905823039-868360898
Opcode ID: bb637833572eb652b4abb77a448731b85813111016884efff794deca9154b5ff
Instruction ID: dae8bb43699e1bc592154d49b48def6c0867c25f9bac261a3362706d0c43f608
Opcode Fuzzy Hash: bb637833572eb652b4abb77a448731b85813111016884efff794deca9154b5ff
Instruction Fuzzy Hash: 31410CB4904249DFDB04CF94C598BEFBBF1AF58304F2441A8E5086B381C77A6A45CFA6

Function 6D079A17 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 6D079A6D
ext-ms-, xrefs: 6D079A81

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 2354147dcd2c053b92734085455a979f88058b8c9c8c62ac87e973ec791e92c7
Instruction ID: 674599290917632986e7dcbd32d899925082a3120174d774e2b8fc9bb8d60606
Opcode Fuzzy Hash: 2354147dcd2c053b92734085455a979f88058b8c9c8c62ac87e973ec791e92c7
Instruction Fuzzy Hash: 18219C71E16222BBFF318B65AC40B9E37B4AB47761F554510ED15AF185E730E900C6E8

Function 6D0803B8 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D080380: _free.LIBCMT ref: 6D0803A5

_free.LIBCMT ref: 6D080406

Part of subcall function 6D0799A9: HeapFree.KERNEL32(00000000,00000000,?,6D0803AA,6D06A587,00000000,6D06A587,?,?,6D0803D1,6D06A587,00000007,6D06A587,?,6D07D38B,6D06A587), ref: 6D0799BF
Part of subcall function 6D0799A9: GetLastError.KERNEL32(6D06A587,?,6D0803AA,6D06A587,00000000,6D06A587,?,?,6D0803D1,6D06A587,00000007,6D06A587,?,6D07D38B,6D06A587,6D06A587), ref: 6D0799D1

_free.LIBCMT ref: 6D080411
_free.LIBCMT ref: 6D08041C
_free.LIBCMT ref: 6D080470
_free.LIBCMT ref: 6D08047B
_free.LIBCMT ref: 6D080486
_free.LIBCMT ref: 6D080491

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a27d45a320cfdaef14d7d4f740b74aae9e16b72bb56c33c5b9f1cb88268fc740
Instruction ID: dc8104ff1542174f6651f072894b077d36d7a899ebd6181d995bc401f7faf082
Opcode Fuzzy Hash: a27d45a320cfdaef14d7d4f740b74aae9e16b72bb56c33c5b9f1cb88268fc740
Instruction Fuzzy Hash: 0A114C7154AB04ABFB70EBB1CC05FCB779CEF00708F418825B799AB052DBA5B50486A5

Function 6D061F40 Relevance: 10.6, APIs: 7, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 6D061F54
MapViewOfFile.KERNEL32(000000FF,00000006,00000000,00000000,00000000,?,6D062474,000000FF,00000000), ref: 6D061F69
GetFileSize.KERNEL32(000000FF,00000000,?,6D062474,000000FF,00000000), ref: 6D061F78
UnmapViewOfFile.KERNEL32(00000000,?,?,?,?,6D062474,000000FF,00000000), ref: 6D061FAB
CloseHandle.KERNEL32(000000FF,?,?,?,?,6D062474,000000FF,00000000), ref: 6D061FB5
SetFilePointer.KERNEL32(000000FF,6D062474,00000000,00000000,?,?,?,?,6D062474,000000FF,00000000), ref: 6D061FC7
SetEndOfFile.KERNEL32(000000FF,?,?,?,?,6D062474,000000FF,00000000), ref: 6D061FD1

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: File$View$CloseCreateHandleMappingPointerSizeUnmap
String ID:
API String ID: 2211241848-0
Opcode ID: 0a3e2cd6db968bd17668bd2b531c12f41d59edb6cc0ea091409cca6ef41c3b40
Instruction ID: 1f391b66405ca40a509bd7a6eb3e750e3b4018903f2213a67e9af6f6d5df3595
Opcode Fuzzy Hash: 0a3e2cd6db968bd17668bd2b531c12f41d59edb6cc0ea091409cca6ef41c3b40
Instruction Fuzzy Hash: BB11FE79A40208BFDF10DFA4CC89F9E7BB4EB49702F508544FA15AB281D771AA408F94

Function 6D055720 Relevance: 9.3, APIs: 6, Instructions: 261sleepfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000005), ref: 6D055818
SetFilePointerEx.KERNEL32(000000FF,?,?,00000000,00000000), ref: 6D0558B2
ReadFile.KERNEL32(000000FF,000000FF,00000000,00000000,00000000), ref: 6D055934
GetLastError.KERNEL32 ref: 6D05593E
CloseHandle.KERNEL32(000000FF), ref: 6D05595F

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: File$CloseErrorHandleLastPointerReadSleep
String ID:
API String ID: 4017491889-0
Opcode ID: 701a9eb26b0e36e482f30e9908bffab18c9016161f8846582a67e5dc4b32cb73
Instruction ID: af76752fe74bf6ca25093bdc08155a849a066013e020c809ba303d7f1e411845
Opcode Fuzzy Hash: 701a9eb26b0e36e482f30e9908bffab18c9016161f8846582a67e5dc4b32cb73
Instruction Fuzzy Hash: CDC1D9B4E04219DFDB04CFA8C994BAEBBB5BF49314F208659D815AB380D774A941CFA1

Function 6D059550 Relevance: 9.2, APIs: 6, Instructions: 222COMMON

Download Yara Rule

APIs

std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6D0595B9
allocator.LIBCONCRTD ref: 6D05960C
_Find_unchecked.LIBCPMTD ref: 6D0596A4
_Find_unchecked.LIBCPMTD ref: 6D0596B8
_Find_unchecked.LIBCPMTD ref: 6D059766

Part of subcall function 6D059400: _Deallocate.LIBCONCRTD ref: 6D059412

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: Find_unchecked$DeallocateMutex_baseMutex_base::~_allocatorstd::_
String ID:
API String ID: 565782535-0
Opcode ID: 1effb61846f9b381852d3322373296e42bfe70816a8b8c945e028c6c00840303
Instruction ID: 5f702f3fc12af3f4fff0e5f0a5676d66b76c5e6fbb6603deb1a6fd408d79b4d3
Opcode Fuzzy Hash: 1effb61846f9b381852d3322373296e42bfe70816a8b8c945e028c6c00840303
Instruction Fuzzy Hash: 1C910DB1D0410DAFDB04DF94E990EAEB3B6FF89348F118598DA16AB254DB306E14CF90

Function 6D07D7F3 Relevance: 9.2, APIs: 6, Instructions: 168fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000001,00000020,?,?,?,?,?,?,?,?,6D07DF89,00000008,00000001,00000020,0000002C), ref: 6D07D835
__fassign.LIBCMT ref: 6D07D8BF
__fassign.LIBCMT ref: 6D07D8DE
WriteFile.KERNEL32(?,00000020,00000000,?,00000000), ref: 6D07D92D
WriteFile.KERNEL32(?,6D07DF89,00000001,?,00000000), ref: 6D07D967

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: FileWrite__fassign$Console
String ID:
API String ID: 3692784241-0
Opcode ID: 64e658a336ccf99febb5ea80991b74d0a667f94f446449cea3628dd66e9de4ec
Instruction ID: 869d2b5747806fb041bdc8626f588b3f7fd9553a1b3b652b2f5b2b79caa1eb37
Opcode Fuzzy Hash: 64e658a336ccf99febb5ea80991b74d0a667f94f446449cea3628dd66e9de4ec
Instruction Fuzzy Hash: 8A519071A14249EFEF10CFA8D881BEEBBF8EF8A310F14411AE555EB241E7709940CB65

Function 6D057C10 Relevance: 9.1, APIs: 6, Instructions: 122pipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6D057C4B
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,6D0587F7,?,00000000,0002BF20), ref: 6D057CCF

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CountNamedPeekPipeTick
String ID:
API String ID: 741616749-0
Opcode ID: 671600fa9beb8dd0a07900016c2d9b7c7189edac59947be56a97c6aca9201f5d
Instruction ID: 3bf108e48c3ade35652bfd37c8848133db36f953ea02c2a167854c9ceaf263a8
Opcode Fuzzy Hash: 671600fa9beb8dd0a07900016c2d9b7c7189edac59947be56a97c6aca9201f5d
Instruction Fuzzy Hash: 51516B74D00218DBDB22CF24C948FDAB7B5BB8D300F5180D8E9895B241CBB1A6C5EFA0

Function 6D057FA0 Relevance: 9.1, APIs: 6, Instructions: 104pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeA.KERNEL32(00000000,40000000,00000000,00000001,00000400,00000400,00000000,00000000), ref: 6D057FF7
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6D058016
ConnectNamedPipe.KERNEL32(000000FF,?), ref: 6D058058
GetLastError.KERNEL32 ref: 6D058062

Part of subcall function 6D057F60: CloseHandle.KERNEL32(6D05DA21,00002710,?,6D057E40,00002508,00002710,?,6D057A4F,?,?,6D058695,6D05DA21,?,?,6D05DA21,00002710), ref: 6D057F7D

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CreateNamedPipe$CloseConnectErrorEventHandleLast
String ID:
API String ID: 2388497103-0
Opcode ID: a112c8460864e0e51a8706aaa6cb761ae38e4e711d4c2fb25d28bbc897fcbe59
Instruction ID: a81f8ff68330e05a2967914a7cd60068cf321dbd64edddd17f29f87dd1c4059e
Opcode Fuzzy Hash: a112c8460864e0e51a8706aaa6cb761ae38e4e711d4c2fb25d28bbc897fcbe59
Instruction Fuzzy Hash: 81412A74D14208EBEF54CFA5C940BEDBBB4BF49320F608659EA25B72C0D7705A50CBA4

Function 6D0566B0 Relevance: 9.1, APIs: 6, Instructions: 72processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 6D0566EE
Process32First.KERNEL32(?,00000128), ref: 6D056708
CloseHandle.KERNEL32(?), ref: 6D05676C

Part of subcall function 6D0567B0: OpenProcess.KERNEL32(001FFFFF,00000000,FFFFFFFF), ref: 6D0567CC
Part of subcall function 6D0567B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 6D0567E1

CloseHandle.KERNEL32(?), ref: 6D05673A
Process32Next.KERNEL32(?,00000128), ref: 6D056784
CloseHandle.KERNEL32(?), ref: 6D056795

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CloseHandle$ProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3051378104-0
Opcode ID: 98c46b8686abbeccf0212a0b381e5e18776b88d511bc1b6ddbf7aa9e5608ee3d
Instruction ID: e107cd4e4ecbb3d1b3f2c6144f23ab7c0d54ef157ddfccef19ed4dc343f24864
Opcode Fuzzy Hash: 98c46b8686abbeccf0212a0b381e5e18776b88d511bc1b6ddbf7aa9e5608ee3d
Instruction Fuzzy Hash: AE2162759042199BEF24DF70CE44BEE77B5AF4A301F8041D8E9499B245EB34EAA4CF90

Function 6D0738AA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6D0736B4,6D0728BA,6D0723A9,?,6D0725C6,?,00000001,?,?,00000001,?,6D091620,0000000C,6D0726BA), ref: 6D0738B8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6D0738C6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6D0738DF
SetLastError.KERNEL32(00000000,6D0725C6,?,00000001,?,?,00000001,?,6D091620,0000000C,6D0726BA,?,00000001,?), ref: 6D073931

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: b09b2980d7ef90fc940c84edfb47ecb8e657e67b0eac58bcecdc4437cf0204ae
Instruction ID: 2b2f9821f071e28fb50e574cc00fb47698a45efbccc236826e40808a448aa5cf
Opcode Fuzzy Hash: b09b2980d7ef90fc940c84edfb47ecb8e657e67b0eac58bcecdc4437cf0204ae
Instruction Fuzzy Hash: 2E01D83261D7177EBB3117B4AC94B6F26B4FB4F7797211229E2345E1D0EF618810564C

Function 6D06A890 Relevance: 9.1, APIs: 6, Instructions: 55filethreadCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000002,00000000,00000002,00000080,00000000), ref: 6D06A8B6
GetCurrentThreadId.KERNEL32 ref: 6D06A8CB
GetCurrentProcessId.KERNEL32(000000FF,00000000,00000000,00000000,6D06A820), ref: 6D06A914
GetCurrentProcess.KERNEL32(00000000), ref: 6D06A91B
MiniDumpWriteDump.DBGHELP(00000000), ref: 6D06A922
CloseHandle.KERNEL32(000000FF), ref: 6D06A92C

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: Current$DumpProcess$CloseCreateFileHandleMiniThreadWrite
String ID:
API String ID: 1764008985-0
Opcode ID: 653fb980cee937d166e1fa9192481f3a8ca37c787ac6e7a15c3258e16753d369
Instruction ID: 604523fda68f649ad1119e3d9650283186d87bb39e26aac124727897054a54bd
Opcode Fuzzy Hash: 653fb980cee937d166e1fa9192481f3a8ca37c787ac6e7a15c3258e16753d369
Instruction Fuzzy Hash: 36110A70D10209EFEF10DFA0C859BAEBBB4FB09302F518119E615AB281D7785545CFE4

Function 6D052F40 Relevance: 9.0, APIs: 6, Instructions: 43fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000), ref: 6D052F61
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 6D052F73
CopyFileW.KERNEL32(00000000,?,?), ref: 6D052F86
GetLastError.KERNEL32 ref: 6D052F90
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 6D052FA3
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 6D052FB5

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: File$Attributes$CopyErrorLast
String ID:
API String ID: 2106489313-0
Opcode ID: 5d01bb8cb7676249e7124613bd7819e16fb68b11d6c36c63fd4304035f1d0f27
Instruction ID: 39f12ec008cdd3ae844644db0bbfcbbfa61d44738f13ed9ded19688f7c65a103
Opcode Fuzzy Hash: 5d01bb8cb7676249e7124613bd7819e16fb68b11d6c36c63fd4304035f1d0f27
Instruction Fuzzy Hash: 0811C5B9514288AFCF00DFA4C858B9F7FB8AB4A342F108188FD499B340C7369555CFA5

Function 6D052EC0 Relevance: 9.0, APIs: 6, Instructions: 41fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000), ref: 6D052EE1
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 6D052EF3
MoveFileW.KERNEL32(00000000,?), ref: 6D052F01
GetLastError.KERNEL32 ref: 6D052F0B
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 6D052F1E
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 6D052F30

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: File$Attributes$ErrorLastMove
String ID:
API String ID: 4019241439-0
Opcode ID: bdd7ece2c50cdb4a433b633e252bcbd67787c4094c985dab3626a8ed66db30eb
Instruction ID: 5e6929e4cdc90f91ac14bec1e3674741758cf01dc4dd4dd0f6ae038ca26bba5f
Opcode Fuzzy Hash: bdd7ece2c50cdb4a433b633e252bcbd67787c4094c985dab3626a8ed66db30eb
Instruction Fuzzy Hash: A20193B9914248EFDF00DFA4C858B9FBBB8AB4A342F008198FD059B340D7369555CFA5

Function 6D053070 Relevance: 9.0, APIs: 6, Instructions: 37fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000), ref: 6D053088
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 6D05309A
DeleteFileW.KERNEL32(00000000), ref: 6D0530A4
GetLastError.KERNEL32 ref: 6D0530AE
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 6D0530C1
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 6D0530D3

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: File$Attributes$DeleteErrorLast
String ID:
API String ID: 2267219331-0
Opcode ID: 4a48131ee9602e3a575f500d83024d71ebd4569f8a26c8474eff2e2f69cb2595
Instruction ID: 169bdbe0e5a458fa0f06a7a6abcd0a2e391f35c1e65af2106f137b6fd77b257f
Opcode Fuzzy Hash: 4a48131ee9602e3a575f500d83024d71ebd4569f8a26c8474eff2e2f69cb2595
Instruction Fuzzy Hash: C601D679914248ABCF00DFA4C458B9FBFB8AB4A346F008199FD459B340DB369645CFA5

Function 6D05F000 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

Part of subcall function 6D051200: GetLogicalDriveStringsW.KERNEL32(00000100,?), ref: 6D051246
Part of subcall function 6D051200: GetDriveTypeW.KERNEL32(?), ref: 6D0512BB
Part of subcall function 6D051200: GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 6D051307

Concurrency::task_options::get_scheduler.LIBCPMTD ref: 6D05F078
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 6D05F0BA
_swprintf.LIBCMTD ref: 6D05F119

Part of subcall function 6D055C90: __vswprintf_s_l.LIBCONCRTD ref: 6D055CAE

_memcpy_s.LIBCPMTD ref: 6D05F17B

Strings

%c:\, xrefs: 6D05F10E

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: Drive$Affinity::operator!=Concurrency::details::Concurrency::task_options::get_schedulerDiskFreeHardwareLogicalSpaceStringsType__vswprintf_s_l_memcpy_s_swprintf
String ID: %c:\
API String ID: 2504515757-3142399695
Opcode ID: ab19866ed3f5198e0b9e0704da6545bf3b6b36d67cf93e61a1788470b0bead35
Instruction ID: 34c400a63a46de5b19d91504a383af54642cf08f31cf290f7821536cb7397713
Opcode Fuzzy Hash: ab19866ed3f5198e0b9e0704da6545bf3b6b36d67cf93e61a1788470b0bead35
Instruction Fuzzy Hash: DC613B74A04209DFDB04DFA4C990BEEB7B5FF48304F108558E916AB391DB30AE15CBA1

Function 6D07891F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,6D0788D0,?,?,6D078898,?,?), ref: 6D07893F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6D078952
FreeLibrary.KERNEL32(00000000,?,?,?,6D0788D0,?,?,6D078898,?,?), ref: 6D078975

Strings

mscoree.dll, xrefs: 6D078938
CorExitProcess, xrefs: 6D07894A

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b436b43006dddb45a536de9141fb3e1957a1a06794bcda5eec66fa441ffa388a
Instruction ID: 2b8ccf0a8f4eea605419dcdfa8825dc17a61c8cfa389f1782bb06860f8945fc6
Opcode Fuzzy Hash: b436b43006dddb45a536de9141fb3e1957a1a06794bcda5eec66fa441ffa388a
Instruction Fuzzy Hash: FAF04F30A14119BBEF119BA1CC48BAEBFB4EB06612F4100A4F905A6182DB719940CBD5

Function 6D07E355 Relevance: 7.7, APIs: 5, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6D07E3D9
__alloca_probe_16.LIBCMT ref: 6D07E49F
__freea.LIBCMT ref: 6D07E50B

Part of subcall function 6D07A5FF: HeapAlloc.KERNEL32(00000000,6D06A587,?,?,6D07212E,6D06A587,?,6D06A587,0001507C), ref: 6D07A631

__freea.LIBCMT ref: 6D07E514
__freea.LIBCMT ref: 6D07E539

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: be46e0bfd39b147d984da23014a0ee306fca41b1dd799c758d432beda35635d1
Instruction ID: 186a2b9b50ade280f4294e7a34796f4cf29cd2489df10d22a6ae7d2f7e857e2d
Opcode Fuzzy Hash: be46e0bfd39b147d984da23014a0ee306fca41b1dd799c758d432beda35635d1
Instruction Fuzzy Hash: 3751AE7260621BABFB318E649C44FFB37A9EB85754F124168FE18DF150EB31DC1086A9

Function 6D064E50 Relevance: 7.6, APIs: 5, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,D4C6F04B), ref: 6D064ED0
_DebugHeapAllocator.LIBCPMTD ref: 6D064EE2
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 6D064F2A
error_info_injector.LIBCPMTD ref: 6D064F96
LeaveCriticalSection.KERNEL32(?,?,?,00000004), ref: 6D064FB1

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$Affinity::operator!=AllocatorConcurrency::details::DebugEnterHardwareHeapLeaveerror_info_injector
String ID:
API String ID: 176887040-0
Opcode ID: 6eac9e0cb0ec30d6d3da861a0caa1fa637e9b0d89aea86f4cf11adf89574eed9
Instruction ID: 823b3aa2db4235571a02a9c3dc8a4576a1541c58d16ac64542f457f590dcaffb
Opcode Fuzzy Hash: 6eac9e0cb0ec30d6d3da861a0caa1fa637e9b0d89aea86f4cf11adf89574eed9
Instruction Fuzzy Hash: 2951E370D08248EFEB04DFA4D990BEEBBB5FF48304F508129E5167B290DB746945CB65

Function 6D064C70 Relevance: 7.6, APIs: 5, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,D4C6F04B), ref: 6D064CF0
_DebugHeapAllocator.LIBCPMTD ref: 6D064D02
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 6D064D4A
error_info_injector.LIBCPMTD ref: 6D064DB2
LeaveCriticalSection.KERNEL32(?,?,?,00000004), ref: 6D064DCD

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$Affinity::operator!=AllocatorConcurrency::details::DebugEnterHardwareHeapLeaveerror_info_injector
String ID:
API String ID: 176887040-0
Opcode ID: 887326dbc5b0e7005f55541151fc6de5f24232bb90fc98f6750d32d6be9e36bd
Instruction ID: d680d5759247e24ea989b485718df4448ac0f60f94f33677dd2679038a16657e
Opcode Fuzzy Hash: 887326dbc5b0e7005f55541151fc6de5f24232bb90fc98f6750d32d6be9e36bd
Instruction Fuzzy Hash: 6241F670D08249EFEB08DFA4D995BEEBBB5FF48304F508129E61277291DB706904CB64

Function 6D0655B0 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(D4C6EF0F,?,?,?,?,?,6D061E39,D4C6F04B,D4C6F04B,D4C6F04B), ref: 6D0655CC
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 6D065608
std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6D065617
LeaveCriticalSection.KERNEL32(D4C6EF0F,?,D4C6F04B,00000000,?,D4C6F04B,D4C6F04B,00000004), ref: 6D065671
LeaveCriticalSection.KERNEL32(D4C6EF0F,00000000,?,D4C6F04B,D4C6F04B,00000004,?,?,?,?,?,6D061E39,D4C6F04B,D4C6F04B,D4C6F04B), ref: 6D065683

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Affinity::operator!=Concurrency::details::EnterHardwareMutex_baseMutex_base::~_std::_
String ID:
API String ID: 3020211749-0
Opcode ID: 9574b5853ca28009ea6325c34d4400fa54260bf4d7e8e6aac04713fbfea39898
Instruction ID: b00ca8a7ee0742003a64a1505156b2d9b5f2f934cbb75bca9e2f4d1d9bb036a1
Opcode Fuzzy Hash: 9574b5853ca28009ea6325c34d4400fa54260bf4d7e8e6aac04713fbfea39898
Instruction Fuzzy Hash: DC21F874D04109ABEB08DFA4D854BFEBBB4AF49304F418169E612A7281DB34AA44CBA5

Function 6D0654C0 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,6D0618F1,?,?,?,D4C6F04B), ref: 6D0654DC
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 6D065518
std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6D065527
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,?,?,00000004), ref: 6D065581
LeaveCriticalSection.KERNEL32(?,00000000,?,?,?,00000004,?,?,?,?,6D0618F1,?,?,?,D4C6F04B), ref: 6D065593

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Affinity::operator!=Concurrency::details::EnterHardwareMutex_baseMutex_base::~_std::_
String ID:
API String ID: 3020211749-0
Opcode ID: 2959f4d02bee21e7a26c62f7dcfae1931b746c9e6642c12aa473b5ebc9579a1b
Instruction ID: e56f2696919f87245d09b96d80da45b62f011284984f4b5e5f8c379e3f4c9c3a
Opcode Fuzzy Hash: 2959f4d02bee21e7a26c62f7dcfae1931b746c9e6642c12aa473b5ebc9579a1b
Instruction Fuzzy Hash: 28213074D04149EFEB08DFA4C854BFEB7B5EF48309F408169D612A7281DB34AA44CFA4

Function 6D052B90 Relevance: 7.6, APIs: 5, Instructions: 50filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 6D052BB0
SetFileTime.KERNEL32(000000FF,?,?,?), ref: 6D052BCF
GetLastError.KERNEL32 ref: 6D052BF1
CloseHandle.KERNEL32(000000FF), ref: 6D052C00
GetLastError.KERNEL32 ref: 6D052C08

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleTime
String ID:
API String ID: 1269242970-0
Opcode ID: 16879281524b39c0b16624a40137aae755011759d4cd34d5a05662331b455cf6
Instruction ID: 1bc5d2652ea86148cf4ca17ec09839b88f686d7d0c5b7e9525e074517f8609c8
Opcode Fuzzy Hash: 16879281524b39c0b16624a40137aae755011759d4cd34d5a05662331b455cf6
Instruction Fuzzy Hash: BF118234908348BFEF11CFB4C945BDE7FB4AF0A305F108298E951A7281D7759659CB54

Function 6D056600 Relevance: 7.5, APIs: 5, Instructions: 49processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 6D056637
Process32First.KERNEL32(?,00000128), ref: 6D056651
CloseHandle.KERNEL32(?), ref: 6D05666D
Process32Next.KERNEL32(?,00000128), ref: 6D056685
CloseHandle.KERNEL32(?), ref: 6D056696

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 668cc4563b04536cf0e232367ddf94d3faa7fd6e89ade19d055fbda57b7ebb93
Instruction ID: abb1acccc8f57b3ef7eb34fe07bae459abaa094ca24ee1178355fd7592628e71
Opcode Fuzzy Hash: 668cc4563b04536cf0e232367ddf94d3faa7fd6e89ade19d055fbda57b7ebb93
Instruction Fuzzy Hash: D3113071A102189BDF20DF70CE55BEE77F4BB0E701F814198E60997241DB309A54CF91

Function 6D080317 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6D08032F

Part of subcall function 6D0799A9: HeapFree.KERNEL32(00000000,00000000,?,6D0803AA,6D06A587,00000000,6D06A587,?,?,6D0803D1,6D06A587,00000007,6D06A587,?,6D07D38B,6D06A587), ref: 6D0799BF
Part of subcall function 6D0799A9: GetLastError.KERNEL32(6D06A587,?,6D0803AA,6D06A587,00000000,6D06A587,?,?,6D0803D1,6D06A587,00000007,6D06A587,?,6D07D38B,6D06A587,6D06A587), ref: 6D0799D1

_free.LIBCMT ref: 6D080341
_free.LIBCMT ref: 6D080353
_free.LIBCMT ref: 6D080365
_free.LIBCMT ref: 6D080377

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 95fb4800e770465de332450e0d8985d03157737a0eddb1c83220957bd1726558
Instruction ID: 356ba8f9bb9135d549e96d768821cf7967c97261eb9dc8bf0f84fbe233e9f044
Opcode Fuzzy Hash: 95fb4800e770465de332450e0d8985d03157737a0eddb1c83220957bd1726558
Instruction Fuzzy Hash: 2CF049B1519605ABEF30CB69F884F2BB3EDFA593107615805F168DF500CB31F8808AA8

Function 6D061980 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

_swprintf.LIBCMTD ref: 6D061A35

Part of subcall function 6D055C90: __vswprintf_s_l.LIBCONCRTD ref: 6D055CAE

Part of subcall function 6D05EFD0: lstrcatA.KERNEL32(00000000,00000000,?,6D05F449), ref: 6D05EFEC

_memcpy_s.LIBCPMTD ref: 6D061AB7
_memcpy_s.LIBCPMTD ref: 6D061C74

Part of subcall function 6D069B70: EnterCriticalSection.KERNEL32(-00000078,?,?,6D05DD1A,?,00000010,00000002), ref: 6D069BB8
Part of subcall function 6D069B70: LeaveCriticalSection.KERNEL32(-00000078), ref: 6D069CAC

Part of subcall function 6D065460: EnterCriticalSection.KERNEL32(?), ref: 6D065478
Part of subcall function 6D065460: LeaveCriticalSection.KERNEL32(?,0000001E), ref: 6D0654A5

Strings

TOnePipeShell [%d] Create Error! It's Already Exists!, xrefs: 6D061A24

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave_memcpy_s$__vswprintf_s_l_swprintflstrcat
String ID: TOnePipeShell [%d] Create Error! It's Already Exists!
API String ID: 1204231629-2958404492
Opcode ID: 169558251bdde2025763452b79339a36edeb2bd98f0886f86ddc19849d114878
Instruction ID: 72c4af83739420952c5bbef1b36c982c2c2546636ce0346b8a5a5e1da88a6960
Opcode Fuzzy Hash: 169558251bdde2025763452b79339a36edeb2bd98f0886f86ddc19849d114878
Instruction Fuzzy Hash: 8BB109B5A042589FDB15DF54CC90BAAB3B9FF49704F508598E9099B390DB31AF90CFA0

Function 6D05F200 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 6D05F392
_swprintf.LIBCMTD ref: 6D05F3FE
_memcpy_s.LIBCPMTD ref: 6D05F480

Part of subcall function 6D05E880: EnterCriticalSection.KERNEL32(D4C6F033,00000000,?,6D05F2A9,?,00000000,00000000,?,D4C6F04B), ref: 6D05E88E
Part of subcall function 6D05E880: LeaveCriticalSection.KERNEL32(D4C6F033,?,6D05F2A9,?,00000000,00000000,?,D4C6F04B), ref: 6D05E8A4

Part of subcall function 6D056800: FormatMessageA.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 6D05685D

Part of subcall function 6D05EFD0: lstrcatA.KERNEL32(00000000,00000000,?,6D05F449), ref: 6D05EFEC

Strings

Query [%S] error! Query is running, xrefs: 6D05F3ED

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection_memcpy_s$EnterFormatLeaveMessage_swprintflstrcat
String ID: Query [%S] error! Query is running
API String ID: 1163548326-1242599298
Opcode ID: 515825f822d4d2e2a7e4fe7621ae7e6ed584c293e9207629e52a793011283909
Instruction ID: ee0e1675cfbd8e7cf4278a3fd289cbd3956488b82e9489770866828636ed68c3
Opcode Fuzzy Hash: 515825f822d4d2e2a7e4fe7621ae7e6ed584c293e9207629e52a793011283909
Instruction Fuzzy Hash: B1913F75A042059FEB04DF64CC90BAEB776FF89314F404598E9199B381DB31AE64CF90

Function 6D0624A0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 6D061ED0: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 6D061EFD
Part of subcall function 6D061ED0: CloseHandle.KERNEL32(000000FF), ref: 6D061F10

_memcpy_s.LIBCPMTD ref: 6D062683

Part of subcall function 6D062230: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000), ref: 6D062283
Part of subcall function 6D062230: GetLastError.KERNEL32 ref: 6D062292

Part of subcall function 6D05EFD0: lstrcatA.KERNEL32(00000000,00000000,?,6D05F449), ref: 6D05EFEC

_memcpy_s.LIBCPMTD ref: 6D0625AD

Strings

Send keyboardData error, file is not exit! , xrefs: 6D0625E8
Send keyboardData error, file is not exit!, xrefs: 6D062547

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CreateFile_memcpy_s$CloseErrorHandleLastlstrcat
String ID: Send keyboardData error, file is not exit!$Send keyboardData error, file is not exit!
API String ID: 1386899110-2965487200
Opcode ID: 86110213cfebf326da675316874645de7464175216ee7cdb684a4458c4d6bb5b
Instruction ID: 215b1b54145736f742f13a6d34ff85492a051ca3285c5e1dc19b15438ee58d75
Opcode Fuzzy Hash: 86110213cfebf326da675316874645de7464175216ee7cdb684a4458c4d6bb5b
Instruction Fuzzy Hash: CE817AB5A04209DFDB04DFA8D890BAEB7B5FF48304F14865DE9159B391EB31E950CBA0

Function 6D061CF0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 6D055E10: EnterCriticalSection.KERNEL32(D4C6F043,D4C6F04B,00000004,?), ref: 6D055E3A
Part of subcall function 6D055E10: WaitForSingleObject.KERNEL32(000000FF,000000FF), ref: 6D055E60
Part of subcall function 6D055E10: LeaveCriticalSection.KERNEL32(?), ref: 6D055E77

_swprintf.LIBCMTD ref: 6D061D86

Part of subcall function 6D055C90: __vswprintf_s_l.LIBCONCRTD ref: 6D055CAE

Part of subcall function 6D05EFD0: lstrcatA.KERNEL32(00000000,00000000,?,6D05F449), ref: 6D05EFEC

_memcpy_s.LIBCPMTD ref: 6D061DF3
_memcpy_s.LIBCPMTD ref: 6D061E63

Strings

OnePipeShell [%d] Close error!, xrefs: 6D061D7B

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection_memcpy_s$EnterLeaveObjectSingleWait__vswprintf_s_l_swprintflstrcat
String ID: OnePipeShell [%d] Close error!
API String ID: 3217904910-2944261958
Opcode ID: 2068383d0a4bd0640fbf3c450fda99fcf8f0613901efb353727efa0dc971a59c
Instruction ID: 2a9152637ad100b939ec641a562137685f1fbbc7bb19341a6f61a7d9ccbb2fac
Opcode Fuzzy Hash: 2068383d0a4bd0640fbf3c450fda99fcf8f0613901efb353727efa0dc971a59c
Instruction Fuzzy Hash: 2E5139B4A04249DFEB04DF94C890BAEB3B6FF89308F108559E9159F395DB31AD51CBA0

Function 6D0629F0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 6D062AC2
_memcpy_s.LIBCPMTD ref: 6D062B63

Part of subcall function 6D05EFD0: lstrcatA.KERNEL32(00000000,00000000,?,6D05F449), ref: 6D05EFEC

Strings

Screen Stop error, Class is NULL!, xrefs: 6D062AFD
Screen Stop error!, xrefs: 6D062A5C

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: _memcpy_s$lstrcat
String ID: Screen Stop error!$Screen Stop error, Class is NULL!
API String ID: 3156544786-797384994
Opcode ID: 0222aded799ae4a8db61a4bb2b406c02f8aa9164379346db936f014e87225d70
Instruction ID: a69c54ffed0d771dd9b32d8d5501716f93da37cb556523be822c83e7a0a10066
Opcode Fuzzy Hash: 0222aded799ae4a8db61a4bb2b406c02f8aa9164379346db936f014e87225d70
Instruction Fuzzy Hash: BC515A78A00209DFEB04CF68C891BAEB7B1FF49314F108658E9159F391DB31E951CBA0

Function 6D068EA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,D4C6F04B), ref: 6D068ED4
_memcpy_s.LIBCPMTD ref: 6D068F79
LeaveCriticalSection.KERNEL32(?,?,?), ref: 6D068FB8

Strings

Deal output img error!, xrefs: 6D068F21

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave_memcpy_s
String ID: Deal output img error!
API String ID: 2615672426-2701914271
Opcode ID: 32038c783383dd65f4e62a96076fe80fe4b8f4c886b4190ff30e12a1d5a0ea0f
Instruction ID: ab4eb260f48adb918ad51f63f557e293a8de987a070f9d8e73f6c6de07d55c7b
Opcode Fuzzy Hash: 32038c783383dd65f4e62a96076fe80fe4b8f4c886b4190ff30e12a1d5a0ea0f
Instruction Fuzzy Hash: C0416075A14148AFDB08CFA4DC50FEEB7B9FF49214F044218F505A7381DB31A950CBA4

Function 6D075A9A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D075AC8
_free.LIBCMT ref: 6D075AEE

Strings

@0m, xrefs: 6D075B07
0m, xrefs: 6D075B55

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: _free
String ID: @0m$0m
API String ID: 269201875-1437914988
Opcode ID: a0db390ca6d885732db758fe6b858c359eaec7737827a6e84298a7aa7256284c
Instruction ID: 0732263d5a5fa92d1e2d9acb3a33661c94c33d33d8c020406a920275d423bba3
Opcode Fuzzy Hash: a0db390ca6d885732db758fe6b858c359eaec7737827a6e84298a7aa7256284c
Instruction Fuzzy Hash: 9611CB75E142015BFB305B3DAC54BBB37B4B749734F111616E629CF1D4E7B0C4428A89

Function 6D05D5E0 Relevance: 6.4, APIs: 5, Instructions: 145sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001), ref: 6D05D605

Part of subcall function 6D05DE10: EnterCriticalSection.KERNEL32(?,?,6D05D7F9), ref: 6D05DE26
Part of subcall function 6D05DE10: LeaveCriticalSection.KERNEL32(?,?,6D05D7F9), ref: 6D05DE3E

EnterCriticalSection.KERNEL32(?), ref: 6D05D6AF
LeaveCriticalSection.KERNEL32(?,00000000), ref: 6D05D6D0
EnterCriticalSection.KERNEL32(?), ref: 6D05D6E0

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$Leave$Sleep
String ID:
API String ID: 2452663664-0
Opcode ID: ee3322c67635f362e432fb99faf1ce225350a7476679380241f39233b81c51f4
Instruction ID: d5e253b29e11df7e418e6a1b976feeb7923c508469d6a1f0936f72de1c80993c
Opcode Fuzzy Hash: ee3322c67635f362e432fb99faf1ce225350a7476679380241f39233b81c51f4
Instruction Fuzzy Hash: 9F514BB4E00209DBDB04CFE8C884BAEB7B5BF88304F148569E915AB341D735AA55CBA5

Function 6D07ACC0 Relevance: 6.3, APIs: 4, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6D07AD47

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 5e6ba0af27dc66adfa9354b1179fd89244a3ffa8c59286eda5a176f6145826b5
Instruction ID: fca4d40ab87315c6c650618f07c26a2cf0b6cdb8730d942a5bd622cc0e75115c
Opcode Fuzzy Hash: 5e6ba0af27dc66adfa9354b1179fd89244a3ffa8c59286eda5a176f6145826b5
Instruction Fuzzy Hash: 9AB124719082469FFB21CF69C850BAEBBF5EF49310F2581AAE9499F241D634C901CB68

Function 6D0554A0 Relevance: 6.1, APIs: 4, Instructions: 119fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?), ref: 6D055518
GetLastError.KERNEL32 ref: 6D055524

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: ed8a3b229d9e669c9fc1526b8db8b6831ad0ad7d6c28a4742cbd6ffbfa1f4084
Instruction ID: 6c3a157136987b5424e65590a00cc0d5c1ec96f3e17b93608d4f7ff7cc29c56a
Opcode Fuzzy Hash: ed8a3b229d9e669c9fc1526b8db8b6831ad0ad7d6c28a4742cbd6ffbfa1f4084
Instruction Fuzzy Hash: A251C874A0024ADFDB04CF98C994BAEB7B2BF49304F108658E916AB381D734A951CFA4

Function 6D0552A0 Relevance: 6.1, APIs: 4, Instructions: 89fileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(000000FF,?,000000FF,00000000,00000000), ref: 6D055310
WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 6D05533B
GetLastError.KERNEL32 ref: 6D055345
CloseHandle.KERNEL32(?), ref: 6D055357

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: File$CloseErrorHandleLastPointerWrite
String ID:
API String ID: 2796458406-0
Opcode ID: 87a5674f47b2ea3d4f0371d48076cfe930bebc2361f86c6c03de369a7fb48cc7
Instruction ID: 5f64a38b49d2cf6ba7ee7881a5e02524f7d73122ff57fd597306aa0511f32d1e
Opcode Fuzzy Hash: 87a5674f47b2ea3d4f0371d48076cfe930bebc2361f86c6c03de369a7fb48cc7
Instruction Fuzzy Hash: 0541B7B4A00209DFDB04CF98C594BAEBBB1FF49304F508699E919AB381D770AA51CF94

Function 6D079708 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6D076141,?,?,?,?,6D077D32,?), ref: 6D07970D
_free.LIBCMT ref: 6D079768
_free.LIBCMT ref: 6D07979E
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,?,6D076141,?,?,?,?,6D077D32,?), ref: 6D0797A9

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: f6d382ee5a4e43a35dd2107b488af9dbcc906d5b231718b9b5830f6efa789d54
Instruction ID: 76d1b8e450e68cebf9b1ee326b35b14d227b00bf15801aea5c3e7c4898b4d266
Opcode Fuzzy Hash: f6d382ee5a4e43a35dd2107b488af9dbcc906d5b231718b9b5830f6efa789d54
Instruction Fuzzy Hash: 501152712196126EFB321BB87CC5B6F35ECFB57279B114224F6289F1A0DB518800D55C

Function 6D079859 Relevance: 6.1, APIs: 4, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,6D06A587,?,6D077998,6D07A642,?,?,6D07212E,6D06A587,?,6D06A587,0001507C), ref: 6D07985E
_free.LIBCMT ref: 6D0798B9
_free.LIBCMT ref: 6D0798EF
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6D06A587,?,6D077998,6D07A642,?,?,6D07212E,6D06A587,?,6D06A587,0001507C), ref: 6D0798FA

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 6107527da413dfca561821c1557edc207296396e02e55c40c7740a4e01c5ae5c
Instruction ID: 2747a856594534e4cf40f56d73de01e11049dfdb0be17a15a0105e6cbe98d511
Opcode Fuzzy Hash: 6107527da413dfca561821c1557edc207296396e02e55c40c7740a4e01c5ae5c
Instruction Fuzzy Hash: BB01C4716182026AFF7257B87CC0FAB39E9FB57378B111234F6299F0E0DB518800856C

Function 6D073B62 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 6D073B7C

Part of subcall function 6D073AC9: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 6D073AF8
Part of subcall function 6D073AC9: ___AdjustPointer.LIBCMT ref: 6D073B13

_UnwindNestedFrames.LIBCMT ref: 6D073B91
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 6D073BA2
CallCatchBlock.LIBVCRUNTIME ref: 6D073BCA

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 1d2cbf3fc5d85ee38127e2180f4d2801c9af14cf3da80acdaadcd3532b5d838e
Instruction ID: daeffea211908d1417c334f66928e57d810100e1b970f3c34e3a19d60fc6c1f3
Opcode Fuzzy Hash: 1d2cbf3fc5d85ee38127e2180f4d2801c9af14cf3da80acdaadcd3532b5d838e
Instruction Fuzzy Hash: 7A012932504109BBEF225E95CC41EEF7B69EF8C758F054118FE285A120C372E861DBA4

Function 6D07C211 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105,6D093F48), ref: 6D07C23A
GetLastError.KERNEL32 ref: 6D07C244
__dosmaperr.LIBCMT ref: 6D07C24B
_mbstowcs.LIBCMT ref: 6D07C260

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: ErrorFileLastModuleName__dosmaperr_mbstowcs
String ID:
API String ID: 2664030482-0
Opcode ID: fd6936986480dceb652525ce1941798db78ced82037571cbcd5c22757af38b3d
Instruction ID: 5a8d61ba67a5be50e67daad242beb026d4da965a68eb0da08cefa2d58a45ef47
Opcode Fuzzy Hash: fd6936986480dceb652525ce1941798db78ced82037571cbcd5c22757af38b3d
Instruction Fuzzy Hash: 20F0CD32A0410DABDF20DFA4DD48BAF77B8EB5A304F050498E6199B140EB709A508B98

Function 6D061ED0 Relevance: 6.0, APIs: 4, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 6D061EFD
CloseHandle.KERNEL32(000000FF), ref: 6D061F10
GetLastError.KERNEL32 ref: 6D061F1F
GetLastError.KERNEL32 ref: 6D061F2C

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandle
String ID:
API String ID: 614986841-0
Opcode ID: 6d32aefd0dca4fb443590daa8850539c66105fa197dac869e0a9086f60ee966c
Instruction ID: 862cb4c3647b3aff763c7bfe5a8f0e49b8a0d1b59b07804cdb51d472872af7e7
Opcode Fuzzy Hash: 6d32aefd0dca4fb443590daa8850539c66105fa197dac869e0a9086f60ee966c
Instruction Fuzzy Hash: 2D011974550308FBEF20DFA4C849B9D7BB4FB0A326F608258E9256B2C0D7709640CB95

Function 6D081DCF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,0000002C,00000000,?,?,6D081583,?,00000001,?,00000001,?,6D07D9ED,00000020,00000000,00000001), ref: 6D081DE6
GetLastError.KERNEL32(?,6D081583,?,00000001,?,00000001,?,6D07D9ED,00000020,00000000,00000001,00000020,00000001,?,6D07DF6E,00000008), ref: 6D081DF2

Part of subcall function 6D081DB8: CloseHandle.KERNEL32(FFFFFFFE,6D081E02,?,6D081583,?,00000001,?,00000001,?,6D07D9ED,00000020,00000000,00000001,00000020,00000001), ref: 6D081DC8

___initconout.LIBCMT ref: 6D081E02

Part of subcall function 6D081D7A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6D081DA9,6D081569,00000001,?,6D07D9ED,00000020,00000000,00000001,00000020), ref: 6D081D8D

WriteConsoleW.KERNEL32(?,?,0000002C,00000000,?,6D081583,?,00000001,?,00000001,?,6D07D9ED,00000020,00000000,00000001,00000020), ref: 6D081E17

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: ad2c100f812faedb29bdd3e94f30e53c29d43f9e784f26f4850e8dbb969ad0c1
Instruction ID: 3e210f9a24acea87cc71affe57fb21de05250fed48bd2baba46a88940db2b337
Opcode Fuzzy Hash: ad2c100f812faedb29bdd3e94f30e53c29d43f9e784f26f4850e8dbb969ad0c1
Instruction Fuzzy Hash: 1DF0C036514255BBDF221F95CC08B9A7F76FF4A7A3F464014FB2997121CB3288209BD5

Function 6D079146 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D07914F

Part of subcall function 6D0799A9: HeapFree.KERNEL32(00000000,00000000,?,6D0803AA,6D06A587,00000000,6D06A587,?,?,6D0803D1,6D06A587,00000007,6D06A587,?,6D07D38B,6D06A587), ref: 6D0799BF
Part of subcall function 6D0799A9: GetLastError.KERNEL32(6D06A587,?,6D0803AA,6D06A587,00000000,6D06A587,?,?,6D0803D1,6D06A587,00000007,6D06A587,?,6D07D38B,6D06A587,6D06A587), ref: 6D0799D1

_free.LIBCMT ref: 6D079162
_free.LIBCMT ref: 6D079173
_free.LIBCMT ref: 6D079184

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 46a3c0e20ada2e0aa78e323bc3c8416ff84baa1f02d58cb95f52e47af69c0e68
Instruction ID: eac649cac2103ae49401c1f22a4432c4fb3923f759e5efea8b388376673947bd
Opcode Fuzzy Hash: 46a3c0e20ada2e0aa78e323bc3c8416ff84baa1f02d58cb95f52e47af69c0e68
Instruction Fuzzy Hash: C4E0BF79814125BEBE219F28F8017453A31F79E618303A006F5301F210C7728511DBCE

Function 6D077CD2 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 6D077E3F

Strings

+, xrefs: 6D077D7A
-, xrefs: 6D077D6D

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 10c0253171a2ec4e6f472f94dc16206b29dc5e93729e83d4680e20ea9da39f78
Instruction ID: 7938f9fd05cc20bb82ad61b1e92579c134b031f169a5b535175affedb9568f6c
Opcode Fuzzy Hash: 10c0253171a2ec4e6f472f94dc16206b29dc5e93729e83d4680e20ea9da39f78
Instruction Fuzzy Hash: A891D530D0424A9EFF25CE69C8507FDBBB5FF8A3A4F148256E8749F290D37099058B99

Function 6D0789C3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

H?m, xrefs: 6D078A06

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID:
String ID: H?m
API String ID: 0-2987568079
Opcode ID: 0eed2c5cbf2ecea1463b50ed4bff91e371f3ed177e34f120ec919607e09c129d
Instruction ID: 60e7080e85d68c2a90f5f00116bc916c9b77f6d8338fcd00a84a7574fcbd0c00
Opcode Fuzzy Hash: 0eed2c5cbf2ecea1463b50ed4bff91e371f3ed177e34f120ec919607e09c129d
Instruction Fuzzy Hash: FF415171E44215BFFB21CF99D880BEEBBF8FB89310B154066E6149F240D7B19A41CB69

Function 6D07B6B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6D07B72D

Strings

dCm, xrefs: 6D07B6FA
`Cm, xrefs: 6D07B6E8

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: _free
String ID: `Cm$dCm
API String ID: 269201875-747795958
Opcode ID: edc1fbef9deabc65a92137f4aa2efe2e4dc221c01a8ea03355d71bdfb641532c
Instruction ID: 3b14cfc7fb605df61ad471acf7a05a35a77973f8f2abdb99cccb9067d017d46e
Opcode Fuzzy Hash: edc1fbef9deabc65a92137f4aa2efe2e4dc221c01a8ea03355d71bdfb641532c
Instruction Fuzzy Hash: 5E11D3755097029FF7308F29D481B56B7F4FB45768F21801EE6888F240EB71D480C799

Function 6D07297E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

h>m, xrefs: 6D0729FA
\>m, xrefs: 6D0729D9

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID:
String ID: \>m$h>m
API String ID: 0-3309143754
Opcode ID: a9d52955ee7b7f737d2b5d74e0b200a7ec63af4acad38daf9b293e7ecde51752
Instruction ID: 8239de163e8a46d4cccb9f18249de9e5c1763a078378005dbc87967fef1ecc0c
Opcode Fuzzy Hash: a9d52955ee7b7f737d2b5d74e0b200a7ec63af4acad38daf9b293e7ecde51752
Instruction Fuzzy Hash: 69119E36D046196BEF31DF7884003EE77F55B0A728F05506AED24EF280D7B096419BA9

Function 6D072103 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 6D07218A
___raise_securityfailure.LIBCMT ref: 6D072271

Strings

;mp;m, xrefs: 6D07226C

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: ;mp;m
API String ID: 3761405300-3512574690
Opcode ID: 8ccffeb438eca89b2baa2f966f5123e38018c9c2cdd925a054f77a8ee5a9e018
Instruction ID: 164095473e0f16aaa7cb79a1f911821a3b0fda2bb4da57537fc5300e6689d1d7
Opcode Fuzzy Hash: 8ccffeb438eca89b2baa2f966f5123e38018c9c2cdd925a054f77a8ee5a9e018
Instruction Fuzzy Hash: 6F21EEF8515704AAEF14CF29D1917567BF4BB5E314F10A42AE60D9F381EBB09982CF48

Function 6D054D10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6D054D1D
std::_Xinvalid_argument.LIBCPMT ref: 6D054D3B

Part of subcall function 6D0720D6: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6D0720E2
Part of subcall function 6D0720D6: __CxxThrowException@8.LIBVCRUNTIME ref: 6D0720F0

Strings

list<T> too long, xrefs: 6D054D36

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: std::_$Exception@8Mutex_baseMutex_base::~_ThrowXinvalid_argumentstd::invalid_argument::invalid_argument
String ID: list<T> too long
API String ID: 2057655285-4027344264
Opcode ID: d5b35a84bcb92276f900cc87a6b9a2ffcd6c700d4e52ff146b363c11fd10d091
Instruction ID: 2189435b10cf8d076fff2054b9d542116c170a1af57c9db3c101e4c73d317979
Opcode Fuzzy Hash: d5b35a84bcb92276f900cc87a6b9a2ffcd6c700d4e52ff146b363c11fd10d091
Instruction Fuzzy Hash: 38F03431D08118AF9B18DFA8DA41AACBBB8EF08210B0141A9DD056B300DB30BE60CBD1

Function 6D067D10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6D067D1D
std::_Xinvalid_argument.LIBCPMT ref: 6D067D3B

Part of subcall function 6D0720D6: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6D0720E2
Part of subcall function 6D0720D6: __CxxThrowException@8.LIBVCRUNTIME ref: 6D0720F0

Strings

list<T> too long, xrefs: 6D067D36

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: std::_$Exception@8Mutex_baseMutex_base::~_ThrowXinvalid_argumentstd::invalid_argument::invalid_argument
String ID: list<T> too long
API String ID: 2057655285-4027344264
Opcode ID: 48cb02b1dd90c81a8a553dfec2bf19abd5429a49083ecd7c7d7895df48e90294
Instruction ID: 078e0aaaf13ff7d94967de1272abdf1290b1fd94cf01948cf5ecfbc0308a7984
Opcode Fuzzy Hash: 48cb02b1dd90c81a8a553dfec2bf19abd5429a49083ecd7c7d7895df48e90294
Instruction Fuzzy Hash: D3F05831D09118AF9B18EFA8CA41AACBBB8EF48350B0145A9DD057B300DB307E50CBD1

Function 6D063FD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6D063FDD
std::_Xinvalid_argument.LIBCPMT ref: 6D063FFB

Part of subcall function 6D0720D6: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6D0720E2
Part of subcall function 6D0720D6: __CxxThrowException@8.LIBVCRUNTIME ref: 6D0720F0

Strings

list<T> too long, xrefs: 6D063FF6

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: std::_$Exception@8Mutex_baseMutex_base::~_ThrowXinvalid_argumentstd::invalid_argument::invalid_argument
String ID: list<T> too long
API String ID: 2057655285-4027344264
Opcode ID: 733a8d4ee78963ce495aa2245d6b66a72b3847e8665fbce1b691fcd08a77dd1f
Instruction ID: 8dccc51d5fcefa29fb9799001bbda9e1bb9e7eb1a18c6e921a2e64996f101ca9
Opcode Fuzzy Hash: 733a8d4ee78963ce495aa2245d6b66a72b3847e8665fbce1b691fcd08a77dd1f
Instruction Fuzzy Hash: 94F05831D08128AFAB18DFA8DA51AACBBB8EF09350B1141A9DD0577300DB307E50CBD1

Function 6D0520A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 6D0520AD
std::_Xinvalid_argument.LIBCPMT ref: 6D0520CB

Part of subcall function 6D0720D6: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6D0720E2
Part of subcall function 6D0720D6: __CxxThrowException@8.LIBVCRUNTIME ref: 6D0720F0

Strings

list<T> too long, xrefs: 6D0520C6

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: std::_$Exception@8Mutex_baseMutex_base::~_ThrowXinvalid_argumentstd::invalid_argument::invalid_argument
String ID: list<T> too long
API String ID: 2057655285-4027344264
Opcode ID: 7e649828eb05f79af3807a0d915250075ac8efd64bdcc951fa4b7e9d199dd1e5
Instruction ID: bb4aff41ea96696ced175330a500b6cbf083bdc3d2fdf250e5503d8e66afed85
Opcode Fuzzy Hash: 7e649828eb05f79af3807a0d915250075ac8efd64bdcc951fa4b7e9d199dd1e5
Instruction Fuzzy Hash: E6F05831D09118AF9B28DFB8CA81AADBBB8EF08310B0141A9DD0577300DB307E50DBC5

Function 6D05D8A0 Relevance: 5.2, APIs: 4, Instructions: 176sleepCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(-00014F25,?,?,?,?,D4C6F04B,?,?,?,?,?,00000000,6D08525F,000000FF,?,6D06A61B), ref: 6D05D963
InitializeCriticalSection.KERNEL32(-00014F3D,?,?,D4C6F04B,?,?,?,?,?,00000000,6D08525F,000000FF,?,6D06A61B), ref: 6D05D973
InitializeCriticalSection.KERNEL32(-00014F55,?,?,D4C6F04B,?,?,?,?,?,00000000,6D08525F,000000FF,?,6D06A61B), ref: 6D05D982
Sleep.KERNEL32(00000064,00002710,?,?,?,D4C6F04B), ref: 6D05DA3A

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalInitializeSection$Sleep
String ID:
API String ID: 1960909292-0
Opcode ID: a3ed17556539a20cc85c1a21f4a70d031b89073a17e9a41199ba3c092b4c3374
Instruction ID: d60859e8af8b264285c379bc40bd923d6a8bbe368e1a0bdd9e497c3b9a5a7b1a
Opcode Fuzzy Hash: a3ed17556539a20cc85c1a21f4a70d031b89073a17e9a41199ba3c092b4c3374
Instruction Fuzzy Hash: C1816AB090420ADBEB05DFA4CD54BEEBBB1FF89308F104269E9156B381DB756950CFA4

Function 6D05E590 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6D05E5B8
LeaveCriticalSection.KERNEL32(?), ref: 6D05E5CE
EnterCriticalSection.KERNEL32(?), ref: 6D05E600
LeaveCriticalSection.KERNEL32(?), ref: 6D05E614

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ecc8f4f2d794bdba7adfd80db6362c4a9efdbd3b30b96f4fc870874a7da24448
Instruction ID: 0e4ba0cc0f0bcddc0a35ba6c1ce465179de6a9dabba58b43f45b33229d1e86fb
Opcode Fuzzy Hash: ecc8f4f2d794bdba7adfd80db6362c4a9efdbd3b30b96f4fc870874a7da24448
Instruction Fuzzy Hash: 32115574E10209DFCF04DFB8C851BAFBBB0AF4A205F404159EA05AB341D735AA44CBE9

Function 6D05DE50 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6D05D534), ref: 6D05DE68
LeaveCriticalSection.KERNEL32(?,?,6D05D534), ref: 6D05DE86
EnterCriticalSection.KERNEL32(?,?,6D05D534), ref: 6D05DE96
LeaveCriticalSection.KERNEL32(?), ref: 6D05DEC9

Memory Dump Source

Source File: 00000005.00000002.1685988233.000000006D051000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D050000, based on PE: true

Associated: 00000005.00000002.1685976549.000000006D050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686011329.000000006D086000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686025807.000000006D093000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1686038836.000000006D096000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d050000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: d2ae1aca3e7c4ea65074e9b1413649b705c4dc2a24290f7812cf94cd63881294
Instruction ID: 5707be7b9324ea395919ae24c07d50e301374596e3f8f56b794a2481d9c98d86
Opcode Fuzzy Hash: d2ae1aca3e7c4ea65074e9b1413649b705c4dc2a24290f7812cf94cd63881294
Instruction Fuzzy Hash: C901D134A10204EBDF14DBA4DD54B9EB334FFCA30AF1141A8E9016B341CB35AE10AED8

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AB5tAhygtM.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exePID: 6764, Parent PID: 2580

General

Chronological Activities

Analysis Process: conhost.exePID: 6788, Parent PID: 6764

General

Chronological Activities

Analysis Process: cmd.exePID: 6932, Parent PID: 6764

General

Chronological Activities

Analysis Process: rundll32.exePID: 6956, Parent PID: 6764

Windows Analysis Report
AB5tAhygtM.dll

Function 6CDDA720 Relevance: 4.5, APIs: 3, Instructions: 22
COMMON

Function 6CDEE098 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Function 6CDE994C Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 6CDD9D70 Relevance: 34.7, APIs: 23, Instructions: 237
synchronizationsleepCOMMON

Function 6CDCC280 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 239
windowmemoryCOMMON