Edit tour

Windows Analysis Report
file.dll

Overview

General Information

Sample name:	file.dll renamed because original name is a hash value
Original sample name:	file.exe
Analysis ID:	1524403
MD5:	69d883f1a13a13d5f198b45a5df0ba97
SHA1:	940678df6cc3814046d7acac5bd0ab1b8664249d
SHA256:	5749acfc3cb027699aa197427c06334c69fb7d36add21f32105cd4033f3a191b
Tags:	dllexesignedx64user-jstrosch
Infos:

Detection

Score:	9
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches the installation path of Mozilla Firefox

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6236 cmdline: loaddll64.exe "C:\Users\user\Desktop\file.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 5956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 828 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\file.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 2192 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

regsvr32.exe (PID: 2896 cmdline: regsvr32.exe /s C:\Users\user\Desktop\file.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

rundll32.exe (PID: 7044 cmdline: rundll32.exe C:\Users\user\Desktop\file.dll,CheckMozJavaPlugins MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6496 cmdline: rundll32.exe C:\Users\user\Desktop\file.dll,DllCanUnloadNow MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6664 cmdline: rundll32.exe C:\Users\user\Desktop\file.dll,DllGetClassObject MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 3756 cmdline: C:\Windows\system32\WerFault.exe -u -p 6664 -s 348 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: file.dll

Static PE information: certificate valid

Source: file.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: c:\jenkins\workspace\8-2-build-windows-x64-cygwin\jdk8u361\3183\build\windows-x64\deploy\tmp\jp2ssv\obj64\jp2ssv.pdb source: rundll32.exe, 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmp, file.dll

Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF977C0 FindFirstFileA,FindNextFileA,FindClose,	8_2_00007FFD9DF977C0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF994A8 FindFirstFileA,_local_unwind,FindNextFileA,DeleteFileA,FindClose,	8_2_00007FFD9DF994A8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFB81B4 FindFirstFileExW,	8_2_00007FFD9DFB81B4

Source: unknown

DNS traffic detected: query: 15.164.165.52.in-addr.arpa replaycode: Name error (3)

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: file.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: file.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: file.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: file.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: file.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: file.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.dll	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: file.dll	String found in binary or memory: http://ocsp.digicert.com0
Source: file.dll	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.dll	String found in binary or memory: http://ocsp.digicert.com0C
Source: file.dll	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.11.dr	String found in binary or memory: http://upx.sf.net
Source: file.dll	String found in binary or memory: http://www.digicert.com/CPS0

Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF9D740	8_2_00007FFD9DF9D740
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF91F64	8_2_00007FFD9DF91F64
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF91520	8_2_00007FFD9DF91520
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFB2660	8_2_00007FFD9DFB2660
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFB6690	8_2_00007FFD9DFB6690
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF9DE90	8_2_00007FFD9DF9DE90
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF9475C	8_2_00007FFD9DF9475C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFB7FA8	8_2_00007FFD9DFB7FA8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF957E0	8_2_00007FFD9DF957E0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF99010	8_2_00007FFD9DF99010
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFA5858	8_2_00007FFD9DFA5858
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF9DCA8	8_2_00007FFD9DF9DCA8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF957E0	8_2_00007FFD9DF957E0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFBA4F4	8_2_00007FFD9DFBA4F4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFB4588	8_2_00007FFD9DFB4588
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFB1DC8	8_2_00007FFD9DFB1DC8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFBD5E4	8_2_00007FFD9DFBD5E4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFA8E14	8_2_00007FFD9DFA8E14
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFA5ADC	8_2_00007FFD9DFA5ADC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFAE2EC	8_2_00007FFD9DFAE2EC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF92BCC	8_2_00007FFD9DF92BCC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFC0BF8	8_2_00007FFD9DFC0BF8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF953F0	8_2_00007FFD9DF953F0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFAAC50	8_2_00007FFD9DFAAC50
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFAF87C	8_2_00007FFD9DFAF87C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFB6074	8_2_00007FFD9DFB6074
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFB4588	8_2_00007FFD9DFB4588
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFAE8C0	8_2_00007FFD9DFAE8C0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFA8908	8_2_00007FFD9DFA8908
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF97988	8_2_00007FFD9DF97988
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFB81B4	8_2_00007FFD9DFB81B4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFAB204	8_2_00007FFD9DFAB204
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFBCA2C	8_2_00007FFD9DFBCA2C

Source: C:\Windows\System32\rundll32.exe

Code function: String function: 00007FFD9DF9A2D8 appears 34 times

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6664 -s 348

Source: file.dll

Binary or memory string: OriginalFilenamejp2ssv.dllX vs file.dll

Source: C:\Windows\System32\rundll32.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\118.0.1 (x64 en-US)\Main Install Directory

Jump to behavior

Source: classification engine

Classification label: clean9.winDLL@15/5@1/0

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFD9DF937D4 CoCreateInstance,

8_2_00007FFD9DF937D4

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFD9DF94418 WideCharToMultiByte,LoadLibraryExA,LoadLibraryExA,FindResourceA,LoadResource,SizeofResource,FreeLibrary,

8_2_00007FFD9DF94418

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5956:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6664

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\419624aa-c12d-47e2-aac6-301164bdc823

Jump to behavior

Source: file.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,CheckMozJavaPlugins

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\file.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\file.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\file.dll
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,CheckMozJavaPlugins
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,DllCanUnloadNow
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,DllGetClassObject
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6664 -s 348
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\file.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\file.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,CheckMozJavaPlugins	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,DllCanUnloadNow	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,DllGetClassObject	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: file.dll

Static PE information: certificate valid

Source: file.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: file.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: file.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: file.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFD9DF96D4C _snwprintf_s,LoadLibraryA,_snwprintf_s,LoadLibraryA,_snwprintf_s,LoadLibraryA,GetProcAddress,_Wcsftime,FreeLibrary,

8_2_00007FFD9DF96D4C

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\file.dll

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

API coverage: 2.8 %

Source: C:\Windows\System32\loaddll64.exe TID: 1612

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF977C0 FindFirstFileA,FindNextFileA,FindClose,	8_2_00007FFD9DF977C0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF994A8 FindFirstFileA,_local_unwind,FindNextFileA,DeleteFileA,FindClose,	8_2_00007FFD9DF994A8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFB81B4 FindFirstFileExW,	8_2_00007FFD9DFB81B4

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFD9DFA42A8 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

8_2_00007FFD9DFA42A8

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: Amcache.hve.11.dr	Binary or memory string: VMware
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.11.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.11.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.11.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.11.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.11.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.11.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.11.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.11.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.11.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.11.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.11.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.11.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.11.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFD9DFA3E7C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_00007FFD9DFA3E7C

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFD9DF9F3F4 GetLastError,IsDebuggerPresent,OutputDebugStringW,

8_2_00007FFD9DF9F3F4

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFD9DF96D4C _snwprintf_s,LoadLibraryA,_snwprintf_s,LoadLibraryA,_snwprintf_s,LoadLibraryA,GetProcAddress,_Wcsftime,FreeLibrary,

8_2_00007FFD9DF96D4C

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFD9DFB93A4 GetProcessHeap,

8_2_00007FFD9DFB93A4

Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFA3E7C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FFD9DFA3E7C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DFA0398 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FFD9DFA0398
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFD9DF9F94C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00007FFD9DF9F94C

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",#1

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFD9DFC0910 cpuid

8_2_00007FFD9DFC0910

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFD9DFA06A8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

8_2_00007FFD9DFA06A8

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFD9DFB627C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

8_2_00007FFD9DFB627C

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFD9DF9A744 GetVersionExA,

8_2_00007FFD9DF9A744

Source: Amcache.hve.11.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	21 Virtualization/Sandbox Evasion	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	51 Security Software Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Regsvr32	LSA Secrets	14 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
15.164.165.52.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.11.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524403
Start date and time:	2024-10-02 19:00:54 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.dll renamed because original name is a hash value
Original Sample Name:	file.exe
Detection:	CLEAN
Classification:	clean9.winDLL@15/5@1/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 20 Number of non-executed functions: 118
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: file.dll

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fil_4bdbc898aa41e69a58d6ca0b49de377bd76f77_d75f6fa5_76820721-d08e-48f8-b510-448c0ca67010\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7653006153516252
Encrypted:	false
SSDEEP:	192:s1jFiIy2o0x0Iv34jxMfzuiFbZ24lO8V:qhiF2mIv34jCzuiFbY4lO8V
MD5:	E37FE8F90B620436904234E816306935
SHA1:	04571A1955AA5D9BE5736A5893BC251687A3023C
SHA-256:	8FC80780378733A37306B8F9FE5E53DA968ECC26F85C123F5785EE74261E5398
SHA-512:	C70FEA52FA86116323B4B3B2F22C43406C8F60C7DDE4B409F6E8503B6F5B7D28A92AF8EA96DCEB6B0671D4E50A0872D7A481F069FC82666833AFF36EED326211
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.3.6.2.1.1.2.5.5.6.7.2.2.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.3.6.2.1.1.3.4.4.7.3.4.7.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.6.8.2.0.7.2.1.-.d.0.8.e.-.4.8.f.8.-.b.5.1.0.-.4.4.8.c.0.c.a.6.7.0.1.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.c.e.4.5.3.5.6.-.5.7.2.4.-.4.a.6.7.-.8.2.c.8.-.1.7.b.9.1.1.c.c.6.d.6.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.f.i.l.e...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.0.8.-.0.0.0.1.-.0.0.1.5.-.8.5.4.1.-.b.a.c.6.e.c.1.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.r.u.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER36CC.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Oct 2 17:01:53 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	71122
Entropy (8bit):	1.2752295280738657
Encrypted:	false
SSDEEP:	192:wqb8QUhg/yOMxqMbb37Sge34eKMLdBSVwRYkf:DwfhWBMbb3w75BSVw+
MD5:	C205B2E97C00A7B11EA9FE9EC7409253
SHA1:	1B324FB9932AE169272D96274EDB5FE3CEE13638
SHA-256:	842BB7B001B1174D410C8725735B61A8D48536F7F6F72DDE9D19AAABC795AE39
SHA-512:	846DAA70B4C99326129184FB1F16C7C0D7DB24E1AC3B751DD057734AA2C056AAECBA4548A4857BD3707D88BDFC448801AE82C8487C0C1018BFB07A1560B4A49B
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........\|.f.........................................)..........T.......8...........T........... ...............T...........@...............................................................................eJ..............Lw......................T............\|.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER395E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8494
Entropy (8bit):	3.6952404666897354
Encrypted:	false
SSDEEP:	192:R6l7wVeJPELPNROj6YoYogmfiL0p0prp89b0eGfWcm:R6lXJ8rzq6YfogmfGOH0Hfk
MD5:	6346FF80190BCB261640AD3DF6AE29EF
SHA1:	F47CA672DEF24040C9CB995500A4C558995B5536
SHA-256:	9AF3FE91DA32A6445B8C17AB38341830AD866A953FC95C74C29C472E777A76FE
SHA-512:	2F40AEBC96FF3C3BF1630CDB0BD55FE43527865FD35C6E26AD4A22926F608E62BFD27F70F23B6AFE523AC606633057F6C0F851223939D956FCBA363247371208
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER39CC.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4729
Entropy (8bit):	4.465403787700911
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg771I96//WpW8VYy0Ym8M4JCFCthaWEF4/Wyq85m1OWEkzptSTSxd:uIjfZI7f/u7VNJ3aWDWXOW1poOxd
MD5:	CB146CEFD0C9096599337FF486440D08
SHA1:	7524ECD5B9ACF434260CC20654264529D782DCE6
SHA-256:	0FD909FF2E0DAB64881208F605B4D21180AF25587B4ECE84C0B51F4146279751
SHA-512:	89EFA0927F6CC72B19A396CE11C73B7FDF9E85BE27804A96F74DBDDAD43984B452BB19F1278223C97BA9D71A662EAD91D6A20DAB6414EE7C787F681EC344C23F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="526084" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469520090410337
Encrypted:	false
SSDEEP:	6144:RzZfpi6ceLPx9skLmb0fYZWSP3aJG8nAgeiJRMMhA2zX4WABluuNMjDH5S:JZHtYZWOKnMM6bFpaj4
MD5:	4663AE42DD9F11C4B79207B031368373
SHA1:	3B797D99246C4CCAFD2E7C393DCD04DCE0660BA3
SHA-256:	0C7CEFDF14C49816CA6FA71771BB3C5A79EB814AFD50471E27CC0610FA46ACFD
SHA-512:	6D592F13E9A0AE15DD0372450F27A54D3E36EEE662759FF38A85EF3400BABB8DF020D5B5446E2030C0F67104FABCA8DC79276F6D322B18AB305D578746B57405
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..#.................................................................................................................................................................................................................................................................................................................................................Xi5.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.121355444788685
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	file.dll
File size:	351'392 bytes
MD5:	69d883f1a13a13d5f198b45a5df0ba97
SHA1:	940678df6cc3814046d7acac5bd0ab1b8664249d
SHA256:	5749acfc3cb027699aa197427c06334c69fb7d36add21f32105cd4033f3a191b
SHA512:	e06613bef2add30c0f5f0c4b5249461c19d813499ace04d94fa42bab237b22efb34a4c1e23565d72593c2bfbd6ad055cf5208968f8ea2b528b66ba6b0140e675
SSDEEP:	6144:j2BK+kd25HU2gcv/Wa83jAqN1RiZNby0N:d+kKH9mT1N1RiL2C
TLSH:	54744B5473E418B8F477DA3988A28502DA76BC511B61DE9F6394024A2F37BE1C63DF32
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t...'...'...'...&...'...&...'..3'...'...&...'...&...'...&...'...&...'...'\..'...&...'=..&...'=..&...'=..'...'=..&...'Rich...

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1800101c4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x63BBD69B [Mon Jan 9 08:55:55 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	313483b5898aa91865cd36a9f29acb2e

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	19/08/2021 02:00:00 20/08/2023 01:59:59
Subject Chain	CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, S=California, C=US
Version:	3
Thumbprint MD5:	2876C1BECB51837D0E3DE50903D025B6
Thumbprint SHA-1:	940D69C0A34A1B4CFD8048488BA86F4CED60481A
Thumbprint SHA-256:	EE46613A38B4F486164BCE7FB23178667715617F511B364594311A1548B08EB1
Serial:	068BE2F53452C882F18ED41A5DD4E7A3

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007F225CB7EFE7h
call 00007F225CB7F4A8h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007F225CB7EE74h
int3
int3
int3
retn 0000h
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push edi
dec eax
sub esp, 10h
xor eax, eax
mov dword ptr [0003FE31h], 00000002h
xor ecx, ecx
mov dword ptr [0003FE21h], 00000001h
cpuid
inc esp
mov eax, ecx
xor edi, edi
inc esp
mov ecx, ebx
inc ecx
xor eax, 6C65746Eh
inc ecx
xor ecx, 756E6547h
inc esp
mov edx, edx
mov esi, eax
xor ecx, ecx
lea eax, dword ptr [edi+01h]
inc ebp
or ecx, eax
cpuid
inc ecx
xor edx, 49656E69h
mov dword ptr [esp], eax
inc ebp
or ecx, edx
mov dword ptr [esp+04h], ebx
inc esp
mov ebx, ecx
mov dword ptr [esp+08h], ecx
mov dword ptr [esp+0Ch], edx
jne 00007F225CB7F032h
dec eax
or dword ptr [0003FDDCh], FFFFFFFFh
and eax, 0FFF3FF0h
cmp eax, 000106C0h
je 00007F225CB7F00Ah
cmp eax, 00020660h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4e570	0x194	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4e704	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x56000	0xb80	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x53000	0x2730	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x53400	0x28a0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x57000	0x74c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4a050	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x49f50	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x33000	0x4e0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x4e110	0x80	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x31aae	0x31c00	9d052583f25e65ed28a8bdc48d5c964c	False	0.5521454930904522	data	6.456251822305383	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x33000	0x1c72a	0x1c800	5bbea155b354be5c20dd7fd564ee20c7	False	0.2625925164473684	data	4.377975050235937	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x50000	0x23d4	0x1000	61115e6cb33832668f270ea02c86a3c4	False	0.1748046875	data	2.5568170519688955	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x53000	0x2730	0x2800	d2b3d8772cf7fd699c092ee71934ce58	False	0.4873046875	data	5.4732851134488545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x56000	0xb80	0xc00	f92da0697814ff37131ef7f68d89bf7e	False	0.3017578125	data	4.274647443366615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x57000	0x74c	0x800	904ea74ba1a3d5338d75d70249523b89	False	0.57666015625	data	5.224582899824992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
REGISTRY	0x561b0	0x16d	ASCII text	English	United States	0.5123287671232877
REGISTRY	0x56320	0x16d	ASCII text	English	United States	0.5095890410958904
REGISTRY	0x56490	0x103	ASCII text	English	United States	0.4942084942084942
REGISTRY	0x56598	0x103	ASCII text	English	United States	0.4942084942084942
REGISTRY	0x566a0	0x107	ASCII text	English	United States	0.7072243346007605
REGISTRY	0x567a8	0x98	ASCII text	English	United States	0.8026315789473685
RT_VERSION	0x56840	0x340	data	English	United States	0.4651442307692308

Imports

DLL	Import
KERNEL32.dll	DecodePointer, RaiseException, GetLastError, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, EncodePointer, CloseHandle, EnterCriticalSection, LeaveCriticalSection, ReleaseMutex, WaitForSingleObject, CreateMutexA, DisableThreadLibraryCalls, FreeLibrary, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, LoadLibraryExA, LoadResource, SizeofResource, lstrcmpiA, OpenMutexA, FindResourceA, MultiByteToWideChar, WideCharToMultiByte, IsDBCSLeadByte, DeleteFileA, FindClose, FindFirstFileA, FindNextFileA, LoadLibraryA, VerSetConditionMask, GetEnvironmentVariableA, CreateFileA, GetLongPathNameA, GetTempPathA, GetCurrentProcess, CreateProcessA, OpenProcess, GlobalMemoryStatusEx, GetLocalTime, GetSystemDirectoryA, GetWindowsDirectoryA, GetVersionExA, GetNativeSystemInfo, GlobalAlloc, GlobalFree, LocalAlloc, LocalFree, GetShortPathNameA, FormatMessageA, lstrlenA, VerifyVersionInfoA, WTSGetActiveConsoleSessionId, GetFileAttributesA, GetSystemWindowsDirectoryA, OutputDebugStringA, GetCurrentProcessId, GetCurrentThreadId, IsDebuggerPresent, OutputDebugStringW, WriteConsoleW, SetEndOfFile, ReadConsoleW, ReadFile, GetConsoleMode, GetConsoleCP, FlushFileBuffers, WriteFile, SetFilePointerEx, GetFileSizeEx, GetStringTypeW, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, RtlUnwind, InterlockedFlushSList, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, GetSystemInfo, VirtualAlloc, VirtualProtect, VirtualQuery, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetTimeZoneInformation, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, HeapFree, HeapAlloc, HeapSize, HeapReAlloc, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetStdHandle, GetCurrentDirectoryW, GetFullPathNameW, SetStdHandle, SetEnvironmentVariableW
USER32.dll	GetWindowThreadProcessId, GetShellWindow, CloseDesktop, OpenInputDesktop, CharNextA, wsprintfA
ole32.dll	CoTaskMemRealloc, CoTaskMemFree, CoUninitialize, CoInitialize, StringFromCLSID, CoCreateInstance, CoTaskMemAlloc
OLEAUT32.dll	SysAllocStringByteLen, SysStringLen, SysAllocString, VarUI4FromStr, SysFreeString, VariantClear

Exports

Name	Ordinal	Address
CheckMozJavaPlugins	1	0x18000a028
DllCanUnloadNow	2	0x180001c74
DllGetClassObject	3	0x180001520
DllRegisterServer	4	0x180001c88
DllUnregisterServer	5	0x180001c94
RedirectAllStaticVersionKeys	6	0x180006504
RedirectSelectedStaticVersionKeys	7	0x1800065c4
RegKeyBranchNeedsUpdating	8	0x180006478
RemoveAllMozillaJavaPlugins	9	0x180007284
RunBrokerProcess	10	0x180007310
UpdateTreatAsKey	11	0x180006684

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 19:02:05.770172119 CEST	53	60374	1.1.1.1	192.168.2.6
Oct 2, 2024 19:02:19.362873077 CEST	53	55826	162.159.36.2	192.168.2.6
Oct 2, 2024 19:02:19.862385988 CEST	62819	53	192.168.2.6	1.1.1.1
Oct 2, 2024 19:02:19.871315002 CEST	53	62819	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 19:02:19.862385988 CEST	192.168.2.6	1.1.1.1	0xc5fe	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 19:02:19.871315002 CEST	1.1.1.1	192.168.2.6	0xc5fe	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	13:01:45
Start date:	02/10/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\file.dll"
Imagebase:	0x7ff74add0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:01:45
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:01:45
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\file.dll",#1
Imagebase:	0x7ff6fe110000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:01:45
Start date:	02/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\file.dll
Imagebase:	0x7ff67fef0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:01:45
Start date:	02/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\file.dll,CheckMozJavaPlugins
Imagebase:	0x7ff746a50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:01:45
Start date:	02/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\file.dll",#1
Imagebase:	0x7ff746a50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:01:48
Start date:	02/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\file.dll,DllCanUnloadNow
Imagebase:	0x7ff746a50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:01:51
Start date:	02/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\file.dll,DllGetClassObject
Imagebase:	0x7ff746a50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:01:52
Start date:	02/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6664 -s 348
Imagebase:	0x7ff75fbc0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16%
Total number of Nodes:	2000
Total number of Limit Nodes:	18

Executed Functions

Function 00007FFD9DF91520 Relevance: 52.9, APIs: 10, Strings: 20, Instructions: 420
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFD9DF9D9F0: RegOpenKeyExA.KERNELBASE ref: 00007FFD9DF9DA5A

Part of subcall function 00007FFD9DFA4484: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFA44C5

sscanf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF916EE
sscanf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF917E9
sscanf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF918E1
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF919FA
CreateMutexA.KERNEL32 ref: 00007FFD9DF91A6D
GetLastError.KERNEL32 ref: 00007FFD9DF91A7B
OpenMutexA.KERNEL32 ref: 00007FFD9DF91A99

Part of subcall function 00007FFD9DF96478: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF964CA

_local_unwind.LIBVCRUNTIME ref: 00007FFD9DF91AD1
WaitForSingleObject.KERNEL32 ref: 00007FFD9DF91AE7
_local_unwind.LIBVCRUNTIME ref: 00007FFD9DF91B64

Strings

%llu, xrefs: 00007FFD9DF917DA
%llu, xrefs: 00007FFD9DF918D2
%llu, xrefs: 00007FFD9DF916DF
update, xrefs: 00007FFD9DF91721
later, xrefs: 00007FFD9DF9175D
deployment.webjava.enabled, xrefs: 00007FFD9DF9180C
true, xrefs: 00007FFD9DF91798
later, xrefs: 00007FFD9DF91690
update, xrefs: 00007FFD9DF91651
Mutex, xrefs: 00007FFD9DF91A32
jp2ssv.dll, xrefs: 00007FFD9DF91BEF
%s\bin\jp2ssv.dll, xrefs: 00007FFD9DF919E9
block, xrefs: 00007FFD9DF91673
true, xrefs: 00007FFD9DF916B5
block, xrefs: 00007FFD9DF91740
SSVAgentMutex, xrefs: 00007FFD9DF91A8B
jp2ssv.dll, xrefs: 00007FFD9DF91C12
11.361.2, xrefs: 00007FFD9DF91B74
false, xrefs: 00007FFD9DF9181C
jp2ssv.dll, xrefs: 00007FFD9DF91BC9

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: sscanf$MutexOpen_local_unwind$CreateErrorLastObjectSingleWait_invalid_parameter_noinfo_snwprintf_sswprintf
String ID: %llu$%llu$%llu$%s\bin\jp2ssv.dll$11.361.2$Mutex$SSVAgentMutex$block$block$deployment.webjava.enabled$false$jp2ssv.dll$jp2ssv.dll$jp2ssv.dll$later$later$true$true$update$update
API String ID: 1521680484-3839229735
Opcode ID: 06989ee496560a191980a93f29b8cb2a99d3fa4950b5b5c850a5ca76a6bd9294
Instruction ID: 6b013ba25f58719ccf2c27fe57f1ef7514741a0d2466ebaf4a84a70454a1f2b6
Opcode Fuzzy Hash: 06989ee496560a191980a93f29b8cb2a99d3fa4950b5b5c850a5ca76a6bd9294
Instruction Fuzzy Hash: 40127162F1C9C651EB30DFA5E8621EAA261FBD5384F404236DACD47A99FE3CD509C740

Function 00007FFD9DF91F64 Relevance: 33.5, APIs: 5, Strings: 14, Instructions: 268
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FFD9DF91FBA

Part of subcall function 00007FFD9DFA46EC: strstr.LIBVCRUNTIME ref: 00007FFD9DFA4723

DisableThreadLibraryCalls.KERNEL32 ref: 00007FFD9DF9239F

Part of subcall function 00007FFD9DF9D9F0: RegOpenKeyExA.KERNELBASE ref: 00007FFD9DF9DA5A

Part of subcall function 00007FFD9DFA4484: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFA44C5

sscanf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9215C
sscanf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF92231
sscanf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF922FB

Strings

update, xrefs: 00007FFD9DF920D9
block, xrefs: 00007FFD9DF9219C
true, xrefs: 00007FFD9DF92127
later, xrefs: 00007FFD9DF9210D
block, xrefs: 00007FFD9DF920F3
%llu, xrefs: 00007FFD9DF92144
update, xrefs: 00007FFD9DF92182
ssvagent.exe, xrefs: 00007FFD9DF91FD5
false, xrefs: 00007FFD9DF92255
later, xrefs: 00007FFD9DF921B6
deployment.webjava.enabled, xrefs: 00007FFD9DF92245
true, xrefs: 00007FFD9DF921E6
%llu, xrefs: 00007FFD9DF922ED
%llu, xrefs: 00007FFD9DF92223

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: sscanf$CallsDisableFileLibraryModuleNameOpenThread_invalid_parameter_noinfostrstr
String ID: %llu$%llu$%llu$block$block$deployment.webjava.enabled$false$later$later$ssvagent.exe$true$true$update$update
API String ID: 1610733529-2036894985
Opcode ID: 31d723c57e7ce75be79ebd9b7beab8ca7e763c65bacb6803460a3e03684e70a8
Instruction ID: e0437aaf56e8bac87c8eb9087f5a3043e6677e4543656e0118e4e2f2b2d83710
Opcode Fuzzy Hash: 31d723c57e7ce75be79ebd9b7beab8ca7e763c65bacb6803460a3e03684e70a8
Instruction Fuzzy Hash: F7C15122B28AC355EB34AFA5D8626F91361FF94788F804232D98D4B599FE7CE705C740

Function 00007FFD9DF9D740 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 158
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,?,?,?,?,00007FFD9DF91818), ref: 00007FFD9DF9D820

Part of subcall function 00007FFD9DFABF58: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFABF7D

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,00007FFD9DF91818), ref: 00007FFD9DF9D8C2
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,00007FFD9DF91818), ref: 00007FFD9DF9D985

Strings

deployment.modified.timestamp, xrefs: 00007FFD9DF9D87D
deployment.modified.timestamp, xrefs: 00007FFD9DF9D8F4
SOFTWARE\Oracle\JavaDeploy, xrefs: 00007FFD9DF9D8B4

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Open$_invalid_parameter_noinfo
String ID: SOFTWARE\Oracle\JavaDeploy$deployment.modified.timestamp$deployment.modified.timestamp
API String ID: 2082215927-716718558
Opcode ID: 5257eef159938afc1ac749d74670a1734ca4e6543f3238034bb47169f28f6cd5
Instruction ID: f25c6985f8f3d7e80ff5d33af41e7b73dd17f379f3659bedd80928cbecc047f7
Opcode Fuzzy Hash: 5257eef159938afc1ac749d74670a1734ca4e6543f3238034bb47169f28f6cd5
Instruction Fuzzy Hash: D1714022B18AC286E7709FA5E86166A67A5FB847C4F501231FACE47F58EF3CD145CB40

Function 00007FFD9DF9FE94 Relevance: 15.2, APIs: 10, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFD9DF9FEBC
_RTC_Initialize.LIBCMT ref: 00007FFD9DF9FF50
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFD9DF9FF76
__scrt_release_startup_lock.LIBCMT ref: 00007FFD9DF9FFA1
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FFD9DF9FFC0
__scrt_fastfail.LIBCMT ref: 00007FFD9DF9FFF6
_RTC_Initialize.LIBCMT ref: 00007FFD9DFA0057
__scrt_release_startup_lock.LIBCMT ref: 00007FFD9DFA006A
__scrt_uninitialize_crt.LIBCMT ref: 00007FFD9DFA0074
__scrt_fastfail.LIBCMT ref: 00007FFD9DFA0087

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_release_startup_lock$__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_is_nonwritable_in_current_image__scrt_uninitialize_crt
String ID:
API String ID: 4085079087-0
Opcode ID: b0b55818c316fdf5a3517c4d4876db3057afc319c5bfef9534f6fb83436c9f7f
Instruction ID: ac82cd6f028a5110aa1e6cc059fe7f52d2b37582428d4729d6192b363263fe63
Opcode Fuzzy Hash: b0b55818c316fdf5a3517c4d4876db3057afc319c5bfef9534f6fb83436c9f7f
Instruction Fuzzy Hash: 26919322F1CAC345FA74AFE6A5632B92690AF85780F444375EACD4379AFE3CE4458700

Function 00007FFD9DF9F6CC Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vcrt_initialize.LIBVCRUNTIME ref: 00007FFD9DF9F6EE

Part of subcall function 00007FFD9DFA2020: __vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00007FFD9DFA2029
Part of subcall function 00007FFD9DFA2020: __vcrt_initialize_locks.LIBVCRUNTIME ref: 00007FFD9DFA202E

__vcrt_uninitialize.LIBVCRUNTIME ref: 00007FFD9DF9F706

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: __vcrt_initialize__vcrt_initialize_locks__vcrt_initialize_winapi_thunks__vcrt_uninitialize
String ID:
API String ID: 1882725809-0
Opcode ID: 7ab1baf98a59c69f39ac2451dd79b0a18bdd618af924edda5b286a407d09aafc
Instruction ID: 06ab530f096fe52261f5eb5e833df4e0db7a2f7634cc46fd165d984b305e1c19
Opcode Fuzzy Hash: 7ab1baf98a59c69f39ac2451dd79b0a18bdd618af924edda5b286a407d09aafc
Instruction Fuzzy Hash: DCE01A10F0C7C645FE752EE621732B916900F96340F1857B9EAED82193FE1DA44A5635

Function 00007FFD9DF9D9F0 Relevance: 1.6, APIs: 1, Instructions: 52
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FFD9DF9DA5A

Part of subcall function 00007FFD9DFABF58: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFABF7D

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Open_invalid_parameter_noinfo
String ID:
API String ID: 131715653-0
Opcode ID: d244560fa4788ac33a2a4150e5f567402c1ac3b7fae48a1d4fe5a9c6bebaa959
Instruction ID: b33f9256c856b2f0ce7b58ae0ee418ed7f2a92b14f8679106452a7cc3f8ae801
Opcode Fuzzy Hash: d244560fa4788ac33a2a4150e5f567402c1ac3b7fae48a1d4fe5a9c6bebaa959
Instruction Fuzzy Hash: 68119032B1C7C286E7608F92E85152AB7A5FB88BC4F544235EA8D47B55EF3CE515CB00

Function 00007FFD9DFB39F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFB3A1B

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 39a261442b0964c5366dc9ef667b9b885fa98aac484cf6d7e758a5e18f53b61e
Instruction ID: b0615d75d0eb85b84637e69ab6cf14d7871ed50285cef4cf3b836ae5200a8d5f
Opcode Fuzzy Hash: 39a261442b0964c5366dc9ef667b9b885fa98aac484cf6d7e758a5e18f53b61e
Instruction Fuzzy Hash: AE115E3AB486C286E330AFD5A462569A2A8EB80780F154335D7DD4B696FF3CE8148B50

Function 00007FFD9DF9F282 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFD9DF9F213

Part of subcall function 00007FFD9DFC13A8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC13C2
Part of subcall function 00007FFD9DFC13A8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC142E
Part of subcall function 00007FFD9DFC13A8: RaiseException.KERNEL32 ref: 00007FFD9DFC1442

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: b5349ba073e493907d70b657106c693bb803f91517c994d154a66991fb509178
Instruction ID: 600ba09aa40014ddce087762ca86bcd58bb8ebfde2808ac6f3f3bbf21d8864d7
Opcode Fuzzy Hash: b5349ba073e493907d70b657106c693bb803f91517c994d154a66991fb509178
Instruction Fuzzy Hash: 4501D662A1CBC1C2E6208F58F84206AE360FBD9780F605725EFC852E18EF6CC2548B44

Function 00007FFD9DF9F265 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFD9DF9F213

Part of subcall function 00007FFD9DFC13A8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC13C2
Part of subcall function 00007FFD9DFC13A8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC142E
Part of subcall function 00007FFD9DFC13A8: RaiseException.KERNEL32 ref: 00007FFD9DFC1442

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: 3bf326bf2a40f5c1602910a48eb7300059a6ba1f2391d7c39976ab2625828fd0
Instruction ID: 9da0e7b5a7e94b31b497967d7b3e49598d9f8e869adee5cf30e3a9c6104f7f65
Opcode Fuzzy Hash: 3bf326bf2a40f5c1602910a48eb7300059a6ba1f2391d7c39976ab2625828fd0
Instruction Fuzzy Hash: 50F0A46291CBC1C2E6208F59F84206AE760FBD9794F609725EFC952E18EF6CC2548B44

Function 00007FFD9DF9F271 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFD9DF9F213

Part of subcall function 00007FFD9DFC13A8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC13C2
Part of subcall function 00007FFD9DFC13A8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC142E
Part of subcall function 00007FFD9DFC13A8: RaiseException.KERNEL32 ref: 00007FFD9DFC1442

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: 391e2ef7d3195a82ce86e24c16bcc35e6925976b4c2bb8ffc056e2d051142cda
Instruction ID: 9da0e7b5a7e94b31b497967d7b3e49598d9f8e869adee5cf30e3a9c6104f7f65
Opcode Fuzzy Hash: 391e2ef7d3195a82ce86e24c16bcc35e6925976b4c2bb8ffc056e2d051142cda
Instruction Fuzzy Hash: 50F0A46291CBC1C2E6208F59F84206AE760FBD9794F609725EFC952E18EF6CC2548B44

Function 00007FFD9DF9F27D Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFD9DF9F213

Part of subcall function 00007FFD9DFC13A8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC13C2
Part of subcall function 00007FFD9DFC13A8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC142E
Part of subcall function 00007FFD9DFC13A8: RaiseException.KERNEL32 ref: 00007FFD9DFC1442

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: 35f44e23c740a906e0e5ec181a92d95e001227a378cb51d0db83079725294728
Instruction ID: 9da0e7b5a7e94b31b497967d7b3e49598d9f8e869adee5cf30e3a9c6104f7f65
Opcode Fuzzy Hash: 35f44e23c740a906e0e5ec181a92d95e001227a378cb51d0db83079725294728
Instruction Fuzzy Hash: 50F0A46291CBC1C2E6208F59F84206AE760FBD9794F609725EFC952E18EF6CC2548B44

Function 00007FFD9DF9F295 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFD9DF9F213

Part of subcall function 00007FFD9DFC13A8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC13C2
Part of subcall function 00007FFD9DFC13A8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC142E
Part of subcall function 00007FFD9DFC13A8: RaiseException.KERNEL32 ref: 00007FFD9DFC1442

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: eef22f7847af817f5346a3a387ef8d2fd40d258e0acf854cdd94b1023cd87576
Instruction ID: 9da0e7b5a7e94b31b497967d7b3e49598d9f8e869adee5cf30e3a9c6104f7f65
Opcode Fuzzy Hash: eef22f7847af817f5346a3a387ef8d2fd40d258e0acf854cdd94b1023cd87576
Instruction Fuzzy Hash: 50F0A46291CBC1C2E6208F59F84206AE760FBD9794F609725EFC952E18EF6CC2548B44

Function 00007FFD9DF9F2A1 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFD9DF9F213

Part of subcall function 00007FFD9DFC13A8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC13C2
Part of subcall function 00007FFD9DFC13A8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC142E
Part of subcall function 00007FFD9DFC13A8: RaiseException.KERNEL32 ref: 00007FFD9DFC1442

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: d7ff8efee44fc5f71f716ac6409122c6c6ad1b8f3da895bbf402fdd2773ae484
Instruction ID: 9da0e7b5a7e94b31b497967d7b3e49598d9f8e869adee5cf30e3a9c6104f7f65
Opcode Fuzzy Hash: d7ff8efee44fc5f71f716ac6409122c6c6ad1b8f3da895bbf402fdd2773ae484
Instruction Fuzzy Hash: 50F0A46291CBC1C2E6208F59F84206AE760FBD9794F609725EFC952E18EF6CC2548B44

Function 00007FFD9DF9F2B9 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFD9DF9F213

Part of subcall function 00007FFD9DFC13A8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC13C2
Part of subcall function 00007FFD9DFC13A8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC142E
Part of subcall function 00007FFD9DFC13A8: RaiseException.KERNEL32 ref: 00007FFD9DFC1442

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: 1a28e83d2baca6c60245efe20df3e30e10596345c6c4b41bce8e00da07353f41
Instruction ID: 9da0e7b5a7e94b31b497967d7b3e49598d9f8e869adee5cf30e3a9c6104f7f65
Opcode Fuzzy Hash: 1a28e83d2baca6c60245efe20df3e30e10596345c6c4b41bce8e00da07353f41
Instruction Fuzzy Hash: 50F0A46291CBC1C2E6208F59F84206AE760FBD9794F609725EFC952E18EF6CC2548B44

Function 00007FFD9DF9F2AD Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFD9DF9F213

Part of subcall function 00007FFD9DFC13A8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC13C2
Part of subcall function 00007FFD9DFC13A8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC142E
Part of subcall function 00007FFD9DFC13A8: RaiseException.KERNEL32 ref: 00007FFD9DFC1442

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: 80632c6ec193bc15b98e596cd374bf4440c4681666b2ecc1ac29071cc8c0dd8f
Instruction ID: 9da0e7b5a7e94b31b497967d7b3e49598d9f8e869adee5cf30e3a9c6104f7f65
Opcode Fuzzy Hash: 80632c6ec193bc15b98e596cd374bf4440c4681666b2ecc1ac29071cc8c0dd8f
Instruction Fuzzy Hash: 50F0A46291CBC1C2E6208F59F84206AE760FBD9794F609725EFC952E18EF6CC2548B44

Function 00007FFD9DF9F2C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFD9DF9F213

Part of subcall function 00007FFD9DFC13A8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC13C2
Part of subcall function 00007FFD9DFC13A8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC142E
Part of subcall function 00007FFD9DFC13A8: RaiseException.KERNEL32 ref: 00007FFD9DFC1442

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: 543bbabc983a2fa57f5449900e1caab5b606cc3ce7f2394880d883332c3830cd
Instruction ID: 9da0e7b5a7e94b31b497967d7b3e49598d9f8e869adee5cf30e3a9c6104f7f65
Opcode Fuzzy Hash: 543bbabc983a2fa57f5449900e1caab5b606cc3ce7f2394880d883332c3830cd
Instruction Fuzzy Hash: 50F0A46291CBC1C2E6208F59F84206AE760FBD9794F609725EFC952E18EF6CC2548B44

Function 00007FFD9DF9F2D1 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFD9DF9F213

Part of subcall function 00007FFD9DFC13A8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC13C2
Part of subcall function 00007FFD9DFC13A8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC142E
Part of subcall function 00007FFD9DFC13A8: RaiseException.KERNEL32 ref: 00007FFD9DFC1442

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: 16ae7dfd2a5fcea2c82cc4a5e8670a0deca76735726ff86c449210828a221591
Instruction ID: 9da0e7b5a7e94b31b497967d7b3e49598d9f8e869adee5cf30e3a9c6104f7f65
Opcode Fuzzy Hash: 16ae7dfd2a5fcea2c82cc4a5e8670a0deca76735726ff86c449210828a221591
Instruction Fuzzy Hash: 50F0A46291CBC1C2E6208F59F84206AE760FBD9794F609725EFC952E18EF6CC2548B44

Function 00007FFD9DF9F1D4 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFD9DF9F213

Part of subcall function 00007FFD9DFC13A8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC13C2
Part of subcall function 00007FFD9DFC13A8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC142E
Part of subcall function 00007FFD9DFC13A8: RaiseException.KERNEL32 ref: 00007FFD9DFC1442

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: c15c9f59d9c9ccd348bad0d6c8561a15aacde049c291fd8f720ead0ccb6f9074
Instruction ID: 69d8c4bd323edbd8ea9c8df58b5f3466bef01e981a223e2d37eb50e4b4f5e200
Opcode Fuzzy Hash: c15c9f59d9c9ccd348bad0d6c8561a15aacde049c291fd8f720ead0ccb6f9074
Instruction Fuzzy Hash: 5BF0A46291CBC1C2E6208F59F84206AE760FBD9794F609725EFC952E18EF6CC2548B44

Function 00007FFD9DF9F259 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFD9DF9F213

Part of subcall function 00007FFD9DFC13A8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC13C2
Part of subcall function 00007FFD9DFC13A8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFD9DFC142E
Part of subcall function 00007FFD9DFC13A8: RaiseException.KERNEL32 ref: 00007FFD9DFC1442

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: c9690756d4dd4b92c6fc5678ae5c0b1c42bb4dbc50b8e96cdaf29ed4b20306c7
Instruction ID: 9da0e7b5a7e94b31b497967d7b3e49598d9f8e869adee5cf30e3a9c6104f7f65
Opcode Fuzzy Hash: c9690756d4dd4b92c6fc5678ae5c0b1c42bb4dbc50b8e96cdaf29ed4b20306c7
Instruction Fuzzy Hash: 50F0A46291CBC1C2E6208F59F84206AE760FBD9794F609725EFC952E18EF6CC2548B44

Function 00007FFD9DFB308C Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FFD9DFB0619,?,?,00006AC2EEAEFA12,00007FFD9DFA41E9,?,?,?,?,00007FFD9DFB07BA,?,?,00000000), ref: 00007FFD9DFB30E1

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 383924febe7b85696b94743aac14defc0d99da142849da29586037dfeace2a7f
Instruction ID: 2e2948674eb5e317f06c3dc2e06e587f3d755b252f32fcfcdcec596f1a0acb3f
Opcode Fuzzy Hash: 383924febe7b85696b94743aac14defc0d99da142849da29586037dfeace2a7f
Instruction Fuzzy Hash: BAF06D04F4928641FE755FE699732B512C41F98BC4F0C5632CECE8A6C2FE6DE5888230

Non-executed Functions

Function 00007FFD9DF97988 Relevance: 88.8, APIs: 11, Strings: 39, Instructions: 1344COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFD9DF979F2

Part of subcall function 00007FFD9DF9A2D8: _com_util::ConvertStringToBSTR.COMSUPP ref: 00007FFD9DF9A31D

Part of subcall function 00007FFD9DF9A524: SysFreeString.OLEAUT32 ref: 00007FFD9DF9A553

MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF97FB9
MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF98097
MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF983E6
MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF9816C

Part of subcall function 00007FFD9DF9A350: SysAllocString.OLEAUT32 ref: 00007FFD9DF9A395

MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF986EF
MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF989E5
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF98C7A
MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF98CFB
MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF98DA2
CoUninitialize.OLE32 ref: 00007FFD9DF98FCF

Strings

', xrefs: 00007FFD9DF983C9
: , xrefs: 00007FFD9DF9854B
MinUpdateVer: , xrefs: 00007FFD9DF97C0E
SetStaticVersionRedirectKeys: 7 : , xrefs: 00007FFD9DF98A59
: , xrefs: 00007FFD9DF982D0
: , xrefs: 00007FFD9DF98739
MaxUpdateVer: , xrefs: 00007FFD9DF97CB9
SetStaticVersionRedirectKeys: 4 : , xrefs: 00007FFD9DF982FA
SetStaticVersionRedirectKeys: 9 : , xrefs: 00007FFD9DF98E15
: , xrefs: 00007FFD9DF98855
: , xrefs: 00007FFD9DF98F06
SSV_DLL, xrefs: 00007FFD9DF97F39
: , xrefs: 00007FFD9DF981B6
TRUE, xrefs: 00007FFD9DF97E0C
SetStaticVersionRedirectKeys: 10 : , xrefs: 00007FFD9DF98F2D
MinorVer: , xrefs: 00007FFD9DF97ABD
VERSION, xrefs: 00007FFD9DF97F2B
SetStaticVersionRedirectKeys: 3 : , xrefs: 00007FFD9DF981E0
FALSE, xrefs: 00007FFD9DF97E13
SetStaticVersionRedirectKeys: 6 : , xrefs: 00007FFD9DF9887F
PARAMETERS: , xrefs: 00007FFD9DF979F8
REDIRECT_CLSID, xrefs: 00007FFD9DF97F1D
MajorVer: , xrefs: 00007FFD9DF97A21
TRUE, xrefs: 00007FFD9DF97EAC
InHighIntegrityMode: , xrefs: 00007FFD9DF97DDB
SetStaticVersionRedirectKeys: 5 : , xrefs: 00007FFD9DF98763
%1d.%1d.%1d, xrefs: 00007FFD9DF98C67
{E19F9331-3110-11D4-991C-005004D3B3DB}, xrefs: 00007FFD9DF983DA
: , xrefs: 00007FFD9DF98DEB
SetStaticVersionRedirectKeys: 2 : , xrefs: 00007FFD9DF98575
ssvDLL: , xrefs: 00007FFD9DF97D4C
SetStaticVersionRedirectKeys: 1 : , xrefs: 00007FFD9DF9845F
: , xrefs: 00007FFD9DF98B4A
MicroVer: , xrefs: 00007FFD9DF97B62
FALSE, xrefs: 00007FFD9DF97EB3
: , xrefs: 00007FFD9DF98435
: , xrefs: 00007FFD9DF98A2F
SetStaticVersionRedirectKeys: 8 : , xrefs: 00007FFD9DF98B74
createFamilyCLSID: , xrefs: 00007FFD9DF97E7B

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide$String$AllocConvertFreeInitializeUninitialize_com_util::swprintf
String ID: : $ : $ : $ : $ : $ : $ : $ : $ : $ : $%1d.%1d.%1d$'$FALSE$FALSE$InHighIntegrityMode: $MajorVer: $MaxUpdateVer: $MicroVer: $MinUpdateVer: $MinorVer: $PARAMETERS: $REDIRECT_CLSID$SSV_DLL$SetStaticVersionRedirectKeys: 1 : $SetStaticVersionRedirectKeys: 10 : $SetStaticVersionRedirectKeys: 2 : $SetStaticVersionRedirectKeys: 3 : $SetStaticVersionRedirectKeys: 4 : $SetStaticVersionRedirectKeys: 5 : $SetStaticVersionRedirectKeys: 6 : $SetStaticVersionRedirectKeys: 7 : $SetStaticVersionRedirectKeys: 8 : $SetStaticVersionRedirectKeys: 9 : $TRUE$TRUE$VERSION$createFamilyCLSID: $ssvDLL: ${E19F9331-3110-11D4-991C-005004D3B3DB}
API String ID: 302353784-2235754527
Opcode ID: 929ca3f9df810dd3edb0d50090094b04a678409c0df34416addf5ec5cabd3311
Instruction ID: ff670498425ad95962a99a61c8ae48b24ec6462c8cc0c7f10303d19b1b131270
Opcode Fuzzy Hash: 929ca3f9df810dd3edb0d50090094b04a678409c0df34416addf5ec5cabd3311
Instruction Fuzzy Hash: 69D22166B05AC699DB30DFB4D8622E83361FB41358F805332E65D5B6E9EF38DA49C340

Function 00007FFD9DFA8E14 Relevance: 40.4, APIs: 20, Strings: 2, Instructions: 1864COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FFD9DFA9B30
memcpy_s.LIBCPMT ref: 00007FFD9DFA9BC5
memcpy_s.LIBCPMT ref: 00007FFD9DFAA2BD
memcpy_s.LIBCPMT ref: 00007FFD9DFAA304
memcpy_s.LIBCPMT ref: 00007FFD9DFAA538
memcpy_s.LIBCPMT ref: 00007FFD9DFAA5A1
memcpy_s.LIBCPMT ref: 00007FFD9DFAA5DC
memcpy_s.LIBCPMT ref: 00007FFD9DFAA684
memcpy_s.LIBCPMT ref: 00007FFD9DFAA898
memcpy_s.LIBCPMT ref: 00007FFD9DFA9D77

Part of subcall function 00007FFD9DFABDFC: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFABE2E

memcpy_s.LIBCPMT ref: 00007FFD9DFA9F4D
memcpy_s.LIBCPMT ref: 00007FFD9DFAA03B
memcpy_s.LIBCPMT ref: 00007FFD9DFAA071
memcpy_s.LIBCPMT ref: 00007FFD9DFAA106
memcpy_s.LIBCPMT ref: 00007FFD9DFAA217
memcpy_s.LIBCPMT ref: 00007FFD9DFAAA67

Strings

%llu, xrefs: 00007FFD9DFA8E1A
, xrefs: 00007FFD9DFAA8AA

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $%llu
API String ID: 2880407647-3173638401
Opcode ID: 634d361a60300ce70fcd9f8ed63ab7ed394f02b0a8249bd0b0b7ba94679ccf0e
Instruction ID: 9ce2527c6cbabf2ff93dc182eceaeedb83de3f392ecbf5d210ba66a8250f673f
Opcode Fuzzy Hash: 634d361a60300ce70fcd9f8ed63ab7ed394f02b0a8249bd0b0b7ba94679ccf0e
Instruction Fuzzy Hash: 1703F672B181D28BDB758E64D4617F937A5FBC878CF405235DA4A5BB48FB38AA04CB40

Function 00007FFD9DF96D4C Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 114libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9DF9B3E4: GetModuleHandleA.KERNEL32(00000000,?,?,?,?,00000800,?,00007FFD9DF96DA4,00000000,?,00000104,?,?,00007FFD9DF9195C), ref: 00007FFD9DF9B473
Part of subcall function 00007FFD9DF9B3E4: GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,00000800,?,00007FFD9DF96DA4,00000000,?,00000104,?,?,00007FFD9DF9195C), ref: 00007FFD9DF9B48A
Part of subcall function 00007FFD9DF9B3E4: GetShortPathNameA.KERNEL32 ref: 00007FFD9DF9B4A2

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF96E1A
LoadLibraryA.KERNEL32(00000000,?,00000104,?,?,00007FFD9DF9195C), ref: 00007FFD9DF96E26
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF96E69
LoadLibraryA.KERNEL32(?,00000104,?,?,00007FFD9DF9195C), ref: 00007FFD9DF96E75
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF96E9B
LoadLibraryA.KERNEL32(?,00000104,?,?,00007FFD9DF9195C), ref: 00007FFD9DF96EA7
GetProcAddress.KERNEL32(?,00000104,?,?,00007FFD9DF9195C), ref: 00007FFD9DF96ED1
_Wcsftime.LIBCMT ref: 00007FFD9DF96F0E
FreeLibrary.KERNEL32(?,00000104,?,?,00007FFD9DF9195C), ref: 00007FFD9DF96F16

Part of subcall function 00007FFD9DF9B3E4: GetLongPathNameA.KERNEL32 ref: 00007FFD9DF9B4CF

Strings

getLatestInstalledVersion, xrefs: 00007FFD9DF96EC7
%s\%s, xrefs: 00007FFD9DF96E4C
jp2ssv.dll, xrefs: 00007FFD9DF96D93
%s\%s, xrefs: 00007FFD9DF96DFA
vcruntime140.dll, xrefs: 00007FFD9DF96DEA
ssv.dll, xrefs: 00007FFD9DF96DB4
msvcp140.dll, xrefs: 00007FFD9DF96E3D
%s\deploy.dll, xrefs: 00007FFD9DF96E85

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Library$LoadName_snwprintf_s$ModulePath$AddressFileFreeHandleLongProcShortWcsftime
String ID: %s\%s$%s\%s$%s\deploy.dll$getLatestInstalledVersion$jp2ssv.dll$msvcp140.dll$ssv.dll$vcruntime140.dll
API String ID: 2458015616-2230199283
Opcode ID: 189665066616595832c88f8149e6b8d370ef5ce3a6ca16d5fd219ee3d0b9010f
Instruction ID: f9ed638ba02ae08d61a1bb98d2392331a0271070fd4618784ff055d433774365
Opcode Fuzzy Hash: 189665066616595832c88f8149e6b8d370ef5ce3a6ca16d5fd219ee3d0b9010f
Instruction Fuzzy Hash: 41511132B08EC295E731DFA1E8661E92365BB897C9F444236DA8D46799FF3CD209C310

Function 00007FFD9DFBA4F4 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1207COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FFD9DFBA53D
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBAB48
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBAD0B
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBAF12
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBB1D6
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBB3D1
memcpy_s.LIBCPMT ref: 00007FFD9DFBB4BF
memcpy_s.LIBCPMT ref: 00007FFD9DFBB56A
memcpy_s.LIBCPMT ref: 00007FFD9DFBB633

Strings

1#INF, xrefs: 00007FFD9DFBB707
1#SNAN, xrefs: 00007FFD9DFBB6E2
1#QNAN, xrefs: 00007FFD9DFBB6EB
1#IND, xrefs: 00007FFD9DFBB6D9

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 392f6b6f0b3c0a0cfcc601a5e793c3bdcc4a232016a2b6fb597afb8c494e4a74
Instruction ID: 8cda0e437a31026dd94e9395c4cc22c53375cd85da89ac6185b5e198c24156ef
Opcode Fuzzy Hash: 392f6b6f0b3c0a0cfcc601a5e793c3bdcc4a232016a2b6fb597afb8c494e4a74
Instruction Fuzzy Hash: 3AB2E772B082C28AE7758EA5D5617F937A1FB44388F505235DB4E67B88EB7CE940CB10

Function 00007FFD9DF957E0 Relevance: 21.7, APIs: 9, Strings: 3, Instructions: 733COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FFD9DF958E8
MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF959FB
GetModuleHandleA.KERNEL32 ref: 00007FFD9DF95A67
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DF95BC3
GetModuleFileNameA.KERNEL32 ref: 00007FFD9DF95DBB
MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF95ECF
GetModuleHandleA.KERNEL32 ref: 00007FFD9DF95F3F
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DF960C9
MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF961D6

Strings

REGISTRY, xrefs: 00007FFD9DF95B98, 00007FFD9DF961F0
Module, xrefs: 00007FFD9DF95B5D, 00007FFD9DF95F51, 00007FFD9DF9600C
Module_Raw, xrefs: 00007FFD9DF95B7E, 00007FFD9DF9602D

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Module$ByteCharMultiWide$FileHandleName_invalid_parameter_noinfo
String ID: Module$Module_Raw$REGISTRY
API String ID: 633357525-549000027
Opcode ID: f59b16d5c55a5ea1640bd3f4e49bf1d21e274a211428c2b9c7f45e150542dd60
Instruction ID: ca96526e646a2ff72c1574e3788fa97b729dae3d059c22670a23981d55d7ed38
Opcode Fuzzy Hash: f59b16d5c55a5ea1640bd3f4e49bf1d21e274a211428c2b9c7f45e150542dd60
Instruction Fuzzy Hash: 73627F22F09AC295EB759FE5D4622B82390AF54B98F844331EA9D477D6FF3CE5498300

Function 00007FFD9DF9475C Relevance: 18.5, APIs: 8, Strings: 4, Instructions: 483stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF9398A
Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF939AC
Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF93A41

lstrcmpiA.KERNEL32(?,00000000,FFFFFFFF,00000000,?,00000000,00000000,00000000,00007FFD9DF943AB), ref: 00007FFD9DF947E3
lstrcmpiA.KERNEL32(?,00000000,00000000,00000000,00007FFD9DF943AB), ref: 00007FFD9DF947FB
CharNextA.USER32(?,00000000,00000000,00000000,00007FFD9DF943AB), ref: 00007FFD9DF94846
lstrcmpiA.KERNEL32(?,00000000,00000000,00000000,00007FFD9DF943AB), ref: 00007FFD9DF9486D
lstrcmpiA.KERNEL32(?,00000000,00000000,00000000,00007FFD9DF943AB), ref: 00007FFD9DF948E6
lstrcmpiA.KERNEL32(?,00000000,00000000,00000000,00007FFD9DF943AB), ref: 00007FFD9DF94912

Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF939C3
Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF939D9
Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF939E8
Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF93A60

CharNextA.USER32(?,00000000,00000000,00000000,00007FFD9DF943AB), ref: 00007FFD9DF94A17
lstrcmpiA.KERNEL32(?,00000000,00000000,00000000,00007FFD9DF943AB), ref: 00007FFD9DF94CAB

Strings

Delete, xrefs: 00007FFD9DF947D9
NoRemove, xrefs: 00007FFD9DF948DC
ForceRemove, xrefs: 00007FFD9DF947F1
Val, xrefs: 00007FFD9DF94908

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CharNext$lstrcmpi
String ID: Delete$ForceRemove$NoRemove$Val
API String ID: 3586774192-1781481701
Opcode ID: b792288ab48acdc3113caaf7659aec790278bc08f99a8c1b028134949074f2c6
Instruction ID: d6036cc4984663d679969c34d55cad5daff245c2a3a970e2ac3f0fe43b0a76c7
Opcode Fuzzy Hash: b792288ab48acdc3113caaf7659aec790278bc08f99a8c1b028134949074f2c6
Instruction Fuzzy Hash: 5E129261F086C246FB349FE5A8222B966D1AFA5BD4F404335DACD9B695FF3CE8048704

Function 00007FFD9DF99010 Relevance: 16.7, APIs: 4, Strings: 7, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9DF93AD0: RegOpenKeyExA.ADVAPI32 ref: 00007FFD9DF93B22

CoInitialize.OLE32 ref: 00007FFD9DF99150
MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF991D3
MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF99229
CoUninitialize.OLE32 ref: 00007FFD9DF99291

Strings

CLSID_STRING, xrefs: 00007FFD9DF991EA
NODOTVERSION, xrefs: 00007FFD9DF99156
Software, xrefs: 00007FFD9DF99056
JavaSoft, xrefs: 00007FFD9DF990A5
{5852F5ED-8BF4-11D4-A245-0080C6F74284}, xrefs: 00007FFD9DF9921A
Java Plug-in, xrefs: 00007FFD9DF990C4
', xrefs: 00007FFD9DF9920A

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide$InitializeOpenUninitialize
String ID: '$CLSID_STRING$Java Plug-in$JavaSoft$NODOTVERSION$Software${5852F5ED-8BF4-11D4-A245-0080C6F74284}
API String ID: 1861335079-2342161888
Opcode ID: 7f9f342f8b82bc003bba41477066fe6de19d44da589d027c7ffad286b251a31d
Instruction ID: cd6e31d012d03e5a4b0049faba7b9ef206c9c93dc05323ac4d704814177e5a54
Opcode Fuzzy Hash: 7f9f342f8b82bc003bba41477066fe6de19d44da589d027c7ffad286b251a31d
Instruction Fuzzy Hash: E9918E26B08AC299E7709FB1D8622E937A4FB44758F449335EA9E477D8EF38D158C340

Function 00007FFD9DF9DE90 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 261COMMON

Download Yara Rule

Strings

%s\Sun\Java\Deployment\%s, xrefs: 00007FFD9DF9E233
h, xrefs: 00007FFD9DF9E038
DeploymentRuleSet.jar, xrefs: 00007FFD9DF9E21D
\Java\Java Update\jucheck.exe, xrefs: 00007FFD9DF9DF55

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID:
String ID: %s\Sun\Java\Deployment\%s$DeploymentRuleSet.jar$\Java\Java Update\jucheck.exe$h
API String ID: 0-835978652
Opcode ID: c06f65703be671fb740b90d4bb2b903a746086a75d06577ab66fec3626ddce02
Instruction ID: 4adab57c2cb75dbb5ed0ca27dc2d97b3422959f4e45217ad25e20d72e831239f
Opcode Fuzzy Hash: c06f65703be671fb740b90d4bb2b903a746086a75d06577ab66fec3626ddce02
Instruction Fuzzy Hash: 0BB1A322F19BC285EB209FB4D8662AD27A1FB45798F504731EA9D17AD9EF3CD194C300

Function 00007FFD9DF94418 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 231libraryCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FFD9DF94534
LoadLibraryExA.KERNEL32 ref: 00007FFD9DF94559
LoadLibraryExA.KERNEL32 ref: 00007FFD9DF94574
FindResourceA.KERNEL32 ref: 00007FFD9DF9459C
LoadResource.KERNEL32 ref: 00007FFD9DF945BA
SizeofResource.KERNEL32 ref: 00007FFD9DF945D2
FreeLibrary.KERNEL32 ref: 00007FFD9DF9469F

Strings

REGISTRY, xrefs: 00007FFD9DF94422

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: LibraryLoadResource$ByteCharFindFreeMultiSizeofWide
String ID: REGISTRY
API String ID: 2112413501-194740550
Opcode ID: acd537686daa82ab8c00cec96e649a415d24f43cbf1fb046536ea460a8e787fc
Instruction ID: 491193953004ccb8331cf4f638af7a2e558944369c313dbeb5cca76ee70fcd49
Opcode Fuzzy Hash: acd537686daa82ab8c00cec96e649a415d24f43cbf1fb046536ea460a8e787fc
Instruction Fuzzy Hash: 89911562F08AC286EB359FE498221B822D0FF557A8F544735DAAD47BC5FF3CE9058204

Function 00007FFD9DF9DCA8 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 112registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,00000800,?,00007FFD9DF9D38D), ref: 00007FFD9DF9DD30
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9DD67
RegOpenKeyExA.ADVAPI32(?,?,?,00000800,?,00007FFD9DF9D38D), ref: 00007FFD9DF9DD8D

Strings

SOFTWARE\JavaSoft\Java Runtime Environment, xrefs: 00007FFD9DF9DD22
RuntimeLib, xrefs: 00007FFD9DF9DDD0
%s\%s, xrefs: 00007FFD9DF9DD59
JavaHome, xrefs: 00007FFD9DF9DE03
SOFTWARE\JavaSoft\Java Runtime Environment, xrefs: 00007FFD9DF9DD4D

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Open$swprintf
String ID: %s\%s$JavaHome$RuntimeLib$SOFTWARE\JavaSoft\Java Runtime Environment$SOFTWARE\JavaSoft\Java Runtime Environment
API String ID: 3904290426-1474300321
Opcode ID: f0aa83d946c3e49064ca171275f7c7b4d798c0e82ce483c5b70335f5c635de81
Instruction ID: 9b595c0c1350833c15048bd6ae303fd59c80765eb3189f6781188f9f0cc2f698
Opcode Fuzzy Hash: f0aa83d946c3e49064ca171275f7c7b4d798c0e82ce483c5b70335f5c635de81
Instruction Fuzzy Hash: 91515E32B08B8595E730DFA5E8515AA73A4FB85794F504336EA8D03A98EF3DD615CB00

Function 00007FFD9DFB6074 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 329timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FFD9DFB60AF

Part of subcall function 00007FFD9DFB5820: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFB5834

_get_daylight.LIBCMT ref: 00007FFD9DFB609E

Part of subcall function 00007FFD9DFB5880: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFB5894

_get_daylight.LIBCMT ref: 00007FFD9DFB629F
_get_daylight.LIBCMT ref: 00007FFD9DFB62B0
_get_daylight.LIBCMT ref: 00007FFD9DFB62C1
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD9DFB64F5), ref: 00007FFD9DFB62E8

Strings

?, xrefs: 00007FFD9DFB63BA

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$InformationTimeZone
String ID: ?
API String ID: 435049134-1684325040
Opcode ID: bd7881590763dc93024a16697a97a44a50c4d14023ff70fb2882da424a42b082
Instruction ID: 1d52c1719c053f489991219f1e9b8f6de77e41bde8a2ec85ce65ea4d03be4dd0
Opcode Fuzzy Hash: bd7881590763dc93024a16697a97a44a50c4d14023ff70fb2882da424a42b082
Instruction Fuzzy Hash: D0D19522B08AC289FB709FA5D9622B92790EB447D4F845335EB8D4B795FF3CE4418760

Function 00007FFD9DF92BCC Relevance: 9.4, APIs: 6, Instructions: 412COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF9398A
Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF939AC
Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF93A41

Part of subcall function 00007FFD9DF962A8: lstrcmpiA.KERNEL32(?,00000000,00000000,?), ref: 00007FFD9DF962C4

CharNextA.USER32(?,00006AC2EEAEFA12,00000000,?,?,00000000,00000000,?), ref: 00007FFD9DF92C76
CharNextA.USER32(?,00006AC2EEAEFA12,00000000,?,?,00000000,00000000,?), ref: 00007FFD9DF92D51
CharNextA.USER32(?,00006AC2EEAEFA12,00000000,?,?,00000000,00000000,?), ref: 00007FFD9DF92D69

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CharNext$lstrcmpi
String ID:
API String ID: 3586774192-0
Opcode ID: 40fb3e7af9d98c7d0256e03d4a62867a1e0ddf12141ad93470b76351430a399e
Instruction ID: 8dd21e8cc8e8f23be52439a6d704da1a0b1b6b9aec5233f0a038565c388c7d69
Opcode Fuzzy Hash: 40fb3e7af9d98c7d0256e03d4a62867a1e0ddf12141ad93470b76351430a399e
Instruction Fuzzy Hash: 90F1D022F086C296EB349FE598662F92791EB447A8F840335EA9D47BD5FF3CD5498300

Function 00007FFD9DFAE2EC Relevance: 9.2, APIs: 6, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFAE30E
_get_daylight.LIBCMT ref: 00007FFD9DFAE36A
_get_daylight.LIBCMT ref: 00007FFD9DFAE37B
_get_daylight.LIBCMT ref: 00007FFD9DFAE38C
_isindst.LIBCMT ref: 00007FFD9DFAE3DD
_isindst.LIBCMT ref: 00007FFD9DFAE430

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: b4432a344c3a555ee76dee4d310d3f8f8cee425a12fa84d97cf3040707d73335
Instruction ID: 0d4c8938d52a2f72e4930ea3d889ba025c31f55b0c8b242d73b5046e61e1f358
Opcode Fuzzy Hash: b4432a344c3a555ee76dee4d310d3f8f8cee425a12fa84d97cf3040707d73335
Instruction Fuzzy Hash: B491FB72B043864BEB788FA5D9623782795EB947C8F448135DA4D8B789FF3CE5508700

Function 00007FFD9DFA3E7C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFD9DFA3EF5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFD9DFA3F0D
RtlVirtualUnwind.KERNEL32 ref: 00007FFD9DFA3F48
IsDebuggerPresent.KERNEL32 ref: 00007FFD9DFA3F81
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFD9DFA3F8B
UnhandledExceptionFilter.KERNEL32 ref: 00007FFD9DFA3F96

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 95237892bd91c0d9798e73f4bc81ba1e30643d7e4dd7d42e5968682c736c0ade
Instruction ID: 0b0fc8bd379d4fdcdf309412dd262db7002df328845c0bcd2c5f9ea13efcb922
Opcode Fuzzy Hash: 95237892bd91c0d9798e73f4bc81ba1e30643d7e4dd7d42e5968682c736c0ade
Instruction Fuzzy Hash: E6317F36718BC19ADB709FA5E8512AE73A4FB84798F504235EA8D43B58EF3CC159CB00

Function 00007FFD9DFB627C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 157timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FFD9DFB629F

Part of subcall function 00007FFD9DFB5880: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFB5894

_get_daylight.LIBCMT ref: 00007FFD9DFB62B0

Part of subcall function 00007FFD9DFB5820: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFB5834

_get_daylight.LIBCMT ref: 00007FFD9DFB62C1

Part of subcall function 00007FFD9DFB5850: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFB5864

Part of subcall function 00007FFD9DFB0044: HeapFree.KERNEL32(?,?,00007FFD9DFAF933,00007FFD9DFB9E88,?,?,?,00007FFD9DFB9ECB,?,?,00006AC2EEAEFA12,00007FFD9DFB9A38,?,?,?,00007FFD9DFB996B), ref: 00007FFD9DFB005A
Part of subcall function 00007FFD9DFB0044: GetLastError.KERNEL32(?,?,00007FFD9DFAF933,00007FFD9DFB9E88,?,?,?,00007FFD9DFB9ECB,?,?,00006AC2EEAEFA12,00007FFD9DFB9A38,?,?,?,00007FFD9DFB996B), ref: 00007FFD9DFB006C

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD9DFB64F5), ref: 00007FFD9DFB62E8

Strings

?, xrefs: 00007FFD9DFB63BA

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: ?
API String ID: 3458911817-1684325040
Opcode ID: 04696fbbc6ec48e3e68bb116718cf29dd6bf503b7e1fde6fa10e7bb2df231013
Instruction ID: 9bb98ad639807659d1864f45ddc7aa3fa9fb2b171ec29048953caab52b4b9b34
Opcode Fuzzy Hash: 04696fbbc6ec48e3e68bb116718cf29dd6bf503b7e1fde6fa10e7bb2df231013
Instruction Fuzzy Hash: 6C61A332B08A8289E7709FA1E8621A977A0FB44794F844336EB8D47795FF3CE541C760

Function 00007FFD9DFBD5E4 Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 00007FFD9DFBD653
WriteFile.KERNEL32 ref: 00007FFD9DFBD8FD
WriteFile.KERNEL32 ref: 00007FFD9DFBD94F
GetLastError.KERNEL32 ref: 00007FFD9DFBDA91
GetLastError.KERNEL32 ref: 00007FFD9DFBDAA3

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: 8ef58a2333d960558992878652b1ff3caf0e79299979685ffb4df9ab5f5c2baa
Instruction ID: dc5c9a68fb8430c6e26227bcc53a0166a2584965f18c6eb9921ffb1661da706a
Opcode Fuzzy Hash: 8ef58a2333d960558992878652b1ff3caf0e79299979685ffb4df9ab5f5c2baa
Instruction Fuzzy Hash: 62D1BF62B08AC19AE720CFA4D9612ED77B1FB45798B144236CB8E47F99EE3CD016C710

Function 00007FFD9DF994A8 Relevance: 7.6, APIs: 5, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32 ref: 00007FFD9DF996A4

Part of subcall function 00007FFD9DFABFB8: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFABFE0

FindFirstFileA.KERNEL32 ref: 00007FFD9DF9956E
_local_unwind.LIBVCRUNTIME ref: 00007FFD9DF995FC
FindNextFileA.KERNEL32 ref: 00007FFD9DF99660
DeleteFileA.KERNEL32 ref: 00007FFD9DF99676

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNext_invalid_parameter_noinfo_local_unwind
String ID:
API String ID: 1705660847-0
Opcode ID: c6383e6905e86354cab5c0d84a085e6cc6792051aa71fabd5b89885bc194bd20
Instruction ID: f5196266d7ca8d569379c5051e37ca112186135434e07a6405ae1465acd634cb
Opcode Fuzzy Hash: c6383e6905e86354cab5c0d84a085e6cc6792051aa71fabd5b89885bc194bd20
Instruction Fuzzy Hash: 64519226B08AC151E670DF91E8622EAA3A0FB85BD4F455232DEDD53795FF3CD5098B00

Function 00007FFD9DF9F3F4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFD9DF9F455
IsDebuggerPresent.KERNEL32 ref: 00007FFD9DF9F46D
OutputDebugStringW.KERNEL32 ref: 00007FFD9DF9F47E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FFD9DF9F477

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 32159da2667f3b9849b16fdc563a20598ba3c85a850bf4a7bde06273c9ac0adb
Instruction ID: 27828d8c99a7c72c2c53d0b379053ff8a06c358047c16da4bd20ed3c6a8b8ca8
Opcode Fuzzy Hash: 32159da2667f3b9849b16fdc563a20598ba3c85a850bf4a7bde06273c9ac0adb
Instruction Fuzzy Hash: 3D114C32B14B82A6E7249FA6D6663B932A0FF48385F444235CA8D42A51FF3CE178C750

Function 00007FFD9DFA42A8 Relevance: 6.1, APIs: 4, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FFD9DFA42F8
GetSystemInfo.KERNEL32 ref: 00007FFD9DFA430F

Part of subcall function 00007FFD9DFB0FA8: try_get_function.LIBVCRUNTIME ref: 00007FFD9DFB0FCB

VirtualAlloc.KERNEL32 ref: 00007FFD9DFA437C
VirtualProtect.KERNEL32 ref: 00007FFD9DFA4396

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Virtual$AllocInfoProtectQuerySystemtry_get_function
String ID:
API String ID: 3306135294-0
Opcode ID: 5ca0a7ec0eec55a3a2c4a08aeb90b18ac1e3441cfa849694d88987f5aa331d19
Instruction ID: 11eb7b4b0b26c4621cb6d3c4ea004fd03442421697f6b287d22f1f4922b444b3
Opcode Fuzzy Hash: 5ca0a7ec0eec55a3a2c4a08aeb90b18ac1e3441cfa849694d88987f5aa331d19
Instruction Fuzzy Hash: 5C316D32724B859AEB20DF75D8517E823A5FB48B88F484135DA4D8BB44EF3DE585C700

Function 00007FFD9DFB6690 Relevance: 5.5, APIs: 3, Instructions: 1031COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFB6A82
_get_daylight.LIBCMT ref: 00007FFD9DFB6B82
_get_daylight.LIBCMT ref: 00007FFD9DFB6B9B

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 9d5c94c60ce6c146c63a2e44383a9ea8ac5c14ff111f73395e182fb61da06cd8
Instruction ID: ed6e5b50068142f677b5650b7a2d48b29ff12eebbe9e58e8db08434ca56f6363
Opcode Fuzzy Hash: 9d5c94c60ce6c146c63a2e44383a9ea8ac5c14ff111f73395e182fb61da06cd8
Instruction Fuzzy Hash: 48928D76B08BC286EB348FA4D86217927A5FB45788F148235DBCD0BA94EF3DE511C720

Function 00007FFD9DFB1DC8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFB1E2C

Strings

gfffffff, xrefs: 00007FFD9DFB20C9

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 0c5c02b96e18df3db29adbf39ba0761df5944b8030605a219fd084750963f313
Instruction ID: cd660785c93d0a9f6632e44adec6049e3be35ecad4fc9439591cf6f8572a6429
Opcode Fuzzy Hash: 0c5c02b96e18df3db29adbf39ba0761df5944b8030605a219fd084750963f313
Instruction Fuzzy Hash: 3A915762B097C686EF21CFA5A4213BD6B94AB54BC4F098232CB8D47395FE3DE506C311

Function 00007FFD9DFB4588 Relevance: 4.9, APIs: 3, Instructions: 439stringCOMMON

Download Yara Rule

APIs

strchr.LIBVCRUNTIME ref: 00007FFD9DFB45C8

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: strchr
String ID:
API String ID: 2830005266-0
Opcode ID: 65dd2a7eccd2c79d44cd0dbcb66701b859529cf1ab0b7db1b97cbc727733571f
Instruction ID: 7a0d42ce5f2195be4aa4f8b5a5ab76fb22540899d36bc28018de58f1138d9c10
Opcode Fuzzy Hash: 65dd2a7eccd2c79d44cd0dbcb66701b859529cf1ab0b7db1b97cbc727733571f
Instruction Fuzzy Hash: DC02AD21B196D640FA319F96A6332792694AF41BA8F188735DFED477D1FE3CE4018324

Function 00007FFD9DFAAC50 Relevance: 4.8, APIs: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FFD9DFAACB6
memcpy_s.LIBCPMT ref: 00007FFD9DFAACE1

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: c3ce4f40abd015804e06012491579be2688d1f3553d77213851906fb9fecb7c1
Instruction ID: 6d00ca4d2cef87baf9f74ab593a530b0fc4f3b26256de9301bda9dba00910a40
Opcode Fuzzy Hash: c3ce4f40abd015804e06012491579be2688d1f3553d77213851906fb9fecb7c1
Instruction Fuzzy Hash: 9AC1D472B182DA87EB34CF59E055A6AB791FB94784F448235DB9E53744FA3DE804CB00

Function 00007FFD9DFAE8C0 Relevance: 4.6, APIs: 3, Instructions: 99timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFAE8F8

Part of subcall function 00007FFD9DFA40E0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FFD9DFA408D), ref: 00007FFD9DFA40E9
Part of subcall function 00007FFD9DFA40E0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FFD9DFA408D), ref: 00007FFD9DFA410E

_get_daylight.LIBCMT ref: 00007FFD9DFAE910
GetTimeZoneInformation.KERNEL32(?), ref: 00007FFD9DFAE969

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CurrentFeatureInformationPresentProcessProcessorTimeZone_get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 341842238-0
Opcode ID: a356ff44c7fe08ede85d1b24c399bd14485f0c4609b727f1bb95983bde910740
Instruction ID: 1bb1c6284a5291d915929529a68c1ac0aac804a785f70dafc072cbb6487b9801
Opcode Fuzzy Hash: a356ff44c7fe08ede85d1b24c399bd14485f0c4609b727f1bb95983bde910740
Instruction Fuzzy Hash: A941A066B187C586EB74CFE5E4626A962A0EB98380F409231EADD47B95FF3CE5508700

Function 00007FFD9DF977C0 Relevance: 4.6, APIs: 3, Instructions: 84fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32 ref: 00007FFD9DF978ED

Part of subcall function 00007FFD9DFABFB8: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFABFE0

FindFirstFileA.KERNEL32 ref: 00007FFD9DF9786C

Part of subcall function 00007FFD9DF9B70C: CreateFileA.KERNEL32 ref: 00007FFD9DF9B734
Part of subcall function 00007FFD9DF9B70C: GetLastError.KERNEL32 ref: 00007FFD9DF9B740

FindNextFileA.KERNEL32 ref: 00007FFD9DF978C7

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: FileFind$CloseCreateErrorFirstLastNext_invalid_parameter_noinfo
String ID:
API String ID: 2842505342-0
Opcode ID: c08843fb8f68cf03f7789a4c46c241b51713ca92ff95c9c2bd7797747c459e41
Instruction ID: 0075066797e1296a5b08bca9acdd51c1c0d96e61ada3099477bcbeef49798990
Opcode Fuzzy Hash: c08843fb8f68cf03f7789a4c46c241b51713ca92ff95c9c2bd7797747c459e41
Instruction Fuzzy Hash: 64317362B18AC195E720EFB5D8622E96390FB84794F844632DE8D47799FF38D60AC740

Function 00007FFD9DFB2660 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFB2691

Part of subcall function 00007FFD9DFA40E0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FFD9DFA408D), ref: 00007FFD9DFA40E9
Part of subcall function 00007FFD9DFA40E0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FFD9DFA408D), ref: 00007FFD9DFA410E

Strings

-, xrefs: 00007FFD9DFB286C

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: -
API String ID: 4036615347-2547889144
Opcode ID: f30431a1fd95573c15dcfd89aa47b9aaae2925108b865685cb72cdfe89fbaf68
Instruction ID: 066c5511e3a4727bb29f84c4756728f84966702eeb2b2e1d1368332c5befb307
Opcode Fuzzy Hash: f30431a1fd95573c15dcfd89aa47b9aaae2925108b865685cb72cdfe89fbaf68
Instruction Fuzzy Hash: F2810F32B087C686EA748EA9B46236AA691FB95794F144335EBDD03BD8EF3CD4008710

Function 00007FFD9DFB7FA8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFB7FD8

Part of subcall function 00007FFD9DFA40E0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FFD9DFA408D), ref: 00007FFD9DFA40E9
Part of subcall function 00007FFD9DFA40E0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FFD9DFA408D), ref: 00007FFD9DFA410E

Strings

*?, xrefs: 00007FFD9DFB7FFF

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: *?
API String ID: 4036615347-2564092906
Opcode ID: 4f4b62dfc343c943f822ecf4745ef85c72e1cea372fbfdd212ab7dff0f8a4782
Instruction ID: a6066241bf34ba183c4cd13a68fda49500fe091990fa292b4d912a648cce43d9
Opcode Fuzzy Hash: 4f4b62dfc343c943f822ecf4745ef85c72e1cea372fbfdd212ab7dff0f8a4782
Instruction Fuzzy Hash: 5351D166B15BD685EF20CFE698225A927A0FF84BD8B484631DF9D07B85FE3CD0418320

Function 00007FFD9DFC0BF8 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FFD9DFC0E47
RaiseException.KERNEL32 ref: 00007FFD9DFC0E58

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: b2e9369180dbe41cd3aa7bc69ba0ad97f333a94b5de1c0bdfb9b7b427a26ee5b
Instruction ID: 327af77f3474d57e860c4a77e961ea588bd556e0cadeb16df96b7f20702ad57f
Opcode Fuzzy Hash: b2e9369180dbe41cd3aa7bc69ba0ad97f333a94b5de1c0bdfb9b7b427a26ee5b
Instruction Fuzzy Hash: 1AB16D77600B858BEB25DF6DC55636C37A0F784B88F148A21DA9D877A4DF39E462C700

Function 00007FFD9DF953F0 Relevance: 3.2, APIs: 2, Instructions: 189COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,00007FFD9DF90000,00000000,00000000,?,?,?,00007FFD9DF9620F), ref: 00007FFD9DF9550F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,00007FFD9DF90000,00000000,00000000,?,?,?,00007FFD9DF9620F), ref: 00007FFD9DF955F2

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 800fbec7aa9bf4a8cbbcc61cded88ad31487562974ab2d17b07c78309925f791
Instruction ID: b3aabf54621fb39e54f7124de35748b2e0006feaabaef5a5cfc6b776f767a8a8
Opcode Fuzzy Hash: 800fbec7aa9bf4a8cbbcc61cded88ad31487562974ab2d17b07c78309925f791
Instruction Fuzzy Hash: 4961F232F08BC285EA349FA5A5225B922A1EB557B4F540735EABD47BC5EF3CE5058300

Function 00007FFD9DFBCA2C Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FFD9DFBCA90

Part of subcall function 00007FFD9DFC0380: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFC0394

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 84dbe30e15e6eae941505677de12013f0c5c3030e7563b86cffdf7c97d8bb012
Instruction ID: 29e6245b36f5804cf9201ab4482b12a19732f7fcce133c7ee0664d6daa06890e
Opcode Fuzzy Hash: 84dbe30e15e6eae941505677de12013f0c5c3030e7563b86cffdf7c97d8bb012
Instruction Fuzzy Hash: 1371E322F086C246F7748EB9947263F6281AF90760F144735DBED87AC1FE7DE8418A20

Function 00007FFD9DFB81B4 Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75528dbd0d7067ecdd27007f8628ad0d228c9b8524537b888c72de96c31e67b
Instruction ID: 47a0a93ac7797db38be4c74879d9da00e0b649e2b9b0d2298454ac4d4ef1c96f
Opcode Fuzzy Hash: e75528dbd0d7067ecdd27007f8628ad0d228c9b8524537b888c72de96c31e67b
Instruction Fuzzy Hash: AA51A026B087D194F7309FB6A9112AE7BA5BB847D4F144235EE9C47A85EF3CD141C700

Function 00007FFD9DF937D4 Relevance: 1.5, APIs: 1, Instructions: 33comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FFD9DF93816

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: e6521d9c78b99e8d543134cf68f819a2d73d25d7cf811e9d7d2394d92e07a1ca
Instruction ID: 8e0512bd1b275aaba839e8e37e0361bbe3a716975a6da7ce95ee13b461d8bd6b
Opcode Fuzzy Hash: e6521d9c78b99e8d543134cf68f819a2d73d25d7cf811e9d7d2394d92e07a1ca
Instruction Fuzzy Hash: 7F012C7BB08A8282E7218FA5E421069A3A1FB84BC4B588231DA8D43758EF39D45AC700

Function 00007FFD9DF9A744 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FFD9DF9A77C

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 62c5b087a6450926370cf8209f5462acc4037c5462491ac5b58cda2a3a1f95f5
Instruction ID: 60332a27836927dab44d941a673f78269b873a384350b8d1e760ec60d58154e9
Opcode Fuzzy Hash: 62c5b087a6450926370cf8209f5462acc4037c5462491ac5b58cda2a3a1f95f5
Instruction Fuzzy Hash: 62E0302AB1858186F770AFA0E42636A62A0FB88744F814225D68D02645EF3CD209CF10

Function 00007FFD9DFA5858 Relevance: 1.5, Strings: 1, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FFD9DFA59F1

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 96dcd4de4b1df0aef028137f7808bc8982df8eab9eceec7f6b82003babea1daa
Instruction ID: 8691563e628b6af077d213ddd4b01d9f29ef5a2491fffe53966f77f85ec28415
Opcode Fuzzy Hash: 96dcd4de4b1df0aef028137f7808bc8982df8eab9eceec7f6b82003babea1daa
Instruction Fuzzy Hash: 6A71E411B0C6C646FA748E9990623BA63A2ABE5768F540335CDCD0F7D9FE3DE8468701

Function 00007FFD9DFA5ADC Relevance: 1.4, Strings: 1, Instructions: 196COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FFD9DFA5C75

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 440c5aab33dc9f6f19e7a2815fc18fa09c256e57a27b87fb0389583b4f7a7f1a
Instruction ID: aea106139752d70edc9ab0a0b0542a5f9f4a14d6d2c37f9e4b9e1968431263ae
Opcode Fuzzy Hash: 440c5aab33dc9f6f19e7a2815fc18fa09c256e57a27b87fb0389583b4f7a7f1a
Instruction Fuzzy Hash: 94610611B0C6C646FA784EA950223BA5791AFE1788F581332DDCD1B7CAFE3DE8468741

Function 00007FFD9DFB93A4 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFD9DFB93A8

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0fecff8c7abd5b688fc1d4c59210d4994446f0f19b179665c75e03d6f4b80512
Instruction ID: f82f29cdce530bc22c1449e464e497615c74a5f234994491591d48d1f7a89cf0
Opcode Fuzzy Hash: 0fecff8c7abd5b688fc1d4c59210d4994446f0f19b179665c75e03d6f4b80512
Instruction Fuzzy Hash: 28B09220F17A82CAEE182FA16C9325462A4BF48B00F858238C88C41320FF2C21F94B10

Function 00007FFD9DFA8908 Relevance: .3, Instructions: 285COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5949e5ca0c8ce3dcaf72348acdb818015073b73d60e7c43b96f1175034bdaf6
Instruction ID: dd95abe883cc54a7722aec5f46ea1caad15105b4affabb2d5b3566c23dfda88f
Opcode Fuzzy Hash: b5949e5ca0c8ce3dcaf72348acdb818015073b73d60e7c43b96f1175034bdaf6
Instruction Fuzzy Hash: 77916A27B182C246FA394EA590323B92690AFC0794F84173ADE9E4B7C0FE7CE405DB10

Function 00007FFD9DFAF87C Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: bcdc896120c78d454949465a930d2dfda336c6b9241685cc9389bf13f65822f1
Instruction ID: b97850a133126f91ab1656fc216bfb79c858cc5de7959f40f6687e130cbcf05f
Opcode Fuzzy Hash: bcdc896120c78d454949465a930d2dfda336c6b9241685cc9389bf13f65822f1
Instruction Fuzzy Hash: 5D41F833714A9445EF54CFAAD9251A9B3A1AB8CFD4B099532EE8D87B58FF3CD0458304

Function 00007FFD9DFAB204 Relevance: .1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef758bb68dd0015e5eebd32fc6ef9229b7fc843b489c190bb509a01dbbf15546
Instruction ID: 8e7376c4b9dd2499dd2841e4b8ee151c3265156f1333c722c46c44c426368e03
Opcode Fuzzy Hash: ef758bb68dd0015e5eebd32fc6ef9229b7fc843b489c190bb509a01dbbf15546
Instruction Fuzzy Hash: 4D316F32F1C2C385FAB65EE9957767D16929FC2340F288332C9AD06D99FC3AF9819500

Function 00007FFD9DFC0910 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6b969d1584351714580b89cd7e8c15aedd21309ac5cf89bc00d356c17acacad
Instruction ID: e243a2ea05f6c707856003fcf8d72cd0358e6dce4c480e6c8e6d77cc26c6758c
Opcode Fuzzy Hash: b6b969d1584351714580b89cd7e8c15aedd21309ac5cf89bc00d356c17acacad
Instruction Fuzzy Hash: EEF068727182958FDBA88F6DA41362977D0F7083C4F408539D5CD87B54E63D90618F14

Function 00007FFD9DF93B5C Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 247memoryCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.OLE32(?,00000000,FFFFFFFF,00000000,?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93BCD
CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93C33
CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93C3F
CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93C4B
CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93C57
CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93C91
CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93CA4
CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93CB3

Part of subcall function 00007FFD9DF931C8: CoTaskMemRealloc.OLE32(?,?,?,00007FFD9DF92B82), ref: 00007FFD9DF9321B

CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93D1C
CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93D31
CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93D53
CharNextA.USER32 ref: 00007FFD9DF93D89
CharNextA.USER32 ref: 00007FFD9DF93E31
CoTaskMemFree.OLE32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93E62

Strings

}}, xrefs: 00007FFD9DF93CF5
HKCR, xrefs: 00007FFD9DF93C17
HKCU{Software{Classes, xrefs: 00007FFD9DF93C60

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CharNext$Task$AllocFreeRealloc
String ID: }}$HKCR$HKCU{Software{Classes
API String ID: 3917957913-1142484189
Opcode ID: 62e52356015a5d0dc33101422d7587e26c655e3b550c2a50da4106ee225c1683
Instruction ID: c83a6f32353f9fdeb038bf379027510baa99614e501fbb707f6d2e735ea148af
Opcode Fuzzy Hash: 62e52356015a5d0dc33101422d7587e26c655e3b550c2a50da4106ee225c1683
Instruction Fuzzy Hash: 0CA17C22F09A8295FB759FE598722BC27E06F44B94F144235CEDE87395FE3DA8498310

Function 00007FFD9DF9C904 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 98threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFD9DF9C932
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFD9DF9ACE8), ref: 00007FFD9DF9C9A1
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFD9DF9ACE8), ref: 00007FFD9DF9C9AD
GetShellWindow.USER32 ref: 00007FFD9DF9C9C0
GetWindowThreadProcessId.USER32 ref: 00007FFD9DF9C9DB
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFD9DF9ACE8), ref: 00007FFD9DF9C9FD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFD9DF9ACE8), ref: 00007FFD9DF9CA7D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFD9DF9ACE8), ref: 00007FFD9DF9CA86

Part of subcall function 00007FFD9DF9C5FC: GetLocalTime.KERNEL32 ref: 00007FFD9DF9C627
Part of subcall function 00007FFD9DF9C5FC: fwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9C67D

Strings

GetCurrentUserHandle: OpenProcessToken failed., xrefs: 00007FFD9DF9C94E
GetCurrentUserHandle: Can't get process token of desktop shell., xrefs: 00007FFD9DF9CA2D
GetCurrentUserHandle: Unable to get PID of desktop shell., xrefs: 00007FFD9DF9C9EA
GetCurrentUserHandle: No desktop shell is present., xrefs: 00007FFD9DF9C9CB
GetCurrentUserHandle: Can't get primary token., xrefs: 00007FFD9DF9CA68
SeIncreaseQuotaPrivilege, xrefs: 00007FFD9DF9C96C
GetCurrentUserHandle: AdjustTokenPrivileges failed., xrefs: 00007FFD9DF9C9B7
GetCurrentUserHandle: Can't open desktop shell process., xrefs: 00007FFD9DF9CA0B

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CloseHandleProcess$Window$CurrentErrorLastLocalOpenShellThreadTimefwprintf
String ID: GetCurrentUserHandle: AdjustTokenPrivileges failed.$GetCurrentUserHandle: Can't get primary token.$GetCurrentUserHandle: Can't get process token of desktop shell.$GetCurrentUserHandle: Can't open desktop shell process.$GetCurrentUserHandle: No desktop shell is present.$GetCurrentUserHandle: OpenProcessToken failed.$GetCurrentUserHandle: Unable to get PID of desktop shell.$SeIncreaseQuotaPrivilege
API String ID: 1976429503-1238159523
Opcode ID: e6e94d15d8b48a30eb5d9f8d2e548e25f834094bf9d12c1b81c2c6b0c1b91b4b
Instruction ID: 0bbdbb98226e84f0eb9a3ee0fad897f7d153ceafae6952971f4bb9cb6632fa09
Opcode Fuzzy Hash: e6e94d15d8b48a30eb5d9f8d2e548e25f834094bf9d12c1b81c2c6b0c1b91b4b
Instruction Fuzzy Hash: 76412E22F18A9289FB60DFF1E8663BD27B0BF48749F444235DA8E56655EF3CE5488700

Function 00007FFD9DF9B990 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32 ref: 00007FFD9DF9CD4E

Part of subcall function 00007FFD9DF9B8E4: GetSystemDirectoryA.KERNEL32 ref: 00007FFD9DF9B91E
Part of subcall function 00007FFD9DF9B8E4: wsprintfA.USER32 ref: 00007FFD9DF9B959
Part of subcall function 00007FFD9DF9B8E4: LoadLibraryA.KERNEL32 ref: 00007FFD9DF9B967

GetProcAddress.KERNEL32 ref: 00007FFD9DF9CC7D
GetProcAddress.KERNEL32 ref: 00007FFD9DF9CC90
GetProcAddress.KERNEL32 ref: 00007FFD9DF9CCA3
FreeLibrary.KERNEL32 ref: 00007FFD9DF9CCFE
FreeLibrary.KERNEL32 ref: 00007FFD9DF9CD07
FreeLibrary.KERNEL32 ref: 00007FFD9DF9CD14
FreeLibrary.KERNEL32 ref: 00007FFD9DF9CD1D

Strings

Wtsapi32.dll, xrefs: 00007FFD9DF9CC5B
Kernel32.dll, xrefs: 00007FFD9DF9CC3A
WTSQuerySessionInformationA, xrefs: 00007FFD9DF9CC83
WTSGetActiveConsoleSessionId, xrefs: 00007FFD9DF9CC76
WTSFreeMemory, xrefs: 00007FFD9DF9CC96

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Library$Free$AddressProc$DesktopDirectoryInputLoadOpenSystemwsprintf
String ID: Kernel32.dll$WTSFreeMemory$WTSGetActiveConsoleSessionId$WTSQuerySessionInformationA$Wtsapi32.dll
API String ID: 2940747028-3942689601
Opcode ID: b4028af8245e8be4252f8bf68f082aa3c1480abf7be00e6efa0992e81f2d260f
Instruction ID: 85ee6a20b6efeae5d970ae0a2da60bb8482fa19abdb109d9a7e3a7b4e8092472
Opcode Fuzzy Hash: b4028af8245e8be4252f8bf68f082aa3c1480abf7be00e6efa0992e81f2d260f
Instruction Fuzzy Hash: AA313221F0978295EF75AFE6A86317926A0AF84B94F480236DD8D42794FF3CE55AC700

Function 00007FFD9DF9BB00 Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 99registryCOMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9BB6C
RegOpenKeyExA.ADVAPI32(?,00007FFD9DF997B7), ref: 00007FFD9DF9BB92
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9BC17
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9BC4C
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9BC7F

Strings

SOFTWARE\JavaSoft\Java Runtime Environment, xrefs: 00007FFD9DF9BB50
JavaHome, xrefs: 00007FFD9DF9BBAF
bin\java.exe, xrefs: 00007FFD9DF9BBF6
%s\%s, xrefs: 00007FFD9DF9BC0B
%s\%s, xrefs: 00007FFD9DF9BC67
%s\%s, xrefs: 00007FFD9DF9BB5C
bin\server\jvm.dll, xrefs: 00007FFD9DF9BC6E
bin\client\jvm.dll, xrefs: 00007FFD9DF9BC2B
%s\%s, xrefs: 00007FFD9DF9BC40

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: swprintf$Open
String ID: %s\%s$%s\%s$%s\%s$%s\%s$JavaHome$SOFTWARE\JavaSoft\Java Runtime Environment$bin\client\jvm.dll$bin\java.exe$bin\server\jvm.dll
API String ID: 3060457134-1466848623
Opcode ID: 32314bf4e816f653e8fb876ec049608df7bfc1b5edf1fd377f7b83842963051e
Instruction ID: f041f83e2a7216a0ecd59aa01bf31fca266be9f55e313d7b6c58aa01e4e5deeb
Opcode Fuzzy Hash: 32314bf4e816f653e8fb876ec049608df7bfc1b5edf1fd377f7b83842963051e
Instruction Fuzzy Hash: 4F412E36B18AC296E730DFA1E8615EA3365FB88784F444236EA8D43758EF3CD649C740

Function 00007FFD9DF99BE4 Relevance: 21.2, APIs: 3, Strings: 11, Instructions: 213COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF99C82
MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF99CD7
MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF99D63

Strings

REDIRECT_CLSID, xrefs: 00007FFD9DF99C2E
', xrefs: 00007FFD9DF99C69
VERSION, xrefs: 00007FFD9DF99C99
11.361.2, xrefs: 00007FFD9DF99CCB
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}, xrefs: 00007FFD9DF99C62
: , xrefs: 00007FFD9DF99E69
RedirectDynamicClsidKey : , xrefs: 00007FFD9DF99DCD
: , xrefs: 00007FFD9DF99DAC
RedirectDynamicClsidKey : InHighIntegrityMode : , xrefs: 00007FFD9DF99E8A
{8AD9C840-044E-11D1-B3E9-00805F499D93}, xrefs: 00007FFD9DF99C54
SSV_DLL, xrefs: 00007FFD9DF99CEE

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: : $ : $'$11.361.2$REDIRECT_CLSID$RedirectDynamicClsidKey : $RedirectDynamicClsidKey : InHighIntegrityMode : $SSV_DLL$VERSION${8AD9C840-044E-11D1-B3E9-00805F499D93}${CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
API String ID: 626452242-3194389621
Opcode ID: 4373bdf4ca3389d860e4ce2a48be1ed56508f338310bb958032a450841d95de1
Instruction ID: 84528756a37dd1d10ee04b6b3f489456fd5c9ebd640616959809243046f58f2f
Opcode Fuzzy Hash: 4373bdf4ca3389d860e4ce2a48be1ed56508f338310bb958032a450841d95de1
Instruction Fuzzy Hash: 8E919E36B04AC29AEB20DFA0D9621E973A1FB40798F445331EA9D47AD9EF3CD558C300

Function 00007FFD9DF97310 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 121synchronizationCOMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF973AC
WaitForSingleObject.KERNEL32 ref: 00007FFD9DF974C5
CloseHandle.KERNEL32 ref: 00007FFD9DF974CF

Part of subcall function 00007FFD9DF9B3E4: GetModuleHandleA.KERNEL32(00000000,?,?,?,?,00000800,?,00007FFD9DF96DA4,00000000,?,00000104,?,?,00007FFD9DF9195C), ref: 00007FFD9DF9B473
Part of subcall function 00007FFD9DF9B3E4: GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,00000800,?,00007FFD9DF96DA4,00000000,?,00000104,?,?,00007FFD9DF9195C), ref: 00007FFD9DF9B48A
Part of subcall function 00007FFD9DF9B3E4: GetShortPathNameA.KERNEL32 ref: 00007FFD9DF9B4A2

Strings

-new, xrefs: 00007FFD9DF973CC
%s\bin\ssvagent.exe, xrefs: 00007FFD9DF97396
-settreatas, xrefs: 00007FFD9DF9741B
%s\ssvagent.exe, xrefs: 00007FFD9DF97374
-high, xrefs: 00007FFD9DF973FF
-regdeploy, xrefs: 00007FFD9DF97432
-old, xrefs: 00007FFD9DF973D3
runas, xrefs: 00007FFD9DF97471

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: HandleModuleName$CloseFileObjectPathShortSingleWaitswprintf
String ID: -high$ -new$ -old$ -regdeploy$ -settreatas$%s\bin\ssvagent.exe$%s\ssvagent.exe$runas
API String ID: 3610605512-595605224
Opcode ID: 0fd901b3bbd83cdb6d32e22c656e6a78c8e4f958314177c4ec2b6d034dde7c7d
Instruction ID: 048ce22e6e1b835304d93f161a6ef9732928d1dfd1c836061974e36e393fa8e8
Opcode Fuzzy Hash: 0fd901b3bbd83cdb6d32e22c656e6a78c8e4f958314177c4ec2b6d034dde7c7d
Instruction Fuzzy Hash: DA515F26B09BC289EB70DFA1D8623E967A0FB84784F540236DE8D53A95EF3CD645C740

Function 00007FFD9DF9AAA0 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 104libraryloaderCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00007FFD9DF9AAEC

Part of subcall function 00007FFD9DF9AA50: GetModuleHandleA.KERNEL32 ref: 00007FFD9DF9AA62
Part of subcall function 00007FFD9DF9AA50: GetProcAddress.KERNEL32 ref: 00007FFD9DF9AA72
Part of subcall function 00007FFD9DF9AA50: GetCurrentProcess.KERNEL32 ref: 00007FFD9DF9AA80

Part of subcall function 00007FFD9DF9A2D8: _com_util::ConvertStringToBSTR.COMSUPP ref: 00007FFD9DF9A31D

Part of subcall function 00007FFD9DF9A524: SysFreeString.OLEAUT32 ref: 00007FFD9DF9A553

GetModuleHandleA.KERNEL32 ref: 00007FFD9DF9AB4C
GetProcAddress.KERNEL32 ref: 00007FFD9DF9AB5C
GetModuleHandleA.KERNEL32 ref: 00007FFD9DF9AB6C
GetProcAddress.KERNEL32 ref: 00007FFD9DF9AB7C

Strings

Wow64RevertWow64FsRedirection, xrefs: 00007FFD9DF9AB75
\sysWow64\javaws.exe, xrefs: 00007FFD9DF9ABE0
kernel32, xrefs: 00007FFD9DF9AB45
kernel32, xrefs: 00007FFD9DF9AB62
\system32\javaws.exe, xrefs: 00007FFD9DF9AB1B
Wow64DisableWow64FsRedirection, xrefs: 00007FFD9DF9AB55

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$String$ConvertCurrentDirectoryFreeProcessWindows_com_util::
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$\sysWow64\javaws.exe$\system32\javaws.exe$kernel32$kernel32
API String ID: 2226367265-272254647
Opcode ID: e96b04ec342cf2b5a24c61d02313916e693cb6b088e58ef6b1724bb9701a59e6
Instruction ID: 6431d5814a591ca2c23f598a55a7e9b500c805fef23e556a6a076d6f16517115
Opcode Fuzzy Hash: e96b04ec342cf2b5a24c61d02313916e693cb6b088e58ef6b1724bb9701a59e6
Instruction Fuzzy Hash: C6413026F1CA8291EA30EFA5E4621B97360FF84784F844231D9CD575A9FF2CE549C710

Function 00007FFD9DF91130 Relevance: 15.1, APIs: 4, Strings: 6, Instructions: 84COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FFD9DF911AC
wsprintfA.USER32 ref: 00007FFD9DF911D9
wsprintfA.USER32 ref: 00007FFD9DF91221
wsprintfA.USER32 ref: 00007FFD9DF91263

Strings

%1d.%1d.%1d, xrefs: 00007FFD9DF911BC
%s*, xrefs: 00007FFD9DF91201
%s_%02d, xrefs: 00007FFD9DF9124C
1.3.0_02, xrefs: 00007FFD9DF9119B
%1d.%1d*, xrefs: 00007FFD9DF9120F
11.361.2, xrefs: 00007FFD9DF91172

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: wsprintf
String ID: %1d.%1d*$%1d.%1d.%1d$%s*$%s_%02d$1.3.0_02$11.361.2
API String ID: 2111968516-4005296808
Opcode ID: da3e9676f709ab059a29877ca355ad0edcf90fdbc51453e2757fedbd72463284
Instruction ID: 94aca54d2635ac5eec1c570863ce3e89cd73536eb678c6c0ec4861a3582e11ca
Opcode Fuzzy Hash: da3e9676f709ab059a29877ca355ad0edcf90fdbc51453e2757fedbd72463284
Instruction Fuzzy Hash: 9A41A661F1C6D6A1EF70AFE5E4624B86765FB10B88B844332C98D077A4EF2DE555C300

Function 00007FFD9DF9EFB4 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 118threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFD9DFA6888: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFA68BF

Part of subcall function 00007FFD9DF9EF0C: wcsftime.LIBCMT ref: 00007FFD9DF9EF4F
Part of subcall function 00007FFD9DF9EF0C: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9EF83

Part of subcall function 00007FFD9DFABFB8: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFABFE0

GetCurrentThreadId.KERNEL32 ref: 00007FFD9DF9F0DC
GetCurrentProcessId.KERNEL32 ref: 00007FFD9DF9F0E4
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9F11D
OutputDebugStringA.KERNEL32 ref: 00007FFD9DF9F169

Strings

Error:, xrefs: 00007FFD9DF9F0D1
P:%04d T:%04d %s%s, xrefs: 00007FFD9DF9F105
..., xrefs: 00007FFD9DF9F12A
[%08x], xrefs: 00007FFD9DF9F09F

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Current_invalid_parameter_noinfo_snwprintf_s$DebugOutputProcessStringThreadwcsftime
String ID: ...$Error:$P:%04d T:%04d %s%s$[%08x]
API String ID: 4121278308-3806032009
Opcode ID: b3efbf50475dc0ca35aeba42556d225cecfdaf2c4e115e0d9d8016c0ca1ea4b9
Instruction ID: 5fb0be3779cf5d6fc4d5a47fa49cbe30669cf9f4166314363e904129f7bfc902
Opcode Fuzzy Hash: b3efbf50475dc0ca35aeba42556d225cecfdaf2c4e115e0d9d8016c0ca1ea4b9
Instruction Fuzzy Hash: 0551F722B18AC596E730DFA5E8612EA7764FB85784F444231EA8E47699FF3CD605C700

Function 00007FFD9DF99A94 Relevance: 14.0, APIs: 2, Strings: 6, Instructions: 48stringCOMMON

Download Yara Rule

APIs

strchr.LIBVCRUNTIME ref: 00007FFD9DF99B1F
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF99B37

Strings

1.7.0, xrefs: 00007FFD9DF99ADA
1.6.0, xrefs: 00007FFD9DF99AE3
1.8.0, xrefs: 00007FFD9DF99AD1
1.5.0, xrefs: 00007FFD9DF99AEC
1.3.1, xrefs: 00007FFD9DF99AFE
1.4.2, xrefs: 00007FFD9DF99AF5

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: strchrswprintf
String ID: 1.3.1$1.4.2$1.5.0$1.6.0$1.7.0$1.8.0
API String ID: 1210014026-375587272
Opcode ID: 61625b077b594457907bcce8cfa725b7a9e90e980de26022399f6905fe7993bc
Instruction ID: e4652c4c833718206ade85c4bdef2c92d714f906ad0eb527539d44ebc7c58234
Opcode Fuzzy Hash: 61625b077b594457907bcce8cfa725b7a9e90e980de26022399f6905fe7993bc
Instruction Fuzzy Hash: D6111A62F1CA8290EA74EFA0E4720B962A0EB85340F861375D5CE427A9FF2CE604C700

Function 00007FFD9DFBD0DC Relevance: 13.8, APIs: 9, Instructions: 273fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9DFBCCC0: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBCD01
Part of subcall function 00007FFD9DFBCCC0: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBCD81
Part of subcall function 00007FFD9DFBCCC0: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBCDD5
Part of subcall function 00007FFD9DFBCCC0: _get_daylight.LIBCMT ref: 00007FFD9DFBCE2D

CreateFileW.KERNEL32 ref: 00007FFD9DFBD1E2
CreateFileW.KERNEL32 ref: 00007FFD9DFBD232
GetLastError.KERNEL32 ref: 00007FFD9DFBD262
GetFileType.KERNEL32 ref: 00007FFD9DFBD277
GetLastError.KERNEL32 ref: 00007FFD9DFBD281
CloseHandle.KERNEL32 ref: 00007FFD9DFBD2B4
CloseHandle.KERNEL32 ref: 00007FFD9DFBD40F
CreateFileW.KERNEL32 ref: 00007FFD9DFBD444
GetLastError.KERNEL32 ref: 00007FFD9DFBD453

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: da91ab5875a8e5f41171df20e2ba2be3d50c452c82ced639b775666c0d19a953
Instruction ID: c3c93238240a076eea71575b559d2f736568b274ad259cd0fd234e385e7cfa61
Opcode Fuzzy Hash: da91ab5875a8e5f41171df20e2ba2be3d50c452c82ced639b775666c0d19a953
Instruction Fuzzy Hash: E4C1A036B24A8186EB20DFA5C8A21AD3770F789B98B105329DFAE57794EF3CD155C310

Function 00007FFD9DF9B0A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFD9DF9B0BC
GetLastError.KERNEL32 ref: 00007FFD9DF9B104
GlobalAlloc.KERNEL32 ref: 00007FFD9DF9B115
GlobalFree.KERNEL32 ref: 00007FFD9DF9B186

Part of subcall function 00007FFD9DFADEF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFADF43

LocalFree.KERNEL32 ref: 00007FFD9DF9B17D
CloseHandle.KERNEL32 ref: 00007FFD9DF9B190

Strings

S-1-5-18, xrefs: 00007FFD9DF9B15C

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: FreeGlobal$AllocCloseCurrentErrorHandleLastLocalProcess_invalid_parameter_noinfo
String ID: S-1-5-18
API String ID: 2217911499-4289277601
Opcode ID: c829ddb936b256c840dc56f2b916bb401c6da8c0dd0c25d62129ed7a97935d9c
Instruction ID: 45cb9de86d5308d848cdc7b3e9cd5f21884db1a1b00fd2026ea60744c537809e
Opcode Fuzzy Hash: c829ddb936b256c840dc56f2b916bb401c6da8c0dd0c25d62129ed7a97935d9c
Instruction Fuzzy Hash: A8311432F146C29AE7709FA1E8666A933A0FF4978DF080235D98D47654EF3CE485C750

Function 00007FFD9DF9988C Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9DF99BE4: MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF99C82
Part of subcall function 00007FFD9DF99BE4: MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF99CD7
Part of subcall function 00007FFD9DF99BE4: MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF99D63

Part of subcall function 00007FFD9DF9A2D8: _com_util::ConvertStringToBSTR.COMSUPP ref: 00007FFD9DF9A31D

Part of subcall function 00007FFD9DF9B774: StringFromCLSID.OLE32 ref: 00007FFD9DF9B7E8
Part of subcall function 00007FFD9DF9B774: CoTaskMemFree.OLE32 ref: 00007FFD9DF9B807

Part of subcall function 00007FFD9DFA4484: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFA44C5

strstr.LIBVCRUNTIME ref: 00007FFD9DF999F9

Strings

UnregHKCUTreatAs :, xrefs: 00007FFD9DF99932
UpdateTreatAsKeyImpl :, xrefs: 00007FFD9DF999CD
jp2, xrefs: 00007FFD9DF999EF
RedirectDynamicAndTreatasKeys: bLegacy(false) : , xrefs: 00007FFD9DF9990C
RedirectDynamicAndTreatasKeys: bLegacy(true) : , xrefs: 00007FFD9DF998E1
RunBrokerProcess :, xrefs: 00007FFD9DF99A07
{8AD9C840-044E-11D1-B3E9-00805F499D93}, xrefs: 00007FFD9DF99980

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide$String$ConvertFreeFromTask_com_util::_invalid_parameter_noinfostrstr
String ID: RedirectDynamicAndTreatasKeys: bLegacy(false) : $RedirectDynamicAndTreatasKeys: bLegacy(true) : $RunBrokerProcess :$UnregHKCUTreatAs :$UpdateTreatAsKeyImpl :$jp2${8AD9C840-044E-11D1-B3E9-00805F499D93}
API String ID: 2302786040-2547355259
Opcode ID: a7c4b79a78cd6309a406e8ec7454cf7f526294e4723d885dc469ca973f3c2ff3
Instruction ID: 76b8c7d9a2305d0584cdcab09f9a99a6898f4ff7c923475caa87455ca11a8797
Opcode Fuzzy Hash: a7c4b79a78cd6309a406e8ec7454cf7f526294e4723d885dc469ca973f3c2ff3
Instruction Fuzzy Hash: E1518D51F0868351FB70AFA6A8633BA6291BF85784F451335EE8D4B6D6FE3DE5058300

Function 00007FFD9DFBFEA0 Relevance: 10.8, APIs: 7, Instructions: 291COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFC02D6

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a53ed83035f00e95007cc141f28e68cf8ca43ad3a5d6888f5ab7c229909a1036
Instruction ID: b020989856c9121001bd213258421f9267d6e9ab4ee24e8e90935789260217db
Opcode Fuzzy Hash: a53ed83035f00e95007cc141f28e68cf8ca43ad3a5d6888f5ab7c229909a1036
Instruction Fuzzy Hash: 14C1D323B087C691E671AFA595622BE6B60FB81B80F450331DACD07795EF7DE866C310

Function 00007FFD9DF9B584 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9DF93AD0: RegOpenKeyExA.ADVAPI32 ref: 00007FFD9DF93B22

GetShortPathNameA.KERNEL32 ref: 00007FFD9DF9B68B
GetLongPathNameA.KERNEL32 ref: 00007FFD9DF9B69C

Strings

JavaHome, xrefs: 00007FFD9DF9B669
SOFTWARE, xrefs: 00007FFD9DF9B5CA
JavaSoft, xrefs: 00007FFD9DF9B60B
Java Plug-in, xrefs: 00007FFD9DF9B62A

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: NamePath$LongOpenShort
String ID: Java Plug-in$JavaHome$JavaSoft$SOFTWARE
API String ID: 697873569-2643011632
Opcode ID: 8de2dd2af544eeef23ae2ee1ce5d57f4ac55a02f762a55fc54fc450ef9421fcb
Instruction ID: eb8cda1f5955ed81742e47d5da662752b87dfa55a2147e5c28ae5183657074a1
Opcode Fuzzy Hash: 8de2dd2af544eeef23ae2ee1ce5d57f4ac55a02f762a55fc54fc450ef9421fcb
Instruction Fuzzy Hash: F5410F32F04A9698FB60DFE1A8966AD36A4BB44B88F540275DE4DA7B44FF38E445C340

Function 00007FFD9DF996F4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 92registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FFD9DF99740
lstrcmpiA.KERNEL32 ref: 00007FFD9DF997A3
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF997E3

Strings

SOFTWARE\JavaSoft\Java Runtime Environment, xrefs: 00007FFD9DF99732
1.3.1, xrefs: 00007FFD9DF99797
., xrefs: 00007FFD9DF9977D

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Openlstrcmpiswprintf
String ID: .$1.3.1$SOFTWARE\JavaSoft\Java Runtime Environment
API String ID: 90554508-4254749399
Opcode ID: fee8fe5a8c5b91c043af0f75dfddfc78b27ba899f857913750c76daa784e1849
Instruction ID: 399376c8c0481e336043b35fd8082c2f22ad6f28bc997d8e49723cf006692576
Opcode Fuzzy Hash: fee8fe5a8c5b91c043af0f75dfddfc78b27ba899f857913750c76daa784e1849
Instruction Fuzzy Hash: F2417172B18AC686E7308F91E4A27AA6365FB85344F544339E6CD02A58EF3CD415CB10

Function 00007FFD9DF9B2E8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9DF9B2E8: CloseHandle.KERNEL32 ref: 00007FFD9DF9B222

_scwprintf.LIBCMT ref: 00007FFD9DF9B3CB
_com_raise_error.COMSUPP ref: 00007FFD9DF9B3D4

Part of subcall function 00007FFD9DF9A350: SysAllocString.OLEAUT32 ref: 00007FFD9DF9A395

Strings

Error:%08x in GetUserPathW(szPath), xrefs: 00007FFD9DF9B3C4
Error:%08x in SHGetFolderPathW(NULL, CSIDL_APPDATA, NULL, 0, pPath), xrefs: 00007FFD9DF9B2B2
Error:%08x in SHGetSpecialFolderPathW(NULL, pPath, CSIDL_APPDATA, TRUE), xrefs: 00007FFD9DF9B2CA
Error:%08x in SHGetFolderPathEx(FOLDERID_LocalAppDataLow, 0, hToken, pPath, MAX_PATH), xrefs: 00007FFD9DF9B29A

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AllocCloseHandleString_com_raise_error_scwprintf
String ID: Error:%08x in GetUserPathW(szPath)$Error:%08x in SHGetFolderPathEx(FOLDERID_LocalAppDataLow, 0, hToken, pPath, MAX_PATH)$Error:%08x in SHGetFolderPathW(NULL, CSIDL_APPDATA, NULL, 0, pPath)$Error:%08x in SHGetSpecialFolderPathW(NULL, pPath, CSIDL_APPDATA, TRUE)
API String ID: 1473104865-3996986905
Opcode ID: a8e8f4dfac669c0c2ac1caaf99ac525ac7ead6a54a2738dc189d2bc05b52d25e
Instruction ID: b1a9ee8ef8c975adbec729fbd447542cc4332548c48103f512f03cee223aa2d6
Opcode Fuzzy Hash: a8e8f4dfac669c0c2ac1caaf99ac525ac7ead6a54a2738dc189d2bc05b52d25e
Instruction Fuzzy Hash: 8121C822B09AC681E630DF96E8A256E6360FFC5B90F544331DEDD47795EE3CD8428300

Function 00007FFD9DF9127C Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 67COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FFD9DF912F8
wsprintfA.USER32 ref: 00007FFD9DF91322
wsprintfA.USER32 ref: 00007FFD9DF9136E

Strings

113612, xrefs: 00007FFD9DF912BE
%s_%02d, xrefs: 00007FFD9DF91357
%1d%1d%1d, xrefs: 00007FFD9DF91305
130_02, xrefs: 00007FFD9DF912E7

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: wsprintf
String ID: %1d%1d%1d$%s_%02d$113612$130_02
API String ID: 2111968516-2156791873
Opcode ID: 3617cbd6cf970955a92a83e4e6209b6aeda195db7be50e25f19c1fa2ef2c9bfe
Instruction ID: e185bcca6a90e0554d27954849b99ab41b519fafd8f3ab223885f78253a2d8b4
Opcode Fuzzy Hash: 3617cbd6cf970955a92a83e4e6209b6aeda195db7be50e25f19c1fa2ef2c9bfe
Instruction Fuzzy Hash: 6A319162F18AC691EF70AFA4E4624B87771EB50B88B844232C98D07774EF7DE599C700

Function 00007FFD9DFC0AA8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFD9DFC0AD9
GetLastError.KERNEL32 ref: 00007FFD9DFC0AE5
CloseHandle.KERNEL32 ref: 00007FFD9DFC0AFD
CreateFileW.KERNEL32 ref: 00007FFD9DFC0B28
WriteConsoleW.KERNEL32 ref: 00007FFD9DFC0B47

Strings

CONOUT$, xrefs: 00007FFD9DFC0B09

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3eb01d0e2b0435434029c9a77e3a8e282013e36cfd9ffca44087d8506af55cbc
Instruction ID: b6cbff30b58a633a8bdc465524a46084302bbadf2350f1bb986babb1ec297b1d
Opcode Fuzzy Hash: 3eb01d0e2b0435434029c9a77e3a8e282013e36cfd9ffca44087d8506af55cbc
Instruction Fuzzy Hash: EE11B922B18B8286E3609FD2E96632973A0FB88FE8F040334D99D87794EF3CD5548700

Function 00007FFD9DF9BFE8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32 ref: 00007FFD9DF9C020
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9C04A
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9C07B

Strings

%s\Sun\Java\Deployment\deployment.properties, xrefs: 00007FFD9DF9C040
%s\Sun\Java\Deployment\deployment.properties, xrefs: 00007FFD9DF9C071
USER_JPI_PROFILE, xrefs: 00007FFD9DF9C019

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: swprintf$EnvironmentVariable
String ID: %s\Sun\Java\Deployment\deployment.properties$%s\Sun\Java\Deployment\deployment.properties$USER_JPI_PROFILE
API String ID: 3931620965-1935347440
Opcode ID: 043f8c6b2e7a9821c5d04ddd62b2a4987ec9831c14e5369a65bd827613002068
Instruction ID: 3cd863288076443a8a8c10ec639c67560fdd8419ebe5aac9f56db48555cde3de
Opcode Fuzzy Hash: 043f8c6b2e7a9821c5d04ddd62b2a4987ec9831c14e5369a65bd827613002068
Instruction Fuzzy Hash: F7111261F086C641EA35EFA5F4723FA52A0AF88744F844331DACD86665EE3CD555C740

Function 00007FFD9DF9C3B8 Relevance: 8.9, APIs: 7, Instructions: 172stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,?,00000000,?,00007FFD9DF96CEA), ref: 00007FFD9DF9C416

Part of subcall function 00007FFD9DFABF58: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFABF7D

lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,?,00000000,?,00007FFD9DF96CEA), ref: 00007FFD9DF9C4B5
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000), ref: 00007FFD9DF9C50D
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000), ref: 00007FFD9DF9C519
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000), ref: 00007FFD9DF9C571
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000), ref: 00007FFD9DF9C57D
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000), ref: 00007FFD9DF9C589

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: lstrlen$_invalid_parameter_noinfo
String ID:
API String ID: 1432209211-0
Opcode ID: 811ab5e96930460deb0032f31359a025ac11f55678e2bad7e50002e09d833e80
Instruction ID: 276e6ecb99159f5bb4859630f8775228a98afcc68e6c52a75ff1d9abaca95208
Opcode Fuzzy Hash: 811ab5e96930460deb0032f31359a025ac11f55678e2bad7e50002e09d833e80
Instruction Fuzzy Hash: 01617E22F18AE299FB20EFF4D8661FC27A4AB44718F550635CE8E97699FE3C9545C300

Function 00007FFD9DF9B3E4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,?,?,?,00000800,?,00007FFD9DF96DA4,00000000,?,00000104,?,?,00007FFD9DF9195C), ref: 00007FFD9DF9B473
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,00000800,?,00007FFD9DF96DA4,00000000,?,00000104,?,?,00007FFD9DF9195C), ref: 00007FFD9DF9B48A
GetShortPathNameA.KERNEL32 ref: 00007FFD9DF9B4A2
GetLongPathNameA.KERNEL32 ref: 00007FFD9DF9B4CF

Strings

/, xrefs: 00007FFD9DF9B538

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Name$ModulePath$FileHandleLongShort
String ID: /
API String ID: 1612199381-2043925204
Opcode ID: 9aa6524e85ef2779147517f97add29c122336ca2f9200db814c39198408c9b53
Instruction ID: f03bfa1266a6fb16f9bd175bd09e8dd76fa0eed9c9928cd17df3ec9cde3f3ebe
Opcode Fuzzy Hash: 9aa6524e85ef2779147517f97add29c122336ca2f9200db814c39198408c9b53
Instruction Fuzzy Hash: 3641E222F08AC245E6309FA6A8667F96790BF857D8F440731EE8D06B89FE3CD205C700

Function 00007FFD9DF93948 Relevance: 8.9, APIs: 7, Instructions: 119COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF9398A
CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF939AC
CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF939C3
CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF939D9
CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF939E8
CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF93A41
CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF93A60

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 624dc7b04fca85f2beb19e05af5aed21a62d1b16892ccd58cc829dfa82eb3577
Instruction ID: 6f1cced34628a5cdcf7de81d2496e46f68a316c12b00a49026700924739a37b2
Opcode Fuzzy Hash: 624dc7b04fca85f2beb19e05af5aed21a62d1b16892ccd58cc829dfa82eb3577
Instruction Fuzzy Hash: 9041AF2AF19AD685EB715FE2942637837E19B59FC4F488130CBCE4B745EF2C946A8300

Function 00007FFD9DF9AC9C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9DF9B0A0: GetCurrentProcess.KERNEL32 ref: 00007FFD9DF9B0BC
Part of subcall function 00007FFD9DF9B0A0: GetLastError.KERNEL32 ref: 00007FFD9DF9B104
Part of subcall function 00007FFD9DF9B0A0: GlobalAlloc.KERNEL32 ref: 00007FFD9DF9B115
Part of subcall function 00007FFD9DF9B0A0: LocalFree.KERNEL32 ref: 00007FFD9DF9B17D
Part of subcall function 00007FFD9DF9B0A0: GlobalFree.KERNEL32 ref: 00007FFD9DF9B186
Part of subcall function 00007FFD9DF9B0A0: CloseHandle.KERNEL32 ref: 00007FFD9DF9B190

CloseHandle.KERNEL32 ref: 00007FFD9DF9AD29

Part of subcall function 00007FFD9DF9C904: GetCurrentProcess.KERNEL32 ref: 00007FFD9DF9C932

Strings

%s\Oracle\Java\java.settings.cfg, xrefs: 00007FFD9DF9B045
Error:%08x in SHGetFolderPathEx(FOLDERID_LocalAppDataLow, 0, hToken, szPath, MAX_PATH), xrefs: 00007FFD9DF9ADBB

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CloseCurrentFreeGlobalHandleProcess$AllocErrorLastLocal
String ID: %s\Oracle\Java\java.settings.cfg$Error:%08x in SHGetFolderPathEx(FOLDERID_LocalAppDataLow, 0, hToken, szPath, MAX_PATH)
API String ID: 3391735524-2415518075
Opcode ID: 1825dd289b13ec640a1ff01a933e1e46307a8a097cec32a4f395d284747f808e
Instruction ID: 9095542b40121a1915b86454d70ac7c5bd5842398f545a2193cbe3ee356d951b
Opcode Fuzzy Hash: 1825dd289b13ec640a1ff01a933e1e46307a8a097cec32a4f395d284747f808e
Instruction Fuzzy Hash: 9531D526F09AC642EA709FA695622B97290FF84BE0F444332DEDD57799FE3CE4058340

Function 00007FFD9DF9D15C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68memorywindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FFD9DF9D19E
LocalAlloc.KERNEL32 ref: 00007FFD9DF9D1E5
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9D234

Strings

IDispatch error #%d, xrefs: 00007FFD9DF9D224
Unknown error 0x%0lX, xrefs: 00007FFD9DF9D22D

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AllocFormatLocalMessageswprintf
String ID: IDispatch error #%d$Unknown error 0x%0lX
API String ID: 2125616379-2934499512
Opcode ID: 79334511777262f11a8f86ae1c88c95f18a68b0f15c8b542c025bdbfb4c39472
Instruction ID: 3b4c41257dd19c491b2fe953280bad2ed776077b33aca3168aa52e453937b079
Opcode Fuzzy Hash: 79334511777262f11a8f86ae1c88c95f18a68b0f15c8b542c025bdbfb4c39472
Instruction Fuzzy Hash: D8218122F08BD185EB208FA5A42667C77A0AB45F94F644236CA9D43794DE3CD8468340

Function 00007FFD9DF941FC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000380,00007FFD9DF93B0D), ref: 00007FFD9DF94229
GetProcAddress.KERNEL32 ref: 00007FFD9DF9423E
RegOpenKeyExA.ADVAPI32(00000380,00007FFD9DF93B0D), ref: 00007FFD9DF94291

Strings

RegOpenKeyTransactedA, xrefs: 00007FFD9DF94234
Advapi32.dll, xrefs: 00007FFD9DF94222

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedA
API String ID: 1337834000-496252237
Opcode ID: 186bdd89a22db3c4ae1eed4f863b1769ca4a9d32116883050e78feaf6581c552
Instruction ID: 25171e18c8093a9c1a86260c76288e3bf6dfe60878a5a8ce4a21f484f24700eb
Opcode Fuzzy Hash: 186bdd89a22db3c4ae1eed4f863b1769ca4a9d32116883050e78feaf6581c552
Instruction Fuzzy Hash: 12113332B18B81C2EA208F96F45532963A0FB94BD4F184635EE8D47B68DF3CD455CB04

Function 00007FFD9DF9EF0C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFD9DFAE8C0: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFAE8F8

wcsftime.LIBCMT ref: 00007FFD9DF9EF4F
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9EF83

Strings

.%03d, xrefs: 00007FFD9DF9EF74
Error:%08x in SHGetFolderPathEx(FOLDERID_LocalAppDataLow, 0, hToken, szPath, MAX_PATH), xrefs: 00007FFD9DF9EF11
%b %d %H:%M:%S, xrefs: 00007FFD9DF9EF42

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_snwprintf_swcsftime
String ID: %b %d %H:%M:%S$.%03d$Error:%08x in SHGetFolderPathEx(FOLDERID_LocalAppDataLow, 0, hToken, szPath, MAX_PATH)
API String ID: 2458067793-971585045
Opcode ID: db03abb7b968ab3b626578f3a57982f5a7a29107f62aa36b36d6a6d931984b16
Instruction ID: ed1c7b544d3c64f610368f6f2fc7e42780dd6ec2191f911dd0dc86961b878719
Opcode Fuzzy Hash: db03abb7b968ab3b626578f3a57982f5a7a29107f62aa36b36d6a6d931984b16
Instruction Fuzzy Hash: 46015221B195C186EB20DF95E5221B96361EF84B94F944332EAED4A6D9FF3CD104C700

Function 00007FFD9DF94170 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,?,{8AD9C840-044E-11D1-B3E9-00805F499D93},00007FFD9DF93664), ref: 00007FFD9DF94195
GetProcAddress.KERNEL32(?,?,?,?,{8AD9C840-044E-11D1-B3E9-00805F499D93},00007FFD9DF93664), ref: 00007FFD9DF941AA

Strings

Advapi32.dll, xrefs: 00007FFD9DF9418E
{8AD9C840-044E-11D1-B3E9-00805F499D93}, xrefs: 00007FFD9DF9417A
RegDeleteKeyTransactedA, xrefs: 00007FFD9DF941A0

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyTransactedA${8AD9C840-044E-11D1-B3E9-00805F499D93}
API String ID: 1646373207-4167736386
Opcode ID: 7b09678b98334af524696f1cc1755e34ec2d0de2d906bc4f6fdd5f6a9ee53361
Instruction ID: b2f497643c8752af72129f00822a18234b48ad094439b7b20650aeaaef3b0dcd
Opcode Fuzzy Hash: 7b09678b98334af524696f1cc1755e34ec2d0de2d906bc4f6fdd5f6a9ee53361
Instruction Fuzzy Hash: 5A018429F0968191FA318F91E82677A6260BF65BC4F184235DD8D07B54EF3CD595C704

Function 00007FFD9DFAEE24 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFD9DFAEE40
GetProcAddress.KERNEL32 ref: 00007FFD9DFAEE56
FreeLibrary.KERNEL32 ref: 00007FFD9DFAEE73

Strings

mscoree.dll, xrefs: 00007FFD9DFAEE37
CorExitProcess, xrefs: 00007FFD9DFAEE4F

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d23c88e63288b16794083f3f5423ce9dde2bb3c03fb35aa56154aac9be0c08ef
Instruction ID: da818e3a96b0a249be8f5b96c02b1f35614f1c40a325c8935a042166164a359f
Opcode Fuzzy Hash: d23c88e63288b16794083f3f5423ce9dde2bb3c03fb35aa56154aac9be0c08ef
Instruction Fuzzy Hash: 22F05E62B196C291EF645FE1E4A637423A0AF84B84F04123AD98F46664FF3CD89CC310

Function 00007FFD9DF9AA50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFD9DF9AA62
GetProcAddress.KERNEL32 ref: 00007FFD9DF9AA72
GetCurrentProcess.KERNEL32 ref: 00007FFD9DF9AA80

Strings

IsWow64Process, xrefs: 00007FFD9DF9AA6B
kernel32, xrefs: 00007FFD9DF9AA5B

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32
API String ID: 4190356694-3789238822
Opcode ID: 98566bff98159421655fd32f30394f7f09c370aec43595054736029174951612
Instruction ID: 862d73945f28121d640601b56bef7f34b33ef8d903c72da65b608b6c0ddc494d
Opcode Fuzzy Hash: 98566bff98159421655fd32f30394f7f09c370aec43595054736029174951612
Instruction Fuzzy Hash: 69E09265F3968293EA21AFA0E8621B433A0FF48785F441234D98E42310FF2CE46CCB00

Function 00007FFD9DFBDF30 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBDF71
GetConsoleMode.KERNEL32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00007FFD9DFBDEEF,00000000,00000000,?,00007FFD9DFBB7F6), ref: 00007FFD9DFBE030
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00007FFD9DFBDEEF,00000000,00000000,?,00007FFD9DFBB7F6), ref: 00007FFD9DFBE0B0

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: a90e44e88c4d9a674644eaa7b7cda9a14742cf59cc6bdbbc35a628357995ea9b
Instruction ID: a261efd4216b5f6b10c7ff5dc43b827409c0ddb6d050df13fa0488e1da3ef5ed
Opcode Fuzzy Hash: a90e44e88c4d9a674644eaa7b7cda9a14742cf59cc6bdbbc35a628357995ea9b
Instruction Fuzzy Hash: ED81C126F1869299F7B09FE598622BD2660BF44B84F544335DF8E53A91FF3CA441C321

Function 00007FFD9DF9A1C8 Relevance: 7.6, APIs: 5, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00007FFD9DF9A205
SysStringLen.OLEAUT32 ref: 00007FFD9DF9A221
SysAllocStringByteLen.OLEAUT32 ref: 00007FFD9DF9A250
memcpy_s.LIBCPMT ref: 00007FFD9DF9A284
memcpy_s.LIBCPMT ref: 00007FFD9DF9A2AB

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: String$memcpy_s$AllocByte
String ID:
API String ID: 915214016-0
Opcode ID: 9ff872592a5d6084319ac2249c89e249ae891a58e5682e4f480fb74bc431ec06
Instruction ID: 9dddf98649169447b4bee60c016708394308df9bd454308bc5c68c74b5bd6a19
Opcode Fuzzy Hash: 9ff872592a5d6084319ac2249c89e249ae891a58e5682e4f480fb74bc431ec06
Instruction Fuzzy Hash: 4131CD36F09B8686EA29CFD1A0612B873A1EF84FC4F044639DE8D17385EE3EE5448300

Function 00007FFD9DF9C748 Relevance: 7.6, APIs: 5, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFD9DF9C759
GetLastError.KERNEL32 ref: 00007FFD9DF9C79C
LocalAlloc.KERNEL32 ref: 00007FFD9DF9C7AD
LocalFree.KERNEL32 ref: 00007FFD9DF9C807
CloseHandle.KERNEL32 ref: 00007FFD9DF9C812

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Local$AllocCloseCurrentErrorFreeHandleLastProcess
String ID:
API String ID: 1388692885-0
Opcode ID: 5890fafe9f32a84c74863663f39093a5c98218e9f4203c58471230aae2e0a07b
Instruction ID: fb30c6eec22f95927e87d2c92773cd7bcb59a77cd6c7342f4826880f07c664df
Opcode Fuzzy Hash: 5890fafe9f32a84c74863663f39093a5c98218e9f4203c58471230aae2e0a07b
Instruction Fuzzy Hash: 81218332B08A8286EB209FA1E56216A73B0FB85BC5F544235DACD43758EF3CD459CB50

Function 00007FFD9DFC0710 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFD9DFC0738
_set_statfp.LIBCMT ref: 00007FFD9DFC0753
_set_statfp.LIBCMT ref: 00007FFD9DFC076F
_set_statfp.LIBCMT ref: 00007FFD9DFC07AB

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: d1d10107198c09c3932fa6673c1dcca8ef673135442fdb47985b5f68ba886dfb
Instruction ID: 5c3f096512299c8c8709acd2d3c78d9d3fd48a9e511689acaa851d70ff5f42aa
Opcode Fuzzy Hash: d1d10107198c09c3932fa6673c1dcca8ef673135442fdb47985b5f68ba886dfb
Instruction Fuzzy Hash: F6112B67F18A8306F67C39B8F7773751140AF55370F440734EAEE166D6EE2CA8A28A44

Function 00007FFD9DF9CB80 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9DF9CAB0: GetProcAddress.KERNEL32 ref: 00007FFD9DF9CADB
Part of subcall function 00007FFD9DF9CAB0: FreeLibrary.KERNEL32 ref: 00007FFD9DF9CAF2

CloseHandle.KERNEL32 ref: 00007FFD9DF9CC10

Part of subcall function 00007FFD9DF9C5FC: GetLocalTime.KERNEL32 ref: 00007FFD9DF9C627
Part of subcall function 00007FFD9DF9C5FC: fwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9C67D

CloseHandle.KERNEL32 ref: 00007FFD9DF9CC03

Strings

GetCurrentUserHandle2: WTSGetActiveConsoleSessionId failed., xrefs: 00007FFD9DF9CB9A
GetCurrentUserHandle2: DuplicateTokenEx failed., xrefs: 00007FFD9DF9CBF2
GetCurrentUserHandle2: WTSQueryUserToken failed., xrefs: 00007FFD9DF9CBBA

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CloseHandle$AddressFreeLibraryLocalProcTimefwprintf
String ID: GetCurrentUserHandle2: DuplicateTokenEx failed.$GetCurrentUserHandle2: WTSGetActiveConsoleSessionId failed.$GetCurrentUserHandle2: WTSQueryUserToken failed.
API String ID: 3781070853-2600433152
Opcode ID: 977596058c97fc05b118fe11b939c105fb22c08ee82c49408a96df8b70e11eee
Instruction ID: ea6bfb91fe473c340c201d32b0c796fc755a166deee415128903a2bca1c81afc
Opcode Fuzzy Hash: 977596058c97fc05b118fe11b939c105fb22c08ee82c49408a96df8b70e11eee
Instruction Fuzzy Hash: 7C113062F1C9C282E6709FA5E8623792670EB84384F500231D6CD426E5FF2DE914CB00

Function 00007FFD9DF910A0 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FFD9DF9111D

Strings

{CAFEEFAC-, xrefs: 00007FFD9DF9110B
%s00%1d%1d-%04d-%04d%s, xrefs: 00007FFD9DF91116
-ABCDEFFEDCBA}, xrefs: 00007FFD9DF910ED
3B3DB}, xrefs: 00007FFD9DF910CE

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: wsprintf
String ID: %s00%1d%1d-%04d-%04d%s$-ABCDEFFEDCBA}$3B3DB}${CAFEEFAC-
API String ID: 2111968516-2327481162
Opcode ID: 43a113160358d4ee5a31511d94a34a1d8de73e17938e40cb5bf61d742b316eaf
Instruction ID: 350adcb543556c06c639babf5ddd7e2a9aba12006165a89538689830a7738b9a
Opcode Fuzzy Hash: 43a113160358d4ee5a31511d94a34a1d8de73e17938e40cb5bf61d742b316eaf
Instruction Fuzzy Hash: 6D010065E1C7C186D7719FA8E8525B967E0FB68748F545331DDCC02731EB2DE1A68B00

Function 00007FFD9DFB4F9C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 211COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFB5242

Part of subcall function 00007FFD9DFBC2E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBC301

Strings

UTF-8, xrefs: 00007FFD9DFB51C5
ccs, xrefs: 00007FFD9DFB518E
UTF-16LEUNICODE, xrefs: 00007FFD9DFB51E6

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7acd79f09f8a341cfffe7764835a28e8390265891b5eb0768f2cdec07252b9ce
Instruction ID: d8a69d48a4e5e0ee8e4baa48897f1064f120ec307f58678e622added97217fb0
Opcode Fuzzy Hash: 7acd79f09f8a341cfffe7764835a28e8390265891b5eb0768f2cdec07252b9ce
Instruction Fuzzy Hash: 0C81C331F0D2C3A5F7758EE886722382BA09F25748F596331CBCD47795FA2DA8018761

Function 00007FFD9DF9B774 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

StringFromCLSID.OLE32 ref: 00007FFD9DF9B7E8

Part of subcall function 00007FFD9DF9A350: SysAllocString.OLEAUT32 ref: 00007FFD9DF9A395

CoTaskMemFree.OLE32 ref: 00007FFD9DF9B807

Strings

CLSID, xrefs: 00007FFD9DF9B78D
TreatAs, xrefs: 00007FFD9DF9B84D

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: String$AllocFreeFromTask
String ID: CLSID$TreatAs
API String ID: 1419840921-2001043205
Opcode ID: f563eb98bab78795757106f00883932dc741e48089aad12a8c3329e0a29cdd41
Instruction ID: fe3a2c2856d616781ab72e798385bbc4402c6c4915877b4927ad532e862ca802
Opcode Fuzzy Hash: f563eb98bab78795757106f00883932dc741e48089aad12a8c3329e0a29cdd41
Instruction Fuzzy Hash: 73410D22F14A9289F720DFE1D8A23BD27B0EB44798F044235DA4D56599EF28D549C340

Function 00007FFD9DF91CAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF91D09
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF91DBC

Strings

CLSID\%s\InProcServer32, xrefs: 00007FFD9DF91CEA
{DBC80044-A445-435b-BC74-9C25C1C588A9}, xrefs: 00007FFD9DF91CDE

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: swprintf
String ID: CLSID\%s\InProcServer32${DBC80044-A445-435b-BC74-9C25C1C588A9}
API String ID: 233258989-156410976
Opcode ID: 8f3d1ca228126cd71c3ba05d7230bb16f4512881606843d72c7709cb079b6b12
Instruction ID: 057a3b45a7f4cfd54bffa060eeb9be44d2ab3ee6d4460803f1136225bfef5f4e
Opcode Fuzzy Hash: 8f3d1ca228126cd71c3ba05d7230bb16f4512881606843d72c7709cb079b6b12
Instruction Fuzzy Hash: FB316022F18AC286E770DF95E4617BAA790FF88794F440632EACD46694EF7CD449CB40

Function 00007FFD9DF91E08 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF91E61
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF91F19

Strings

SOFTWARE\JavaSoft\Java Plug-in\%s, xrefs: 00007FFD9DF91E5A
JavaHome, xrefs: 00007FFD9DF91EA2

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: swprintf
String ID: JavaHome$SOFTWARE\JavaSoft\Java Plug-in\%s
API String ID: 233258989-2273268771
Opcode ID: 6565cf4e95469a8e50235f543ccf0fdbf5b177c3100a4c34dfaa0ff1a486cfd3
Instruction ID: 3dea1f6409ba2c6e18a99752f6edc33e6da6196a3ea0b2b6d984824525aae975
Opcode Fuzzy Hash: 6565cf4e95469a8e50235f543ccf0fdbf5b177c3100a4c34dfaa0ff1a486cfd3
Instruction Fuzzy Hash: FA318422F1CAC586E7709F95E4517AAA390FB84798F440631EECD47654EF7CE449CB40

Function 00007FFD9DF9403C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFD9DF9406D
GetProcAddress.KERNEL32 ref: 00007FFD9DF94086

Strings

RegCreateKeyTransactedA, xrefs: 00007FFD9DF9407C
Advapi32.dll, xrefs: 00007FFD9DF94066

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedA
API String ID: 1646373207-1184998024
Opcode ID: 023152c6bbba542695f3a81aa1c98f50176ac0a14ad094d9203144d3c9950427
Instruction ID: a106260b1112a9be59cc934cbe03bf04aca24bc279a6cf167a7712c13c4bb890
Opcode Fuzzy Hash: 023152c6bbba542695f3a81aa1c98f50176ac0a14ad094d9203144d3c9950427
Instruction Fuzzy Hash: C431E536A08B8086DA70CF56F4507AAB3A4FB98B84F144135EA9D43B68DF3DD485CB00

Function 00007FFD9DF93640 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFD9DF93676
GetProcAddress.KERNEL32 ref: 00007FFD9DF9368B

Part of subcall function 00007FFD9DF94170: GetModuleHandleA.KERNEL32(?,?,?,?,{8AD9C840-044E-11D1-B3E9-00805F499D93},00007FFD9DF93664), ref: 00007FFD9DF94195
Part of subcall function 00007FFD9DF94170: GetProcAddress.KERNEL32(?,?,?,?,{8AD9C840-044E-11D1-B3E9-00805F499D93},00007FFD9DF93664), ref: 00007FFD9DF941AA

Strings

Advapi32.dll, xrefs: 00007FFD9DF9366F
RegDeleteKeyExA, xrefs: 00007FFD9DF93681

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyExA
API String ID: 1646373207-1984814126
Opcode ID: c00687004fe57c26ff95247b460d3874ed84a843c0ace60b888fa94cbb2b459c
Instruction ID: e6b30696fc234392519249458ad84ec7d8598ea7f65c3bb96ff284de5a5a0648
Opcode Fuzzy Hash: c00687004fe57c26ff95247b460d3874ed84a843c0ace60b888fa94cbb2b459c
Instruction Fuzzy Hash: DF118222F0DAC285FE709FE1E56293823A0AF48BD4F184235CD8D073A4FE2CE4988310

Function 00007FFD9DF9B8E4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FFD9DF9B91E
wsprintfA.USER32 ref: 00007FFD9DF9B959
LoadLibraryA.KERNEL32 ref: 00007FFD9DF9B967

Strings

%s\%s, xrefs: 00007FFD9DF9B94A

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s\%s
API String ID: 2200240437-4073750446
Opcode ID: 57b8cd5ddd38695a10fe9e38ae9a0ed5f3dc9859d241bb1851465aaf929ba012
Instruction ID: dae9f356c8bf53ab399a09c9cdb4c3c8711456ba25fb05175b187af1455bb599
Opcode Fuzzy Hash: 57b8cd5ddd38695a10fe9e38ae9a0ed5f3dc9859d241bb1851465aaf929ba012
Instruction Fuzzy Hash: DB015666B1C8C282EB30AFA0E8A63E96360FBC8745F444131C6CD42654FE3CD249C740

Function 00007FFD9DF9CB0C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9DF9B8E4: GetSystemDirectoryA.KERNEL32 ref: 00007FFD9DF9B91E
Part of subcall function 00007FFD9DF9B8E4: wsprintfA.USER32 ref: 00007FFD9DF9B959
Part of subcall function 00007FFD9DF9B8E4: LoadLibraryA.KERNEL32 ref: 00007FFD9DF9B967

GetProcAddress.KERNEL32 ref: 00007FFD9DF9CB45
FreeLibrary.KERNEL32 ref: 00007FFD9DF9CB5C

Strings

Wtsapi32.dll, xrefs: 00007FFD9DF9CB25
WTSQueryUserToken, xrefs: 00007FFD9DF9CB3B

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystemwsprintf
String ID: WTSQueryUserToken$Wtsapi32.dll
API String ID: 995386493-1085369751
Opcode ID: 56a124faba1d867944e62daa3371bb503b69030070880ed75652db35c4ac5c5a
Instruction ID: ec3e674febfac476130ddd73a2fc79315ef8c5f8005a80fee24609cd2c1170c2
Opcode Fuzzy Hash: 56a124faba1d867944e62daa3371bb503b69030070880ed75652db35c4ac5c5a
Instruction Fuzzy Hash: 4CF06221F097C181EA54EFA6B49612972A0BF4CBC0F488139EE8D4774AEE7CD455C700

Function 00007FFD9DF9C874 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

_scwprintf.LIBCMT ref: 00007FFD9DF9C89B
_com_raise_error.COMSUPP ref: 00007FFD9DF9C8AB

Part of subcall function 00007FFD9DFA0D40: _com_error::_com_error.COMSUPP ref: 00007FFD9DFA0D51
Part of subcall function 00007FFD9DFA0D40: _CxxThrowException.LIBVCRUNTIME ref: 00007FFD9DFA0D62

Strings

Load failed in %s at function order:%d, xrefs: 00007FFD9DF9C889
Load failed in %s at function %s, xrefs: 00007FFD9DF9C87E

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ExceptionThrow_com_error::_com_error_com_raise_error_scwprintf
String ID: Load failed in %s at function %s$Load failed in %s at function order:%d
API String ID: 1067671652-2536070861
Opcode ID: 15d2235f0d4388ba737710eca5f4d43e1f0d71b1b4d7abf47fbe8d9587c11aa0
Instruction ID: af66d81f092a734b6e951bed65fae129373be36e3cd7b83b5109a552fd197fa8
Opcode Fuzzy Hash: 15d2235f0d4388ba737710eca5f4d43e1f0d71b1b4d7abf47fbe8d9587c11aa0
Instruction Fuzzy Hash: 93E04FA5B0454696EB28AF61D8623A433A1FB48B45F808136DA4D43395EE2DD4D5C340

Function 00007FFD9DF9CAB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9DF9B8E4: GetSystemDirectoryA.KERNEL32 ref: 00007FFD9DF9B91E
Part of subcall function 00007FFD9DF9B8E4: wsprintfA.USER32 ref: 00007FFD9DF9B959
Part of subcall function 00007FFD9DF9B8E4: LoadLibraryA.KERNEL32 ref: 00007FFD9DF9B967

GetProcAddress.KERNEL32 ref: 00007FFD9DF9CADB
FreeLibrary.KERNEL32 ref: 00007FFD9DF9CAF2

Strings

kernel32.dll, xrefs: 00007FFD9DF9CABA
WTSGetActiveConsoleSessionId, xrefs: 00007FFD9DF9CAD1

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystemwsprintf
String ID: WTSGetActiveConsoleSessionId$kernel32.dll
API String ID: 995386493-2743965321
Opcode ID: a94e747d7c81912a55954bd98011f6884c53ad4c528de9e630d6b9588a24fab2
Instruction ID: 6a2c3c277b5aec92ee8fc87c587413514cc96c4e3062b06a7a8b41053f7b47d5
Opcode Fuzzy Hash: a94e747d7c81912a55954bd98011f6884c53ad4c528de9e630d6b9588a24fab2
Instruction Fuzzy Hash: 64F01C21F09AC291EA65EFE5A86737422A1AF89790F584234D9AD463D1FE3CE499C300

Function 00007FFD9DF97928 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF97953
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF97977

Strings

%1d.%1d.%1d_%02d, xrefs: 00007FFD9DF97943
%1d.%1d.%1d, xrefs: 00007FFD9DF97967

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: swprintf
String ID: %1d.%1d.%1d$%1d.%1d.%1d_%02d
API String ID: 233258989-2687705156
Opcode ID: d38f45a04dd781e00efa26e9f721769a5302702e3773c97d2796854e050219bd
Instruction ID: f25e5be418ea40ccaa6b374e9c422379fdabd6c523aeba920ffe934c2eefe37b
Opcode Fuzzy Hash: d38f45a04dd781e00efa26e9f721769a5302702e3773c97d2796854e050219bd
Instruction Fuzzy Hash: 51F01DB5E1878186E7309F59A46245A6AA0FB883C4F501226EACC43B29DA3CD1518F04

Function 00007FFD9DF9BCCC Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 14COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9BD0C

Strings

%s%03d%1d-%04d-%04d%s, xrefs: 00007FFD9DF9BCED
{CAFEEFAC-, xrefs: 00007FFD9DF9BCE1
-ABCDEFFEDCBA}, xrefs: 00007FFD9DF9BCD0

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: swprintf
String ID: %s%03d%1d-%04d-%04d%s$-ABCDEFFEDCBA}${CAFEEFAC-
API String ID: 233258989-27275655
Opcode ID: e8d484ce73426202e45c0597ace0f08fcce4f8f8aeff4baaa71076ee6234996f
Instruction ID: bce6ba78453c7a9c32cf9f37852a11b80edb0aef45b045a6c1b470fbc825d8a6
Opcode Fuzzy Hash: e8d484ce73426202e45c0597ace0f08fcce4f8f8aeff4baaa71076ee6234996f
Instruction Fuzzy Hash: DBE0EDB6A18BC096D760EF51E4521997760F798790F804226E6CC42B14EF3CD164CF00

Function 00007FFD9DF9BD1C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 14COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9BD5C

Strings

{CAFEEFAC-, xrefs: 00007FFD9DF9BD31
%s%03d%1d-%04d-%04d%s, xrefs: 00007FFD9DF9BD3D
-ABCDEFFEDCBB}, xrefs: 00007FFD9DF9BD20

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: swprintf
String ID: %s%03d%1d-%04d-%04d%s$-ABCDEFFEDCBB}${CAFEEFAC-
API String ID: 233258989-3161087305
Opcode ID: 59ec8b4a3f07a456298b38d44a096d68384cea9729b9f8436393625257be525c
Instruction ID: b06a24a8e0ede4be0085728e5f6cb1d89e4bc912e0dd12e2dbea4d74b15e8af6
Opcode Fuzzy Hash: 59ec8b4a3f07a456298b38d44a096d68384cea9729b9f8436393625257be525c
Instruction Fuzzy Hash: F4E0EDB6A18BC09AD760EF55E45119A7760F788740F804226E6CD42B24EF3CD129CB00

Function 00007FFD9DF9BD6C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 14COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9BDAC

Strings

{CAFEEFAC-, xrefs: 00007FFD9DF9BD81
-ABCDEFFEDCBC}, xrefs: 00007FFD9DF9BD70
%s%03d%1d-%04d-%04d%s, xrefs: 00007FFD9DF9BD8D

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: swprintf
String ID: %s%03d%1d-%04d-%04d%s$-ABCDEFFEDCBC}${CAFEEFAC-
API String ID: 233258989-1643939020
Opcode ID: afcf1ac8efc390682bdf3cec92356d572c26cb90679838ce1602c9ecee2069ad
Instruction ID: afa765391c8ca85ec76edc1953f29027e99a140529d0e505e2b94bf673b4bbcc
Opcode Fuzzy Hash: afcf1ac8efc390682bdf3cec92356d572c26cb90679838ce1602c9ecee2069ad
Instruction Fuzzy Hash: 4DE0ED76A18BC0D6E760EF51E8511997760F788354F804226E6CC42B14EF3CD168CB00

Function 00007FFD9DF9BDBC Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 14COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9BDF2

Strings

%s%03d%1d-%04d-FFFF%s, xrefs: 00007FFD9DF9BDDB
-ABCDEFFEDCBA}, xrefs: 00007FFD9DF9BDC3
{CAFEEFAC-, xrefs: 00007FFD9DF9BDCF

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: swprintf
String ID: %s%03d%1d-%04d-FFFF%s$-ABCDEFFEDCBA}${CAFEEFAC-
API String ID: 233258989-2785631815
Opcode ID: fa400c424c15a379298bde027df645991f69e04f7dfb4b70fce87bde1aafe805
Instruction ID: 55fabbd00d6db5645969e1ba1ab97ebf23e33d3d4eeab5a6a6f3c72f83eab414
Opcode Fuzzy Hash: fa400c424c15a379298bde027df645991f69e04f7dfb4b70fce87bde1aafe805
Instruction Fuzzy Hash: E2E04FB6E18781DAD620EF95B4514997760F788780F901226FA8C03724DB3CD125CF00

Function 00007FFD9DFB3E7C Relevance: 6.2, APIs: 4, Instructions: 160COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FFD9DFB3F69
_get_daylight.LIBCMT ref: 00007FFD9DFB3F7A
_get_daylight.LIBCMT ref: 00007FFD9DFB3F8B
_isindst.LIBCMT ref: 00007FFD9DFB4051

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 8c21197ebf451818a87a6a1671b6c72751e7e127eecfbdf7a5003b133139db20
Instruction ID: 365ec4868d4396aef00765d24e83b7cd3452a202eda19ad1c4698c94efb90a19
Opcode Fuzzy Hash: 8c21197ebf451818a87a6a1671b6c72751e7e127eecfbdf7a5003b133139db20
Instruction Fuzzy Hash: 6951F972F046928AFB38DFA4D9621BC27A1AB5039CF540235DF9E57AD5EB3CA405C710

Function 00007FFD9DFBCCC0 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBCD01
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBCD81
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBCDD5
_get_daylight.LIBCMT ref: 00007FFD9DFBCE2D

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 36dd68caac5819a584dcc5a427269c16acca659e73494d6607d3d5c6ccf9d879
Instruction ID: d6b9947a4bcc2386563aa391adb878e45637d26a3a88835373233fc8280397eb
Opcode Fuzzy Hash: 36dd68caac5819a584dcc5a427269c16acca659e73494d6607d3d5c6ccf9d879
Instruction Fuzzy Hash: F651D33AF0828282F7794EB9D43337B6940AB84714F194235DB9D472C6FA3DE88096A1

Function 00007FFD9DFACE64 Relevance: 6.1, APIs: 4, Instructions: 117pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FFD9DFACE97
GetFileInformationByHandle.KERNEL32 ref: 00007FFD9DFACEF4
GetLastError.KERNEL32 ref: 00007FFD9DFACF85
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000030,00000000,?,00007FFD9DFACD88), ref: 00007FFD9DFACFD1

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: f30ade0f03a50c132336b7afa159b893474cd0cc8ed60f042931a914df3f30cf
Instruction ID: dd62486a425fe8c3ed0d2435f60bdaacbbc11674f2e903aedd35e644a25bfd11
Opcode Fuzzy Hash: f30ade0f03a50c132336b7afa159b893474cd0cc8ed60f042931a914df3f30cf
Instruction Fuzzy Hash: 0D416D26B086818AFB24DFF1D4623BD27A5BB84B88F148635DE8D47689FF3CE4458750

Function 00007FFD9DF93318 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eea5e4ca9216b5edd6e5ac518cf1f1c46e715fe4631d5665a4416031606acd5
Instruction ID: a22cfb827117b5712778eec4ecb53e3cb7b58c61c7ad4b864ff741e31b885a9b
Opcode Fuzzy Hash: 7eea5e4ca9216b5edd6e5ac518cf1f1c46e715fe4631d5665a4416031606acd5
Instruction Fuzzy Hash: 9F413B32F49A8286EB618FDAD46223973E0AB54B84F544135DE8D47764EF3CE8998700

Function 00007FFD9DFA0910 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FFD9DFA098D
WideCharToMultiByte.KERNEL32 ref: 00007FFD9DFA09C9
GetLastError.KERNEL32 ref: 00007FFD9DFA09E6
GetLastError.KERNEL32 ref: 00007FFD9DFA0A08

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: c4213deb9bac3d3e14c7945674157e44c7cd54f6cc30e246dd36a8769fcdec33
Instruction ID: 536fdfac08072822df55c279ecc8bbcb77aad7f58434c745007601e77ff76371
Opcode Fuzzy Hash: c4213deb9bac3d3e14c7945674157e44c7cd54f6cc30e246dd36a8769fcdec33
Instruction Fuzzy Hash: 24316F32B087C682F7209FB5B52216A62D5BB84BA4F144734EAED57BE8EF3CD4118704

Function 00007FFD9DF9B9FC Relevance: 6.1, APIs: 4, Instructions: 66synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFD9DF9BA54
WaitForSingleObject.KERNEL32 ref: 00007FFD9DF9BAC0
CloseHandle.KERNEL32 ref: 00007FFD9DF9BACA
CloseHandle.KERNEL32 ref: 00007FFD9DF9BAD4

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CloseHandle$CurrentObjectProcessSingleWait
String ID:
API String ID: 497090408-0
Opcode ID: ada19465033a2224f591ce07138d733c438f472f490b515efa72db5a63188629
Instruction ID: 3c12895ea6a4266b871a29251a1ebe84e991ab8f4cab91de673ac9e98d6ef63d
Opcode Fuzzy Hash: ada19465033a2224f591ce07138d733c438f472f490b515efa72db5a63188629
Instruction Fuzzy Hash: 2F215033B14A828AE760DFA1E4516AE37B5F788B84F144235DE8D63B18EF38C515C740

Function 00007FFD9DF96FC8 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFD9DF97030

Strings

{8AD9C840-044E-11D1-B3E9-00805F499D93}, xrefs: 00007FFD9DF97018
REDIRECT_CLSID, xrefs: 00007FFD9DF96FED
', xrefs: 00007FFD9DF97010

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: '$REDIRECT_CLSID${8AD9C840-044E-11D1-B3E9-00805F499D93}
API String ID: 626452242-1822448160
Opcode ID: 19f02504811ec89557b2472d260cf67dd80cc59258ed5d678d55459eac6594d8
Instruction ID: 4b4123c804ec7a81f3ddd4ed2cc40b24d407a095c6b429a36be226d4d9839ae2
Opcode Fuzzy Hash: 19f02504811ec89557b2472d260cf67dd80cc59258ed5d678d55459eac6594d8
Instruction Fuzzy Hash: E0218C32B14BC1CAD720DFB1E8514A933A5FB48B88B588236EA8D43B58EF38D564C700

Function 00007FFD9DFB2214 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFB2257

Strings

gfff, xrefs: 00007FFD9DFB2379
e+000, xrefs: 00007FFD9DFB22FC

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 62df85511d8a5826e995e3b3d61e9029787f8bc09b4e30e67f465780871fa05e
Instruction ID: 4b5d6fa82c112f0793dd562ea71b7989e524b0e87e0cb5e3be1741b7811e326b
Opcode Fuzzy Hash: 62df85511d8a5826e995e3b3d61e9029787f8bc09b4e30e67f465780871fa05e
Instruction Fuzzy Hash: 0D510662B187C546EB358F69A8523696B91E791B90F4C9331CBDC8BAD6EE2CD080C710

Function 00007FFD9DFBDCD4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFD9DFBDDEB
GetLastError.KERNEL32 ref: 00007FFD9DFBDE0D

Strings

U, xrefs: 00007FFD9DFBDD97

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6c7a1ad708f8f0c9c0f72e2b0a71fcdc561ff3141648a4997859de182e7a9bf6
Instruction ID: 6fee5c5ec95761dcd450441c46d6be9179adbb6ed1562f651bfbd41453573464
Opcode Fuzzy Hash: 6c7a1ad708f8f0c9c0f72e2b0a71fcdc561ff3141648a4997859de182e7a9bf6
Instruction Fuzzy Hash: C641B462B18A8181EB30DFA5E8563A967A0FB98784F444231EF8E87B58EF3CD441C750

Function 00007FFD9DF942B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9DF93B5C: CoTaskMemAlloc.OLE32(?,00000000,FFFFFFFF,00000000,?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93BCD
Part of subcall function 00007FFD9DF93B5C: CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93C33
Part of subcall function 00007FFD9DF93B5C: CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93C3F
Part of subcall function 00007FFD9DF93B5C: CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93C4B
Part of subcall function 00007FFD9DF93B5C: CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93C57
Part of subcall function 00007FFD9DF93B5C: CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93D1C
Part of subcall function 00007FFD9DF93B5C: CharNextA.USER32(?,00000000,?,00007FFD9DF942F5), ref: 00007FFD9DF93D31

CoTaskMemFree.OLE32 ref: 00007FFD9DF943E8

Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF9398A
Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF939AC
Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF93A41

Part of subcall function 00007FFD9DF93848: lstrcmpiA.KERNEL32(00000000,00000000,?,00007FFD9DF94695), ref: 00007FFD9DF93871

Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF939C3
Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF939D9
Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF939E8
Part of subcall function 00007FFD9DF93948: CharNextA.USER32(?,00000000,00000000,?), ref: 00007FFD9DF93A60

CharNextA.USER32 ref: 00007FFD9DF943CD

Strings

{, xrefs: 00007FFD9DF94355

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CharNext$Task$AllocFreelstrcmpi
String ID: {
API String ID: 2690960928-366298937
Opcode ID: 8846d8366f11d7459cd9f6c29452fdd4c6590479ef6695464cedd4ce4a50f1a2
Instruction ID: 7f6629892286ba2ed62799d5fcac250c0aea1099896f35d9c587b82e47b301ab
Opcode Fuzzy Hash: 8846d8366f11d7459cd9f6c29452fdd4c6590479ef6695464cedd4ce4a50f1a2
Instruction Fuzzy Hash: D531CE62F0DAC656F7319FF1A4A27BA2690AB557C4F004231EBCD47A86EF6DE4848704

Function 00007FFD9DF9ADD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_scwprintf.LIBCMT ref: 00007FFD9DF9AECC
_com_raise_error.COMSUPP ref: 00007FFD9DF9AED5

Part of subcall function 00007FFD9DF9A350: SysAllocString.OLEAUT32 ref: 00007FFD9DF9A395

Strings

Error:%08x in SHGetFolderPathW(NULL, CSIDL_APPDATA, NULL, 0, szPath), xrefs: 00007FFD9DF9AEC5

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: AllocString_com_raise_error_scwprintf
String ID: Error:%08x in SHGetFolderPathW(NULL, CSIDL_APPDATA, NULL, 0, szPath)
API String ID: 827919080-3870703697
Opcode ID: c318dec832c13c245b0f30f5acf8950f7143c980dbfce15afb694e555154468b
Instruction ID: 07ade9cc1fc0a51e8f1c44fc4901b1f0050f73b42ef0adf47b9be475aff4b8bd
Opcode Fuzzy Hash: c318dec832c13c245b0f30f5acf8950f7143c980dbfce15afb694e555154468b
Instruction Fuzzy Hash: 0721E736B19A8282E6309FA2E4A266A7360FFC4B90F855735DEDD57795EE3CD4018300

Function 00007FFD9DF9D028 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32 ref: 00007FFD9DF9D09B

Strings

JAVA_REGDEPLOY_DEBUG, xrefs: 00007FFD9DF9D056
JavaDeployReg.log, xrefs: 00007FFD9DF9D0BE

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: PathTemp
String ID: JAVA_REGDEPLOY_DEBUG$JavaDeployReg.log
API String ID: 2920410445-1067332915
Opcode ID: 4fba09d3f440f6a11246e6a6a15baab63b124866e92b420a574cd3da4e446252
Instruction ID: a18888398fa59933ed0ce016e32aa8493604351fcec4eed1c850e2059099268b
Opcode Fuzzy Hash: 4fba09d3f440f6a11246e6a6a15baab63b124866e92b420a574cd3da4e446252
Instruction Fuzzy Hash: 3C316422B08AC6A1FA30DFA1D8621A96361FF84794F544332DADD476A9FF3CE945C700

Function 00007FFD9DFB32CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FFD9DFB330C
GetCurrentDirectoryW.KERNEL32 ref: 00007FFD9DFB335E

Strings

:, xrefs: 00007FFD9DFB3322

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 42e73cfdbfa0298fd4cc1753c7508bff74325fbfcb5c536e4a4ac357275d2463
Instruction ID: 847779c80992a5056d51648f9a362a694efe61eea5fa13bd8dc3a67c5a9f15c0
Opcode Fuzzy Hash: 42e73cfdbfa0298fd4cc1753c7508bff74325fbfcb5c536e4a4ac357275d2463
Instruction Fuzzy Hash: 07219362B086C1C1EB309F95D46626E63F1FB84B84F494236D7CD43294EF7CE9898760

Function 00007FFD9DF9C2B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9C300
RegOpenKeyExA.ADVAPI32 ref: 00007FFD9DF9C329

Strings

SOFTWARE\Classes\CLSID\%s\InprocServer32, xrefs: 00007FFD9DF9C2EF

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Openswprintf
String ID: SOFTWARE\Classes\CLSID\%s\InprocServer32
API String ID: 212519323-450560693
Opcode ID: 5f020b7fbc2b99227d1ce3b9669fb4bfd149fcd2b6b8b9e68f63a1b8bdbd50de
Instruction ID: 8b2b76b3374edeb6af2c616df9ff1554b1068263e46c8514089727988906a243
Opcode Fuzzy Hash: 5f020b7fbc2b99227d1ce3b9669fb4bfd149fcd2b6b8b9e68f63a1b8bdbd50de
Instruction Fuzzy Hash: 71215862B18AC282EB309FA5E8627AA6350FF84784F444231EBCD47695FE3CD545C750

Function 00007FFD9DF9AEE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

_scwprintf.LIBCMT ref: 00007FFD9DF9AFD8
_com_raise_error.COMSUPP ref: 00007FFD9DF9AFE1

Strings

Error:%08x in ::SHGetFolderPathW(0, CSIDL_COMMON_APPDATA, NULL, SHGFP_TYPE_CURRENT, szPath), xrefs: 00007FFD9DF9AFD1

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _com_raise_error_scwprintf
String ID: Error:%08x in ::SHGetFolderPathW(0, CSIDL_COMMON_APPDATA, NULL, SHGFP_TYPE_CURRENT, szPath)
API String ID: 1921093638-1521067552
Opcode ID: 971415fc0a825820d3c65d972ec4c838904a484dc7f7173a9d697224bdd5ae40
Instruction ID: 8b80b7d928cc32b03b7849d46f6f6aa51ec49301f017c617f936d57f8a8a6878
Opcode Fuzzy Hash: 971415fc0a825820d3c65d972ec4c838904a484dc7f7173a9d697224bdd5ae40
Instruction Fuzzy Hash: B511C432718B8186E7309FA5E8A236A76A1FB88790F504331EADC477A8EF3CD105C740

Function 00007FFD9DFB0E7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FFD9DFB0EB5
LCMapStringW.KERNEL32 ref: 00007FFD9DFB0F3D

Strings

LCMapStringEx, xrefs: 00007FFD9DFB0E98, 00007FFD9DFB0EA9

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: c4e603b82d67889a1c70983848a757e921d61e62c337ac2e4d87a4e5915a8ef1
Instruction ID: 13a4aded7c40e53ba734d7e90e3afcb64bae968a938b135a865ef08489b0a5c9
Opcode Fuzzy Hash: c4e603b82d67889a1c70983848a757e921d61e62c337ac2e4d87a4e5915a8ef1
Instruction Fuzzy Hash: 2A111832708BC586D6648F96B4512AAB7A4FB89B80F544236EFCD43B59EF3CD5548B00

Function 00007FFD9DFB0A64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FFD9DFB0A9D
CompareStringW.KERNEL32 ref: 00007FFD9DFB0B25

Strings

CompareStringEx, xrefs: 00007FFD9DFB0A80, 00007FFD9DFB0A91

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CompareStringtry_get_function
String ID: CompareStringEx
API String ID: 3328479835-2590796910
Opcode ID: f0774f51d29aba7234412c419dc47bd46f743be26cdcc1ebd54c0ba50f04e7f2
Instruction ID: a783acc1d5ffac3c34a0ed8cc6686f8296ab0529ff5719543c368f04d6519cce
Opcode Fuzzy Hash: f0774f51d29aba7234412c419dc47bd46f743be26cdcc1ebd54c0ba50f04e7f2
Instruction Fuzzy Hash: 80112932708BC186D7708F96B4912AAB7A5FB89B80F544236EBCD83B59DF3CD5548B40

Function 00007FFD9DFB0C6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FFD9DFB0CA5
GetDateFormatW.KERNEL32(?,?,?,?,?,?,00007FFD9DF9F1BC,00007FFD9DFB77FD,?,?,?,?,?,?,?,00000000), ref: 00007FFD9DFB0D07

Strings

GetDateFormatEx, xrefs: 00007FFD9DFB0C88, 00007FFD9DFB0C99

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: DateFormattry_get_function
String ID: GetDateFormatEx
API String ID: 595753042-159735388
Opcode ID: 31733b05f3cc27761168b133dab4df2ca6c59c5df8e43366d707602e91f94079
Instruction ID: c36e3292beb2ce5e7448a7100197b86d6196d53363effc011b827357ca6339c8
Opcode Fuzzy Hash: 31733b05f3cc27761168b133dab4df2ca6c59c5df8e43366d707602e91f94079
Instruction Fuzzy Hash: A7111C32B08BC186D6248F96B4511AAB7A0FB89BC0F184236EFCD53B69DF3CD5548B40

Function 00007FFD9DFB0D6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FFD9DFB0DA5
GetTimeFormatW.KERNEL32(?,?,?,?,?,?,00007FFD9DF9F1BC,00007FFD9DFB78AE,?,?,?,?,?,?,?,00000000), ref: 00007FFD9DFB0DFC

Strings

GetTimeFormatEx, xrefs: 00007FFD9DFB0D88, 00007FFD9DFB0D99

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: FormatTimetry_get_function
String ID: GetTimeFormatEx
API String ID: 3261793192-1692793031
Opcode ID: d36a8f6a1dcaa146301469bf1d677b8ff11f7097ecd1c12f5fbc57de4acc65f8
Instruction ID: a47c6c0ee26549dc4e4eb53b03c9be1834bfa96a866eb2a2179c7f5e2ea03118
Opcode Fuzzy Hash: d36a8f6a1dcaa146301469bf1d677b8ff11f7097ecd1c12f5fbc57de4acc65f8
Instruction Fuzzy Hash: 8F114F32B08BC586E620DF96E41105AB7A0FB89BD0F184235EF8D53B69EF3CD5548B40

Function 00007FFD9DF9C5FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FFD9DF9C627
fwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FFD9DF9C67D

Strings

[%04u/%02u/%02u %02u:%02u:%02u.%03u] %s , xrefs: 00007FFD9DF9C66C

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: LocalTimefwprintf
String ID: [%04u/%02u/%02u %02u:%02u:%02u.%03u] %s
API String ID: 441805291-1649626469
Opcode ID: 55b3485242530323326d218c82dc0e7f797b73b2db1abb504ae5102256f2a25d
Instruction ID: 2d8788b3367375552f4ad8be3f2d2e579f855d0afed71d454e66ffbb219b5f4d
Opcode Fuzzy Hash: 55b3485242530323326d218c82dc0e7f797b73b2db1abb504ae5102256f2a25d
Instruction Fuzzy Hash: 41016D72A1C68186E7609F91B46203AF7A1FBC4791F140135FECD42A59EB7CD464CF10

Function 00007FFD9DFBC020 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD9DFBC050

Strings

:, xrefs: 00007FFD9DFBC068

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: :
API String ID: 3215553584-336475711
Opcode ID: e50a3a46b8bf8e066275f0c88eba6bcc0385a513aefb00468e840bc58e03b9a9
Instruction ID: 6f876e552d8568b75cb100d3dab2f9baad68828db0bc6e7e756c96ba1729b8bf
Opcode Fuzzy Hash: e50a3a46b8bf8e066275f0c88eba6bcc0385a513aefb00468e840bc58e03b9a9
Instruction Fuzzy Hash: 41018451A1828286E730AFF0A46317E63A0EF44744F840635D6CD83651FF3CD5048A24

Function 00007FFD9DFB0E18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FFD9DFB0E49
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000264C8DFBB98,00007FFD9DFB4F66,?,?,00000000,00007FFD9DFB4E5E,?,?,00000080,00007FFD9DFAE155), ref: 00007FFD9DFB0E63

Strings

InitializeCriticalSectionEx, xrefs: 00007FFD9DFB0E3D

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 7746fca0a66031e3dce0424f66ff0540fc0fa2c5e32d1bb82115370f96844a14
Instruction ID: c03492499418f3aea01723d22e02613dabf7959f04befd997f266cba404d37ce
Opcode Fuzzy Hash: 7746fca0a66031e3dce0424f66ff0540fc0fa2c5e32d1bb82115370f96844a14
Instruction Fuzzy Hash: 91F05E22F08AC191EB259FD2F5620A96361AF48BD0F484635EA8D03B58EF3CE599C750

Function 00007FFD9DF9C0B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32 ref: 00007FFD9DF9C0D8
GetWindowsDirectoryA.KERNEL32 ref: 00007FFD9DF9C0E7

Strings

USERPROFILE, xrefs: 00007FFD9DF9C0D1

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: DirectoryEnvironmentVariableWindows
String ID: USERPROFILE
API String ID: 3766865897-2419442777
Opcode ID: 3a6384c7b4ec03b78a38154110911184891072dc5d9a1f54a570a79498bfa020
Instruction ID: 0e62122c9910b22cb33847dc290e81782d7360c07d8df9950e487230017dc1cc
Opcode Fuzzy Hash: 3a6384c7b4ec03b78a38154110911184891072dc5d9a1f54a570a79498bfa020
Instruction Fuzzy Hash: 64F0EC20F186C141EB249FD7F45113552A0FF48BC0F448230DD9D83B24EE2CD8558700

Function 00007FFD9DFA3C7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FFD9DFA3CA5
TlsSetValue.KERNEL32(?,?,00000000,00007FFD9DFA2296,?,?,?,00007FFD9DFA205D,?,?,?,?,00007FFD9DF9F5F1), ref: 00007FFD9DFA3CBC

Strings

FlsSetValue, xrefs: 00007FFD9DFA3C89, 00007FFD9DFA3C92

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: a276f214a0d924f29beb7849d2e30e28c3e8559952a3ad7a94402a39f3daaa69
Instruction ID: 853e96e9c705490a525c395f206e7f2fc3134800e3821497a8232f99ab578fd5
Opcode Fuzzy Hash: a276f214a0d924f29beb7849d2e30e28c3e8559952a3ad7a94402a39f3daaa69
Instruction Fuzzy Hash: 76E06561B085C291EA255FD0F8220F823A1AF887C0F484335D58D06354FF3CD5598300

Function 00007FFD9DFB0C18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FFD9DFB0C41
TlsSetValue.KERNEL32(?,?,00006AC2EEAEFA12,00007FFD9DFB0606,?,?,00006AC2EEAEFA12,00007FFD9DFA41E9,?,?,?,?,00007FFD9DFB07BA,?,?,00000000), ref: 00007FFD9DFB0C58

Strings

FlsSetValue, xrefs: 00007FFD9DFB0C2E

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 52002a168d54e3afed8a5a8737d9f2f17b010ce75570c03359c1c3d1b34905de
Instruction ID: b8549d91fe4a779ad51643361613bb3dad9374aa8333dbd9bad215209485f408
Opcode Fuzzy Hash: 52002a168d54e3afed8a5a8737d9f2f17b010ce75570c03359c1c3d1b34905de
Instruction Fuzzy Hash: 51E06562B085C291EA245FD1E5230B52362AF487C0F484332D69D06694EF7DD99CC250

Function 00007FFD9DFA0674 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFD9DFA067D
_CxxThrowException.LIBVCRUNTIME ref: 00007FFD9DFA068E

Part of subcall function 00007FFD9DFA1640: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFD9DFA0693), ref: 00007FFD9DFA16B5
Part of subcall function 00007FFD9DFA1640: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFD9DFA0693), ref: 00007FFD9DFA16E7

Strings

Unknown exception, xrefs: 00007FFD9DFA0699

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 3561508498-410509341
Opcode ID: c385aaac0d19a417f3f757970ff93bdeace32e856440c56d563e64ac06e0d506
Instruction ID: 659f2f096898085166599d825005d586fae1c9d6a84e465f6693f39c1e974696
Opcode Fuzzy Hash: c385aaac0d19a417f3f757970ff93bdeace32e856440c56d563e64ac06e0d506
Instruction Fuzzy Hash: 17D06722B28AC695DE20DF84D9A63E96330FB94348F944631E18D825B9FF3CD65AC740

Function 00007FFD9DF962A8 Relevance: 5.0, APIs: 4, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,00000000,00000000,?), ref: 00007FFD9DF962C4
lstrcmpiA.KERNEL32(?,00000000,00000000,?), ref: 00007FFD9DF962E7
lstrcmpiA.KERNEL32(?,00000000,00000000,?), ref: 00007FFD9DF96302
lstrcmpiA.KERNEL32(?,00000000,00000000,?), ref: 00007FFD9DF9631D

Memory Dump Source

Source File: 00000008.00000002.2499626950.00007FFD9DF91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD9DF90000, based on PE: true

Associated: 00000008.00000002.2499613655.00007FFD9DF90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499663761.00007FFD9DFC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499683431.00007FFD9DFE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2499695324.00007FFD9DFE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9df90000_rundll32.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: bd99baac100512fb61f305d0827342b58b7878181c82864482793c89fb3d0cc7
Instruction ID: 553ff6c404b98bf81efc9517a76925bc34185ab948abb1e7e647af25c66fc2de
Opcode Fuzzy Hash: bd99baac100512fb61f305d0827342b58b7878181c82864482793c89fb3d0cc7
Instruction Fuzzy Hash: 1C111222F0CAC681FB309FA5E5623796291AF54BC4F949231D98D87754FF6CE4588301

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fil_4bdbc898aa41e69a58d6ca0b49de377bd76f77_d75f6fa5_76820721-d08e-48f8-b510-448c0ca67010\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER36CC.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER395E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER39CC.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Windows Analysis Report
file.dll

Function 00007FFD9DF91520 Relevance: 52.9, APIs: 10, Strings: 20, Instructions: 420
synchronizationCOMMON

Function 00007FFD9DF91F64 Relevance: 33.5, APIs: 5, Strings: 14, Instructions: 268
threadCOMMON

Function 00007FFD9DF9D740 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 158
registryCOMMON

Function 00007FFD9DF9FE94 Relevance: 15.2, APIs: 10, Instructions: 235
COMMON

Function 00007FFD9DF9F6CC Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Function 00007FFD9DF9D9F0 Relevance: 1.6, APIs: 1, Instructions: 52
registryCOMMON

Function 00007FFD9DFB39F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00007FFD9DF9F282 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Function 00007FFD9DF9F265 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Function 00007FFD9DF9F271 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Function 00007FFD9DF9F27D Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Function 00007FFD9DF9F295 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Function 00007FFD9DF9F2A1 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Function 00007FFD9DF9F1D4 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Function 00007FFD9DF9F259 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON