Edit tour

Windows Analysis Report
fxc.exe

Overview

General Information

Sample name:	fxc.exe
Analysis ID:	1541091
MD5:	0b1904602a90ed190066095f29a3f92a
SHA1:	f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31
SHA256:	6e349195bdc65a1964367317ba14b905440d75398c3fbb1911c3400082d7f149
Tags:	exeMDeployeruser-smica83
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

One or more processes crash

PE file contains sections with non-standard names

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

fxc.exe (PID: 7312 cmdline: "C:\Users\user\Desktop\fxc.exe" MD5: 0B1904602A90ED190066095F29A3F92A)

WerFault.exe (PID: 7388 cmdline: C:\Windows\system32\WerFault.exe -u -p 7312 -s 232 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: fxc.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: fxc.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.0% probability

Source: C:\Users\user\Desktop\fxc.exe

Code function: 0_2_00007FF7BC212410 BCryptGenRandom,GetCurrentProcessId,BCryptGenRandom,HeapFree,CreateNamedPipeW,GetLastError,BCryptGenRandom,BCryptGenRandom,HeapFree,HeapFree,HeapFree,HeapFree,CloseHandle,HeapFree,BCryptGenRandom,HeapFree,

0_2_00007FF7BC212410

Source: fxc.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC2085E0 GetFileInformationByHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,FindFirstFileW,FindClose,HeapFree,		0_2_00007FF7BC2085E0
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC21EF88 FindFirstFileExW,		0_2_00007FF7BC21EF88

Source: Amcache.hve.3.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC1F1D30 HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,CloseHandle,CloseHandle,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,CloseHandle,		0_2_00007FF7BC1F1D30
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC200230 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,		0_2_00007FF7BC200230

Source: C:\Users\user\Desktop\fxc.exe	File created: C:\Windows\Debug\fail.txt			Jump to behavior
Source: C:\Users\user\Desktop\fxc.exe	File created: C:\Windows\Debug\stop.exe			Jump to behavior

Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC1F1D30	0_2_00007FF7BC1F1D30
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC1F12D0	0_2_00007FF7BC1F12D0
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC201B10	0_2_00007FF7BC201B10
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC209420	0_2_00007FF7BC209420
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC203D40	0_2_00007FF7BC203D40
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC1F7520	0_2_00007FF7BC1F7520
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC1FD590	0_2_00007FF7BC1FD590
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC1F8590	0_2_00007FF7BC1F8590
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC1F6D90	0_2_00007FF7BC1F6D90
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC226558	0_2_00007FF7BC226558
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC21D5F4	0_2_00007FF7BC21D5F4
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC211E40	0_2_00007FF7BC211E40
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC2046C0	0_2_00007FF7BC2046C0
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC21EF88	0_2_00007FF7BC21EF88
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC200790	0_2_00007FF7BC200790
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC2097A0	0_2_00007FF7BC2097A0
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC202FE0	0_2_00007FF7BC202FE0
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC215870	0_2_00007FF7BC215870
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC211207	0_2_00007FF7BC211207
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC1FB1F0	0_2_00007FF7BC1FB1F0
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC210A20	0_2_00007FF7BC210A20
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC1F2B10	0_2_00007FF7BC1F2B10
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC1F4350	0_2_00007FF7BC1F4350
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC210BD0	0_2_00007FF7BC210BD0
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC203400	0_2_00007FF7BC203400
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC212410	0_2_00007FF7BC212410
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC2233FC	0_2_00007FF7BC2233FC
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC20EC90	0_2_00007FF7BC20EC90
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC206C60	0_2_00007FF7BC206C60

Source: C:\Users\user\Desktop\fxc.exe

Code function: String function: 00007FF7BC1F48E0 appears 81 times

Source: C:\Users\user\Desktop\fxc.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7312 -s 232

Source: classification engine

Classification label: mal60.winEXE@3/7@0/0

Source: C:\Users\user\Desktop\fxc.exe

Code function: 0_2_00007FF7BC201B10 GetModuleHandleW,FormatMessageW,GetLastError,HeapFree,HeapFree,

0_2_00007FF7BC201B10

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7312

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\e17b0cfc-ae68-4569-b6fd-0a48457ca425

Jump to behavior

Source: fxc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\fxc.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: fxc.exe

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\fxc.exe "C:\Users\user\Desktop\fxc.exe"
Source: C:\Users\user\Desktop\fxc.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7312 -s 232

Source: C:\Users\user\Desktop\fxc.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\fxc.exe	Section loaded: cryptbase.dll			Jump to behavior

Source: fxc.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: fxc.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: fxc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\fxc.exe

Code function: 0_2_00007FF7BC215870 SetLastError,GetCurrentDirectoryW,GetLastError,GetLastError,HeapFree,RtlCaptureContext,RtlLookupFunctionEntry,GetCurrentProcessId,CreateMutexA,CloseHandle,WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,GetProcAddress,ReleaseMutex,RtlVirtualUnwind,HeapFree,GetLastError,HeapFree,HeapFree,

0_2_00007FF7BC215870

Source: fxc.exe

Static PE information: section name: _RDATA

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\fxc.exe

API coverage: 3.6 %

Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC2085E0 GetFileInformationByHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,FindFirstFileW,FindClose,HeapFree,		0_2_00007FF7BC2085E0
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC21EF88 FindFirstFileExW,		0_2_00007FF7BC21EF88

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\fxc.exe

Code function: 0_2_00007FF7BC21E54C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7BC21E54C

Source: C:\Users\user\Desktop\fxc.exe

0_2_00007FF7BC215870

Source: C:\Users\user\Desktop\fxc.exe

Code function: 0_2_00007FF7BC221F64 GetProcessHeap,

0_2_00007FF7BC221F64

Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC21E54C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7BC21E54C
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC218F70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7BC218F70
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC219118 SetUnhandledExceptionFilter,	0_2_00007FF7BC219118
Source: C:\Users\user\Desktop\fxc.exe	Code function: 0_2_00007FF7BC226ADC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7BC226ADC

Source: C:\Users\user\Desktop\fxc.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\fxc.exe

Code function: 0_2_00007FF7BC2263A0 cpuid

0_2_00007FF7BC2263A0

Source: C:\Users\user\Desktop\fxc.exe

0_2_00007FF7BC212410

Source: C:\Users\user\Desktop\fxc.exe

Code function: 0_2_00007FF7BC218E4C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7BC218E4C

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	2 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
fxc.exe	53%	ReversingLabs	Win64.Trojan.Generic
fxc.exe	100%	Avira	TR/AVI.Agent.robcr

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.3.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541091
Start date and time:	2024-10-24 12:06:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	fxc.exe
Detection:	MAL
Classification:	mal60.winEXE@3/7@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 18 Number of non-executed functions: 73
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: fxc.exe

Simulations

Behavior and APIs

Time	Type	Description
06:07:12	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fxc.exe_d5c59118b01e5ac2e9fe2cdeb3cf1adce977e24e_6f60c9ae_8b4724b5-c86e-4711-b290-a9b5b2b0ec6d\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6728573216818682
Encrypted:	false
SSDEEP:	96:6sFb+Ix67sYhqFy7qA8SKQXIDcQTc65cE1cw3u+HbHg/KHnOgrZAX/d5FMT2SlPB:z5x678/U0N9/Dj+zuiF/Z24lO8ID
MD5:	3691DBE0C0CCD7C21D1906B1B48F6608
SHA1:	6AE458A3EB2C13F909F3838734A189E8E7A83711
SHA-256:	4AE7D1474B59ABCDCA2CDECC26C57B90B9742B706C6D95277B893FC2C0351A8E
SHA-512:	36B0C7FFC3E71AA1638B68A310A941CB452AB53388B818981BF9A1D22E2324EF1E521C1DDF668995E8250F1E174C4B77013896A564D4FC9B69E3DA8276F51AC9
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.2.3.8.0.1.7.5.4.5.7.1.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.2.3.8.0.1.7.8.5.8.2.2.0.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.4.7.2.4.b.5.-.c.8.6.e.-.4.7.1.1.-.b.2.9.0.-.a.9.b.5.b.2.b.0.e.c.6.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.c.b.1.8.6.2.7.-.5.5.b.9.-.4.5.4.c.-.b.b.2.7.-.b.9.5.c.f.9.8.b.3.a.9.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.f.x.c...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.9.0.-.0.0.0.1.-.0.0.1.4.-.a.d.3.0.-.6.c.7.5.f.c.2.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.8.b.7.d.6.1.e.2.d.4.d.0.a.f.d.c.b.6.a.d.c.f.5.c.8.b.2.2.c.2.d.0.0.0.0.f.f.f.f.!.0.0.0.0.f.0.a.2.5.5.2.9.b.0.d.0.a.a.b.c.e.9.d.7.2.b.a.4.6.a.a.f.1.c.7.8.c.5.b.4.8.c.3.1.!.f.x.c...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.7././.2.3.:.1.2.:.3.1.:.4.8.!.0.!.f.x.c...e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER70B6.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Oct 24 10:06:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	45042
Entropy (8bit):	1.405447527681338
Encrypted:	false
SSDEEP:	96:5w8EH/X74RvrEXi7V1Ii6l1lsUzTBiBgNBhuOWIqsIGKKAeT:REDOV1IhuUzUijXL
MD5:	675533C5A57EE551BA29EFD019E4B910
SHA1:	F22AB31832151DE70D41C9264595929A2426871F
SHA-256:	559F5095C2EC35E87C0676A6109C136D08764FEAC2103F265F2AED9D739C9A57
SHA-512:	A173BEBBA6783FBF0473EA3EE6981D66F0BAD9599B0E2E6513825CA8B70924546973FA43DE4D8234852C8BDD126701AA62DDE27C6854488B87A8753C5779F68C
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......A..g........................................h#..........`.......8...........T........... ..............P...........<...........................................................................................eJ..............Lw......................T...........@..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7105.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8548
Entropy (8bit):	3.6882233133926294
Encrypted:	false
SSDEEP:	192:R6l7wVeJTfwr8V6Y9RdLZIgmfDopDa89b8Dkf+0m:R6lXJLwr8V6YbPIgmfDW8gfk
MD5:	F5AE93F79CE827BEB61C8E994328D5E6
SHA1:	42A5AAC3A912BCAF36D6DF19CC771790BA5F25CB
SHA-256:	0E33EE03DAAC5F2EA81A0F56897B66615E4887B788A769CAA004D86EF6EC8258
SHA-512:	27C397DA9F17ECEEB70F1CE9B66CE17FBB91C276D371FF347931515E935700F4B3EC161C0F35335E9449C16EB6E02EBABCDF61CF90953E183497B34E06190C9F
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7135.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4707
Entropy (8bit):	4.412733950254919
Encrypted:	false
SSDEEP:	48:cvIwWl8zsFJg771I9HyzJWpW8VY6Ym8M4JNXVgFJ8yq8vfXVpuQreTd:uIjffI79s7VaJ28WvuoGd
MD5:	561D5A71770CB8AFF8689E0E23AF95C9
SHA1:	A647710A9981C58D1BCDB90D90D4B623E6083E73
SHA-256:	81CC975015FF88FF1E7E4EBD13B3BA84660EBFBAC760BB0E9C2BF7AE5990F19A
SHA-512:	853E04B7500445077BB4FDD8D09EAD56841A27B390244DD6E2D64FF566F808E64E84F13E9BD261961380B5EEF5A7FE75F0851348661C4EBE8E3B525F81748904
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="557349" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465446814406059
Encrypted:	false
SSDEEP:	6144:gIXfpi67eLPU9skLmb0b4eWSPKaJG8nAgejZMMhA2gX4WABl0uNMdwBCswSbkn:lXD94eWlLZMM6YFHq+kn
MD5:	E2FC2FECDC61BD1707A31530694208C9
SHA1:	C6415863386027A0ACE5552FB147731897E82B7B
SHA-256:	F4E04A62E0F77566C5DC0D8E34BE43CD9BB57AC2181F7905E17BD7E37F147E6F
SHA-512:	CC8364C8E000031CDAAFD784AAF47EC8875ECE8F266B078BFB1F5CD83ED900B34D7C94FEEBD17872EBB9AE595ED45FE5D6160FA8FE8FB4CDD66DA2F455105B76
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmZ..u.%.................................................................................................................................................................................................................................................................................................................................................A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\debug\fail.txt

Download File

Process:	C:\Users\user\Desktop\fxc.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.238901256602631
Encrypted:	false
SSDEEP:	3:5bn:5b
MD5:	B8E0C5361ACE0B62719F10962426B704
SHA1:	9386FD982496B811D4FEAEB51631AC9C08E97F76
SHA-256:	954297FEA35BC7CCC2C8E474E61EE24ED7248C625804B9FF8768EA15554C2773
SHA-512:	41DC778B14295F97A435DD6BF142D1DFD63A5A17B7D519B9E92CFB9C4BBFCB50B0FFAAF6121E604FE996CA4CF0FE62FD8825EAFD222A10E2BE25D0DCDE6509B8
Malicious:	false
Reputation:	low
Preview:	child is none

C:\Windows\debug\stop.exe

Download File

Process:	C:\Users\user\Desktop\fxc.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	EF399B2D446BB37B7C32AD2CC1B6045B
SHA1:	1B480158E1F30E0B6CEE7813E9ECF094BD6B3745
SHA-256:	6C45CB72A36E63D522AA54ED8ADBD7A29A989474F2F77E0458AF8800564EF3CB
SHA-512:	BF9C0733CA09AE29BAE7EFBFF03B69E87A5489CE610F19DA806F795847563F6055964E5AEC1771293067662402C8613BEB0F498E77E20820587E133B16F73CF5
Malicious:	false
Reputation:	low
Preview:	stop

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.299817634972105
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fxc.exe
File size:	324'608 bytes
MD5:	0b1904602a90ed190066095f29a3f92a
SHA1:	f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31
SHA256:	6e349195bdc65a1964367317ba14b905440d75398c3fbb1911c3400082d7f149
SHA512:	d18058b6b1a045d8544db79940ca5500843a71d3541c012b01d0a70648d0b210113b1715b608c3866d61f41db521109b7084a109a279dc306aed4544ffd17b54
SSDEEP:	6144:6BrFsAPhVdTPrOi4OU4Ym0D+slljJbJ3pvTVFIh:6BrFBEF3mEBvr
TLSH:	99645D15FB9618FDD5ABC074C6468A72B933B8860B21BDEF12A441353F276E46E3DB10
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E..0...c...c...cJ..b...cJ..b...cJ..b...c...b(..c...b...c...b...c...c...c...c...c9k.b...cRich...c................PE..d......f...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140028b50
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x669FA2B4 [Tue Jul 23 12:31:48 2024 UTC]
TLS Callbacks:	0x4000e530, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e56ef045fa5f5c9fae11e44b0b3dd79a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F74C4B9CDC8h
dec eax
add esp, 28h
jmp 00007F74C4B9C947h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 10h
dec esp
mov dword ptr [esp], edx
dec esp
mov dword ptr [esp+08h], ebx
dec ebp
xor ebx, ebx
dec esp
lea edx, dword ptr [esp+18h]
dec esp
sub edx, eax
dec ebp
cmovb edx, ebx
dec esp
mov ebx, dword ptr [00000010h]
dec ebp
cmp edx, ebx
jnc 00007F74C4B9CAE8h
inc cx
and edx, 8D4DF000h
wait
add al, dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4bb04	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4f000	0x24cc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x53000	0x9c8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x46a90	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x46b00	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x46950	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x39000	0x3d8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x37720	0x37800	a02ec713fbe9974812e412b84ffebaad	False	0.5355917440878378	data	6.3992226630856495	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x39000	0x1389a	0x13a00	13b8deb7020ad1349aeef6eb5d67cc1f	False	0.39951980493630573	data	5.309728177527535	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4d000	0x1dd8	0xc00	217dde2fe845fd603a329ab7852c64e6	False	0.14485677083333334	data	2.0102799590686815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x4f000	0x24cc	0x2600	ab62c9ecd85cc5c7443fed8a745a001f	False	0.4862253289473684	data	5.453329444307597	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x52000	0x15c	0x200	5556100c66644b92472d605a319cfb77	False	0.40625	data	3.2977765662674985	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x53000	0x9c8	0xa00	8233352803a1d795b1a18ffe13667efb	False	0.5890625	data	5.39691148505322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
kernel32.dll	CreateWaitableTimerExW, SetWaitableTimer, WaitForSingleObject, CloseHandle, Sleep, GetExitCodeProcess, HeapReAlloc, GetModuleHandleA, GetProcAddress, GetCurrentThread, TryAcquireSRWLockExclusive, ReleaseSRWLockExclusive, GetStdHandle, GetConsoleMode, SetFilePointerEx, MultiByteToWideChar, WriteConsoleW, SetLastError, GetModuleHandleW, FormatMessageW, GetCurrentProcess, GetEnvironmentVariableW, CreateFileW, SetFileInformationByHandle, GetFullPathNameW, GetFileInformationByHandle, GetFileInformationByHandleEx, FindFirstFileW, FindClose, GetEnvironmentStringsW, HeapFree, CompareStringOrdinal, GetModuleFileNameW, GetSystemDirectoryW, AcquireSRWLockExclusive, GetWindowsDirectoryW, CreateProcessW, GetFileAttributesW, DuplicateHandle, CreateThread, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, DeleteProcThreadAttributeList, GetLastError, GetCurrentProcessId, CreateNamedPipeW, ReadFileEx, SleepEx, WriteFileEx, SetThreadStackGuarantee, TerminateProcess, GetProcessHeap, HeapAlloc, GetCurrentDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, CreateMutexA, WaitForSingleObjectEx, LoadLibraryA, ReleaseMutex, RtlVirtualUnwind, AcquireSRWLockShared, ReleaseSRWLockShared, DeleteFileW, GetConsoleOutputCP, FreeEnvironmentStringsW, AddVectoredExceptionHandler, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, RtlUnwindEx, EncodePointer, RaiseException, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, RtlPcToFileHeader, WriteFile, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, WideCharToMultiByte, SetEnvironmentVariableW, SetStdHandle, GetFileType, GetStringTypeW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, HeapSize, FlushFileBuffers
ntdll.dll	RtlNtStatusToDosError, NtReadFile, NtWriteFile
bcrypt.dll	BCryptGenRandom
advapi32.dll	SystemFunction036

Target ID:	0
Start time:	06:06:56
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\fxc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\fxc.exe"
Imagebase:	0x7ff7bc1f0000
File size:	324'608 bytes
MD5 hash:	0B1904602A90ED190066095F29A3F92A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:06:57
Start date:	24/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7312 -s 232
Imagebase:	0x7ff6e4b30000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	64.3%
Total number of Nodes:	759
Total number of Limit Nodes:	10

Executed Functions

Function 00007FF7BC209420 Relevance: 144.4, APIs: 76, Strings: 5, Instructions: 2623memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000004,00000000,?,00000000,?,00007FF7BC20E9AD,?,?,?,00000000,?,00000000,00007FF7BC20A829), ref: 00007FF7BC20956C
HeapFree.KERNEL32(00000004,00000000,?,00000000,?,00007FF7BC20E9AD,?,?,?,00000000,?,00000000,00007FF7BC20A829), ref: 00007FF7BC2095D4
HeapFree.KERNEL32(00000004,00000000,?,00000000,?,00007FF7BC20E9AD,?,?,?,00000000,?,00000000,00007FF7BC20A829), ref: 00007FF7BC209732
HeapFree.KERNEL32(00000004,00000000,?,00000000,?,00007FF7BC20E9AD,?,?,?,00000000,?,00000000,00007FF7BC20A829), ref: 00007FF7BC20975F
GetEnvironmentStringsW.KERNEL32 ref: 00007FF7BC209835

Strings

\?\\, xrefs: 00007FF7BC20A495
PATHRUST_MIN_STACKfatal runtime error: assertion failed: thread_info.stack_guard.get().is_none() && thread_info.thread.get().is_none(), xrefs: 00007FF7BC20BD84
]?\\, xrefs: 00007FF7BC20A49D
assertion failed: self.height > 0, xrefs: 00007FF7BC20D448
.exeprogram not found, xrefs: 00007FF7BC20A6F7

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FreeHeap$EnvironmentStrings
String ID: .exeprogram not found$PATHRUST_MIN_STACKfatal runtime error: assertion failed: thread_info.stack_guard.get().is_none() && thread_info.thread.get().is_none()$\?\\$]?\\$assertion failed: self.height > 0
API String ID: 2767186067-769273994
Opcode ID: 74984789f61491dd844e620553365b152a912cf5e5ad061f5bca680f47206e06
Instruction ID: 25b568b23afc686ca03e2377ff4c77e3ebc2318d7216de766f2ad1bd3839c274
Opcode Fuzzy Hash: 74984789f61491dd844e620553365b152a912cf5e5ad061f5bca680f47206e06
Instruction Fuzzy Hash: 40538366A08BC189F770AF29D8453F9A3A1FB66798F848136CF5D5B799DF389240C310

Function 00007FF7BC1F12D0 Relevance: 72.3, APIs: 35, Strings: 6, Instructions: 595
memorysynchronizationtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7BC1F1D30: HeapFree.KERNEL32 ref: 00007FF7BC1F1ECB
Part of subcall function 00007FF7BC1F1D30: HeapFree.KERNEL32 ref: 00007FF7BC1F1F1B
Part of subcall function 00007FF7BC1F1D30: HeapFree.KERNEL32 ref: 00007FF7BC1F1F2D

CreateWaitableTimerExW.KERNEL32 ref: 00007FF7BC1F151E
SetWaitableTimer.KERNEL32 ref: 00007FF7BC1F155A
WaitForSingleObject.KERNEL32 ref: 00007FF7BC1F156C
CloseHandle.KERNEL32 ref: 00007FF7BC1F1577
CloseHandle.KERNEL32 ref: 00007FF7BC1F1587
Sleep.KERNEL32 ref: 00007FF7BC1F1592
WaitForSingleObject.KERNEL32 ref: 00007FF7BC1F159D
GetExitCodeProcess.KERNEL32 ref: 00007FF7BC1F15CD
HeapFree.KERNEL32 ref: 00007FF7BC1F168A

Part of subcall function 00007FF7BC1F3340: HeapFree.KERNEL32 ref: 00007FF7BC1F35FE

HeapFree.KERNEL32 ref: 00007FF7BC1F17A9
HeapFree.KERNEL32 ref: 00007FF7BC1F17FC
HeapFree.KERNEL32 ref: 00007FF7BC1F180E
HeapFree.KERNEL32 ref: 00007FF7BC1F185D
HeapFree.KERNEL32 ref: 00007FF7BC1F186F
HeapFree.KERNEL32 ref: 00007FF7BC1F18C8
HeapFree.KERNEL32 ref: 00007FF7BC1F18DA
HeapFree.KERNEL32 ref: 00007FF7BC1F1936
HeapFree.KERNEL32 ref: 00007FF7BC1F1989
HeapFree.KERNEL32 ref: 00007FF7BC1F199B
HeapFree.KERNEL32 ref: 00007FF7BC1F1A40
HeapFree.KERNEL32 ref: 00007FF7BC1F1A52
CloseHandle.KERNEL32 ref: 00007FF7BC1F1A67
CloseHandle.KERNEL32 ref: 00007FF7BC1F1A6D
CloseHandle.KERNEL32 ref: 00007FF7BC1F1A7D
CloseHandle.KERNEL32 ref: 00007FF7BC1F1A90
CloseHandle.KERNEL32 ref: 00007FF7BC1F1AA3

Part of subcall function 00007FF7BC1F3B90: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000001,?,?,?,00007FF7BC1F25A4), ref: 00007FF7BC1F3D25

HeapFree.KERNEL32 ref: 00007FF7BC1F1B5E
HeapFree.KERNEL32 ref: 00007FF7BC1F1BAE
HeapFree.KERNEL32 ref: 00007FF7BC1F1BC0
HeapFree.KERNEL32 ref: 00007FF7BC1F1C0E
HeapFree.KERNEL32 ref: 00007FF7BC1F1C20
HeapFree.KERNEL32 ref: 00007FF7BC1F1CB0
HeapFree.KERNEL32 ref: 00007FF7BC1F1D00
HeapFree.KERNEL32 ref: 00007FF7BC1F1D12
GetLastError.KERNEL32 ref: 00007FF7BC1F16F2

Part of subcall function 00007FF7BC1F2920: HeapFree.KERNEL32 ref: 00007FF7BC1F2982
Part of subcall function 00007FF7BC1F2920: HeapFree.KERNEL32 ref: 00007FF7BC1F2994
Part of subcall function 00007FF7BC1F2920: HeapFree.KERNEL32 ref: 00007FF7BC1F29F5
Part of subcall function 00007FF7BC1F2920: HeapFree.KERNEL32 ref: 00007FF7BC1F2A07
Part of subcall function 00007FF7BC1F2920: HeapFree.KERNEL32 ref: 00007FF7BC1F2A68
Part of subcall function 00007FF7BC1F2920: HeapFree.KERNEL32 ref: 00007FF7BC1F2A7A

Strings

C:\Windows\Debug\pay.exe[exec] , xrefs: 00007FF7BC1F19A6
C:\Windows\Debug\a.cache, xrefs: 00007FF7BC1F19AD
C:\Windows\Debug\fail.txtwlQYLoPCil3niI7x8CvR9EtNtL/aeaHrZ23LP3fAsJogVTIzdnZ5Pi09ZVeHFkiB[dec] , xrefs: 00007FF7BC1F165C, 00007FF7BC1F177B, 00007FF7BC1F190D, 00007FF7BC1F1B33, 00007FF7BC1F1C87
is none, xrefs: 00007FF7BC1F1C6C
C:\Windows\Debug\b.cache, xrefs: 00007FF7BC1F136A
child is, xrefs: 00007FF7BC1F1C7A

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FreeHeap$CloseHandle$ObjectSingleTimerWaitWaitable$CodeCreateErrorExitLastProcessSleep
String ID: is none$C:\Windows\Debug\a.cache$C:\Windows\Debug\b.cache$C:\Windows\Debug\fail.txtwlQYLoPCil3niI7x8CvR9EtNtL/aeaHrZ23LP3fAsJogVTIzdnZ5Pi09ZVeHFkiB[dec] $C:\Windows\Debug\pay.exe[exec] $child is
API String ID: 1264200013-3480048919
Opcode ID: 07c59a73f36332f355eef5f65b84ea7444c81d44682379a05c2284ed909b3562
Instruction ID: 6c8a027f78d9af3423b1de2e10f85c5f5607c6821f7068b865a0eb6cf3602605
Opcode Fuzzy Hash: 07c59a73f36332f355eef5f65b84ea7444c81d44682379a05c2284ed909b3562
Instruction Fuzzy Hash: 71528E71A08A8A85EB14EB1AE4053EAA3A5FFA6B84F94C135CF5D57799DF3CD044C320

Function 00007FF7BC1F1D30 Relevance: 53.2, APIs: 28, Strings: 2, Instructions: 663
memoryfilenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapFree.KERNEL32 ref: 00007FF7BC1F1ECB
HeapFree.KERNEL32 ref: 00007FF7BC1F1F1B
HeapFree.KERNEL32 ref: 00007FF7BC1F1F2D
HeapFree.KERNEL32 ref: 00007FF7BC1F1F85
HeapFree.KERNEL32 ref: 00007FF7BC1F1F97
HeapFree.KERNEL32 ref: 00007FF7BC1F20B0
HeapFree.KERNEL32 ref: 00007FF7BC1F2102
HeapFree.KERNEL32 ref: 00007FF7BC1F2114
HeapFree.KERNEL32 ref: 00007FF7BC1F2165
HeapFree.KERNEL32 ref: 00007FF7BC1F2177
HeapFree.KERNEL32 ref: 00007FF7BC1F2194
NtReadFile.NTDLL ref: 00007FF7BC1F21D4
WaitForSingleObject.KERNEL32 ref: 00007FF7BC1F21E9
RtlNtStatusToDosError.NTDLL ref: 00007FF7BC1F221F

Part of subcall function 00007FF7BC2085E0: FindFirstFileW.KERNEL32 ref: 00007FF7BC208869
Part of subcall function 00007FF7BC2085E0: FindClose.KERNEL32 ref: 00007FF7BC208878
Part of subcall function 00007FF7BC2085E0: HeapFree.KERNEL32 ref: 00007FF7BC208906

HeapFree.KERNEL32 ref: 00007FF7BC1F24D3
HeapFree.KERNEL32 ref: 00007FF7BC1F25D6
HeapFree.KERNEL32 ref: 00007FF7BC1F2626
HeapFree.KERNEL32 ref: 00007FF7BC1F2638
HeapFree.KERNEL32 ref: 00007FF7BC1F2689
HeapFree.KERNEL32 ref: 00007FF7BC1F269B
CloseHandle.KERNEL32 ref: 00007FF7BC1F26A6
CloseHandle.KERNEL32 ref: 00007FF7BC1F26B4
HeapFree.KERNEL32 ref: 00007FF7BC1F2754
HeapFree.KERNEL32 ref: 00007FF7BC1F27A7
HeapFree.KERNEL32 ref: 00007FF7BC1F27B9
HeapFree.KERNEL32 ref: 00007FF7BC1F280D
HeapFree.KERNEL32 ref: 00007FF7BC1F281F
CloseHandle.KERNEL32 ref: 00007FF7BC1F2828

Strings

C:\Windows\Debug\fail.txtwlQYLoPCil3niI7x8CvR9EtNtL/aeaHrZ23LP3fAsJogVTIzdnZ5Pi09ZVeHFkiB[dec] , xrefs: 00007FF7BC1F1EA1, 00007FF7BC1F2086, 00007FF7BC1F25AC, 00007FF7BC1F272A
C:\Windows\Debug\b.cache, xrefs: 00007FF7BC1F28DE

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FreeHeap$Close$Handle$FileFind$ErrorFirstObjectReadSingleStatusWait
String ID: C:\Windows\Debug\b.cache$C:\Windows\Debug\fail.txtwlQYLoPCil3niI7x8CvR9EtNtL/aeaHrZ23LP3fAsJogVTIzdnZ5Pi09ZVeHFkiB[dec]
API String ID: 245698163-1914240854
Opcode ID: 7f21da90883e318122770393cb50abb69f54e6a10b0c4ceaaea26ec06006e911
Instruction ID: 5c6364447982eb2ce2f7c7161cab83f81fda8ddf1219fe8a620e01f6458d4293
Opcode Fuzzy Hash: 7f21da90883e318122770393cb50abb69f54e6a10b0c4ceaaea26ec06006e911
Instruction Fuzzy Hash: EC72D571A08AC585F721EF29E8493E9A3A1FF66798F848131DF0D5B768DF389285C310

Function 00007FF7BC2085E0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 191
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileInformationByHandle.KERNEL32 ref: 00007FF7BC208760
GetFileInformationByHandleEx.KERNEL32 ref: 00007FF7BC20879B
GetLastError.KERNEL32 ref: 00007FF7BC20881A
CloseHandle.KERNEL32 ref: 00007FF7BC208836
FindFirstFileW.KERNEL32 ref: 00007FF7BC208869
FindClose.KERNEL32 ref: 00007FF7BC208878
HeapFree.KERNEL32 ref: 00007FF7BC208906

Strings

C:\Windows\Debug\b.cache, xrefs: 00007FF7BC2085E7

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FileHandle$CloseFindInformation$ErrorFirstFreeHeapLast
String ID: C:\Windows\Debug\b.cache
API String ID: 3677867274-1668539190
Opcode ID: 5796192b94fb54c2aaebf824a863f1ca5f029585796110c00edb96b25ddf7d91
Instruction ID: 2ef0c2307bba35fa4b7695ae5152d05f1172192cd1b98cf446790588a1cecedf
Opcode Fuzzy Hash: 5796192b94fb54c2aaebf824a863f1ca5f029585796110c00edb96b25ddf7d91
Instruction Fuzzy Hash: A6917132A047858AF7309F69E8843EEB3A1FB55398F508125CF991BB98DF3CA581C350

Function 00007FF7BC201B10 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 378
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7BC201B73
FormatMessageW.KERNELBASE ref: 00007FF7BC201BBA

Strings

NTDLL.DLL, xrefs: 00007FF7BC201B6C
assertion failed: self.is_char_boundary(new_len)/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\alloc\src\string.rs, xrefs: 00007FF7BC20214C

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FormatHandleMessageModule
String ID: NTDLL.DLL$assertion failed: self.is_char_boundary(new_len)/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\alloc\src\string.rs
API String ID: 2046974992-908490256
Opcode ID: 4d683401d145d04b8b0d3254484aac74a3dce92407b105a9123b0a38d3545261
Instruction ID: 922604085b950f60187cd45c61e9a67b2158d9b530f72265c2ee40a5a0a94114
Opcode Fuzzy Hash: 4d683401d145d04b8b0d3254484aac74a3dce92407b105a9123b0a38d3545261
Instruction Fuzzy Hash: 40F1A432A096C249F7319F29D8047F9A751FB26798F848137DB8D0AB9DDF789285D320

Function 00007FF7BC200230 Relevance: 4.6, APIs: 3, Instructions: 66
filenativesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteFile.NTDLL ref: 00007FF7BC20027D
WaitForSingleObject.KERNEL32 ref: 00007FF7BC200292
RtlNtStatusToDosError.NTDLL ref: 00007FF7BC2002B6

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ErrorFileObjectSingleStatusWaitWrite
String ID:
API String ID: 3447438843-0
Opcode ID: 955f07289bb48e6222bce8d37c28d9ea8498b0f49b00e53e090563fdb6ae2b94
Instruction ID: 66387c17aaa5e96b8b2f4aa0116a4f508d0c5a81ae2c5ed0be23c917741147cc
Opcode Fuzzy Hash: 955f07289bb48e6222bce8d37c28d9ea8498b0f49b00e53e090563fdb6ae2b94
Instruction Fuzzy Hash: 52218432A18B8586F7109B69F4503AAB3A5EB95350F50C235E7DD46BA8EF7CE1C4CB10

Function 00007FF7BC206A00 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 173
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7BC200F00: HeapFree.KERNEL32 ref: 00007FF7BC201029

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,?,C:\Windows\Debug\b.cache,?,00007FF7BC20866A), ref: 00007FF7BC206C29
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,?,C:\Windows\Debug\b.cache,?,00007FF7BC20866A), ref: 00007FF7BC206C3C
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,?,C:\Windows\Debug\b.cache,?,00007FF7BC20866A), ref: 00007FF7BC206C53

Strings

C:\Windows\Debug\b.cache, xrefs: 00007FF7BC206A02

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FreeHeap$CloseErrorHandleLast
String ID: C:\Windows\Debug\b.cache
API String ID: 1415190448-1668539190
Opcode ID: 74c8f011379a3549005a8422be962403b0e3a36ac7212c50cd21c35511baf40c
Instruction ID: 377baf1b59b7533d09ab30ecab01623841e8675f33e87f0140adeae349d4b888
Opcode Fuzzy Hash: 74c8f011379a3549005a8422be962403b0e3a36ac7212c50cd21c35511baf40c
Instruction Fuzzy Hash: 6061F6A190C25646FB606B2996413F9AB90AF67B94F94C132DF5E177CCCE3DE884C720

Function 00007FF7BC1F2920 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 139
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7BC2187E0: DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7BC1F2938), ref: 00007FF7BC21884C
Part of subcall function 00007FF7BC2187E0: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7BC1F2938), ref: 00007FF7BC218867

HeapFree.KERNEL32 ref: 00007FF7BC1F2982
HeapFree.KERNEL32 ref: 00007FF7BC1F2994
HeapFree.KERNEL32 ref: 00007FF7BC1F29F5
HeapFree.KERNEL32 ref: 00007FF7BC1F2A07
HeapFree.KERNEL32 ref: 00007FF7BC1F2A68
HeapFree.KERNEL32 ref: 00007FF7BC1F2A7A
HeapFree.KERNEL32 ref: 00007FF7BC1F2AF0

Strings

C:\Windows\Debug\pay.exe[exec] , xrefs: 00007FF7BC1F2927
C:\Windows\Sysmon64.sysC:\Windows\Debug\b.cache, xrefs: 00007FF7BC1F2A0D

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FreeHeap$DeleteFile
String ID: C:\Windows\Debug\pay.exe[exec] $C:\Windows\Sysmon64.sysC:\Windows\Debug\b.cache
API String ID: 3719452183-883891438
Opcode ID: 648f40e87a3a67498d6af36e687083245c408357acd022bd2d68ec26150df7a9
Instruction ID: c31c519ae7d9ec85e78493f184549732d6c1906b2660fc2a5132f40ccaf2fa5e
Opcode Fuzzy Hash: 648f40e87a3a67498d6af36e687083245c408357acd022bd2d68ec26150df7a9
Instruction Fuzzy Hash: 35519165B09A4681FA14EB5AE5453B8A392EFA6B90F89C031CF1D577ACDF3CD442C320

Function 00007FF7BC1F1010 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AddVectoredExceptionHandler.KERNEL32 ref: 00007FF7BC1F1032
SetThreadStackGuarantee.KERNELBASE ref: 00007FF7BC1F104C
GetLastError.KERNEL32 ref: 00007FF7BC1F1056

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC1F119E, 00007FF7BC1F11FF
main, xrefs: 00007FF7BC1F1065

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ErrorExceptionGuaranteeHandlerLastStackThreadVectored
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs$main
API String ID: 1207050972-2091503091
Opcode ID: dfdb4e87f092b255c515ec56ced92a11e0b940eb2f6b6ca17041038ed7d0a86f
Instruction ID: 15902a61252522389f8dd839065b0a117eb136f0f150d872e26a1f21ccc5058e
Opcode Fuzzy Hash: dfdb4e87f092b255c515ec56ced92a11e0b940eb2f6b6ca17041038ed7d0a86f
Instruction Fuzzy Hash: 50518D62E18B4688F710ABA8E8503FDA3A5BB66354F90C135CB4D6A79CDF7C9095C320

Function 00007FF7BC2187E0 Relevance: 6.1, APIs: 4, Instructions: 54
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7BC200F00: HeapFree.KERNEL32 ref: 00007FF7BC201029

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7BC1F2938), ref: 00007FF7BC21884C
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7BC1F2938), ref: 00007FF7BC218867
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7BC1F2938), ref: 00007FF7BC218871
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7BC1F2938), ref: 00007FF7BC218892

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FreeHeap$DeleteErrorFileLast
String ID:
API String ID: 1166609798-0
Opcode ID: 3f11c54b601b35f42eb0c6b817f30543dba6dce3a726dd26b873697eed452d20
Instruction ID: 23a28a7c5f85dae06b4314d80bdd504fff458b9a100ae1ec7bf3107d0aad9f6f
Opcode Fuzzy Hash: 3f11c54b601b35f42eb0c6b817f30543dba6dce3a726dd26b873697eed452d20
Instruction Fuzzy Hash: 59110A25E0CA5581FA10AB1AE8441E9E361AFEAFD0F898131EF5D17B6CDE3CD4418720

Function 00007FF7BC2189D4 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7BC2189E8

Part of subcall function 00007FF7BC218C38: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7BC218C5A

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7BC2189FD
__scrt_release_startup_lock.LIBCMT ref: 00007FF7BC218A6B

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 3058843127-0
Opcode ID: a53aeb83fb362745e92f1308b851b4be0b3ac8df36c49d980486a2af274f56fc
Instruction ID: 076109ed5abd1e5b7820a8b8366a9eceb4b1814fa532beae06c7b03e9f4adda1
Opcode Fuzzy Hash: a53aeb83fb362745e92f1308b851b4be0b3ac8df36c49d980486a2af274f56fc
Instruction Fuzzy Hash: 0F312B21A0824286FA14BB2CD8913F9A391AFA7784FD58434EB4D4B3DFDE7CA5448270

Function 00007FF7BC201611 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 80
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7BC201B10: GetModuleHandleW.KERNEL32 ref: 00007FF7BC201B73
Part of subcall function 00007FF7BC201B10: FormatMessageW.KERNELBASE ref: 00007FF7BC201BBA

HeapFree.KERNEL32 ref: 00007FF7BC201788

Strings

}0x, xrefs: 00007FF7BC2016ED
OscodekindmessageKindErrorCustomerror (os error ), xrefs: 00007FF7BC201620

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FormatFreeHandleHeapMessageModule
String ID: }0x$OscodekindmessageKindErrorCustomerror (os error )
API String ID: 3599032235-2409297627
Opcode ID: 86b7598a11edca7d32f97b95f18b1462b13d7ad85f12e48f097111f8dcbba088
Instruction ID: 09b6f102aebb68c12e659a02f61c013f8d114131d0a919dced0ce0b43be9450e
Opcode Fuzzy Hash: 86b7598a11edca7d32f97b95f18b1462b13d7ad85f12e48f097111f8dcbba088
Instruction Fuzzy Hash: DF417E66B18A5689FB10EB69D4407EC7B70AB5AB88F804136CF4D27B69CF3CD645C320

Function 00007FF7BC1FE830 Relevance: 4.5, APIs: 3, Instructions: 38
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7BC200F00: HeapFree.KERNEL32 ref: 00007FF7BC201029

GetCurrentThread.KERNEL32 ref: 00007FF7BC1FE88B
SetThreadDescription.KERNELBASE ref: 00007FF7BC1FE89E
HeapFree.KERNEL32(?,?,?,?,?,?,00007FF7BC1F1076), ref: 00007FF7BC1FE8B2

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FreeHeapThread$CurrentDescription
String ID:
API String ID: 2762239883-0
Opcode ID: 6baee0de14b630ea9e238a644f8e62af97798e8afe6627601fc3d4f3ffd1fa68
Instruction ID: 830f3780105408e98f3b90531ee29de092949305084be9b6376eec2a1773b40d
Opcode Fuzzy Hash: 6baee0de14b630ea9e238a644f8e62af97798e8afe6627601fc3d4f3ffd1fa68
Instruction Fuzzy Hash: BF012951A08A4A81FA10B71AF4043ADE761AFA7BD0FD48032DF0D277ACDE2CD5868710

Function 00007FF7BC1F3B90 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 120
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000001,?,?,?,00007FF7BC1F25A4), ref: 00007FF7BC1F3D25

Strings

a formatting trait implementation returned an errorlibrary\alloc\src\fmt.rs, xrefs: 00007FF7BC1F3CCF

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FreeHeap
String ID: a formatting trait implementation returned an errorlibrary\alloc\src\fmt.rs
API String ID: 3298025750-3246017335
Opcode ID: e06e292ca42a74a3870381d6474eef80ecab71b2a2ab64c53d59d02fcaefcf40
Instruction ID: 8eaba0334998156b1bb825220df4d1821927cf23692e439efd6c27d734c89be4
Opcode Fuzzy Hash: e06e292ca42a74a3870381d6474eef80ecab71b2a2ab64c53d59d02fcaefcf40
Instruction Fuzzy Hash: 4C41A5A2E04A4945FF10AB58E8543F8A364FF66394FC8C631DF1D16698DF7CD194C220

Function 00007FF7BC2073F0 Relevance: 2.6, APIs: 2, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5514469a56f24b8deb41b0aa8db4f51faeae5f1f00987259b3bd6e97293158be
Instruction ID: 7e1dc2c64da192376f5678d2d5b19af9b762d4fa1b899f76590e91ebaff29aac
Opcode Fuzzy Hash: 5514469a56f24b8deb41b0aa8db4f51faeae5f1f00987259b3bd6e97293158be
Instruction Fuzzy Hash: 0931C822F1965594F701DB69A8047EDAB70BB25BA8F848532DE0C17798CF78D586C320

Function 00007FF7BC207500 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,?,?,?,00000001,00000002,00000001,?,00007FF7BC1F25C0), ref: 00007FF7BC20751E
CloseHandle.KERNEL32(?,?,00000000,00000001,?,?,?,00000001,?,?,?,00000001,00000002,00000001,?,00007FF7BC1F25C0), ref: 00007FF7BC20756D

Part of subcall function 00007FF7BC200230: NtWriteFile.NTDLL ref: 00007FF7BC20027D
Part of subcall function 00007FF7BC200230: WaitForSingleObject.KERNEL32 ref: 00007FF7BC200292

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: CloseHandle$FileObjectSingleWaitWrite
String ID:
API String ID: 1197516534-0
Opcode ID: c2a394939975c5385155312e737bb6feae2b03989bf40223705a97c30feb1c17
Instruction ID: 14d8cdce40b2f6efe97d5231c4c8e44ef35bd84621b191b15dca2ba54b1d622f
Opcode Fuzzy Hash: c2a394939975c5385155312e737bb6feae2b03989bf40223705a97c30feb1c17
Instruction Fuzzy Hash: 36F0C812F1860945F912A75DA8413FC97606F16FE9F404433CF0C17748CE7CE4C28220

Function 00007FF7BC207484 Relevance: 1.3, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,?,?,?,00000001,00000002,00000001,?,00007FF7BC1F25C0), ref: 00007FF7BC20751E

Part of subcall function 00007FF7BC200230: NtWriteFile.NTDLL ref: 00007FF7BC20027D
Part of subcall function 00007FF7BC200230: WaitForSingleObject.KERNEL32 ref: 00007FF7BC200292

CloseHandle.KERNEL32(?,?,00000000,00000001,?,?,?,00000001,?,?,?,00000001,00000002,00000001,?,00007FF7BC1F25C0), ref: 00007FF7BC20756D

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: CloseHandle$FileObjectSingleWaitWrite
String ID:
API String ID: 1197516534-0
Opcode ID: 0dc99002625e40f21f450e38f5f5fe04962034ca88a6d7483f5f9f0e8ee8e813
Instruction ID: 342082ac794172f5d9d31b7b6add8e349144947d23cd812d6f2384188d94d55a
Opcode Fuzzy Hash: 0dc99002625e40f21f450e38f5f5fe04962034ca88a6d7483f5f9f0e8ee8e813
Instruction Fuzzy Hash: AEF09023F18A1486F702E768E8513AD6764BB11BA8F404436CF0D17758CF38E4D28220

Function 00007FF7BC2074C9 Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,?,?,?,00000001,00000002,00000001,?,00007FF7BC1F25C0), ref: 00007FF7BC20751E
CloseHandle.KERNEL32(?,?,00000000,00000001,?,?,?,00000001,?,?,?,00000001,00000002,00000001,?,00007FF7BC1F25C0), ref: 00007FF7BC20756D

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c9fb2924f1cdda838a45035efe7a2c96366cda1922bb4551d332a6eaf018c9f6
Instruction ID: 1e974f9bb058a3ab4c5082f893e9f390caa0b235540287de2150c95b608adbfa
Opcode Fuzzy Hash: c9fb2924f1cdda838a45035efe7a2c96366cda1922bb4551d332a6eaf018c9f6
Instruction Fuzzy Hash: 9AE06D23F0AA5945FE02A769A9500F997606B55FE4B848472CF0D23B589F38E4C38220

Non-executed Functions

Function 00007FF7BC215870 Relevance: 51.2, APIs: 23, Strings: 6, Instructions: 481libraryloadermemoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7BC21597A
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7BC215986
GetLastError.KERNEL32 ref: 00007FF7BC215992
GetLastError.KERNEL32 ref: 00007FF7BC2159AC
HeapFree.KERNEL32 ref: 00007FF7BC215A28
RtlCaptureContext.KERNEL32(?), ref: 00007FF7BC215B57
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7BC215BA5
GetCurrentProcessId.KERNEL32 ref: 00007FF7BC215C97
CreateMutexA.KERNEL32 ref: 00007FF7BC215D49
CloseHandle.KERNEL32 ref: 00007FF7BC215D71
WaitForSingleObjectEx.KERNEL32 ref: 00007FF7BC215D8F
LoadLibraryA.KERNEL32 ref: 00007FF7BC215DA8
GetProcAddress.KERNEL32 ref: 00007FF7BC215DE1
GetProcAddress.KERNEL32 ref: 00007FF7BC215E18
GetProcAddress.KERNEL32 ref: 00007FF7BC215E4F
GetCurrentProcess.KERNEL32 ref: 00007FF7BC215E68
GetProcAddress.KERNEL32 ref: 00007FF7BC215EAF
ReleaseMutex.KERNEL32 ref: 00007FF7BC215F06
HeapFree.KERNEL32 ref: 00007FF7BC216017
GetLastError.KERNEL32 ref: 00007FF7BC216033

Strings

SymInitializeW, xrefs: 00007FF7BC215E48
SymSetOptions, xrefs: 00007FF7BC215E11
()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC215AB1, 00007FF7BC216083
dbghelp.dll, xrefs: 00007FF7BC215DA1
SymAddrIncludeInlineTrace, xrefs: 00007FF7BC215EA8
SymGetOptions, xrefs: 00007FF7BC215DDA

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: AddressErrorLastProc$Current$FreeHeapMutexProcess$CaptureCloseContextCreateDirectoryEntryFunctionHandleLibraryLoadLookupObjectReleaseSingleWait
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs$SymAddrIncludeInlineTrace$SymGetOptions$SymInitializeW$SymSetOptions$dbghelp.dll
API String ID: 2343345281-1634453497
Opcode ID: e179861b1648cb7c051f4fc5105cdfc64c61a980d5268fa4ae04cbabc74c1742
Instruction ID: ecfc9210fb20736c12699952a772529d3031a6cf7a097b691e4432116badc726
Opcode Fuzzy Hash: e179861b1648cb7c051f4fc5105cdfc64c61a980d5268fa4ae04cbabc74c1742
Instruction Fuzzy Hash: 7E325021A09BC688E770AF29DC443F963A0FB66759F848135CB5D5B798EF3C9245C720

Function 00007FF7BC2046C0 Relevance: 33.9, APIs: 9, Strings: 10, Instructions: 676libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7BC204729
GetCurrentProcess.KERNEL32 ref: 00007FF7BC204742
GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,?), ref: 00007FF7BC204CAA
GetProcAddress.KERNEL32(?,?,?,?,?,00000000,?), ref: 00007FF7BC204CE3
GetProcAddress.KERNEL32(?,?,?,?,?,00000000,?), ref: 00007FF7BC204D30

Strings

SymQueryInlineTrace, xrefs: 00007FF7BC204D29
SymFromInlineContextW, xrefs: 00007FF7BC204E77
SymGetLineFromInlineContextW, xrefs: 00007FF7BC20522A
(, xrefs: 00007FF7BC204ABA
SymFromAddrW, xrefs: 00007FF7BC204722
SymGetLineFromAddrW64, xrefs: 00007FF7BC204AD5
X, xrefs: 00007FF7BC204E59
SymAddrIncludeInlineTrace, xrefs: 00007FF7BC204CDC
(, xrefs: 00007FF7BC205209
X, xrefs: 00007FF7BC204704

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: ($($SymAddrIncludeInlineTrace$SymFromAddrW$SymFromInlineContextW$SymGetLineFromAddrW64$SymGetLineFromInlineContextW$SymQueryInlineTrace$X$X
API String ID: 2190909847-3202392857
Opcode ID: 13d30a5d6f6064d8e4caec754976019cb8802399ed2beacfb975e3ada03743c9
Instruction ID: feb045fae12bd2e3cbf14c3111be92341b971dc148f77f071ddf7a0183655747
Opcode Fuzzy Hash: 13d30a5d6f6064d8e4caec754976019cb8802399ed2beacfb975e3ada03743c9
Instruction Fuzzy Hash: F662CF2191CAC686FB25AB18E4553FAB364FBA6390F808136EB8E03798DF3DD545C750

Function 00007FF7BC210A20 Relevance: 30.6, APIs: 20, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b7f1bb953da3238e8ff0da96104060795636b06b9cb53735873d4db676d6ee
Instruction ID: fd33a11cd804348701906212351de3ea44eede358f0821531e5b08213db4f007
Opcode Fuzzy Hash: f4b7f1bb953da3238e8ff0da96104060795636b06b9cb53735873d4db676d6ee
Instruction Fuzzy Hash: FB428362A047C185EB35AF29DC443E9A3A5FB66B98F848136DF1C5B798CF7C9285C310

Function 00007FF7BC1F2B10 Relevance: 27.5, APIs: 16, Strings: 2, Instructions: 509memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF7BC1F2B36
HeapFree.KERNEL32 ref: 00007FF7BC1F2B7C
HeapFree.KERNEL32 ref: 00007FF7BC1F2B94
HeapFree.KERNEL32 ref: 00007FF7BC1F2CB7

Strings

,(><&*@, xrefs: 00007FF7BC1F32F8
ExitStatussrc\lib.rsC:\Windows\Debug\fail.txtwlQYLoPCil3niI7x8CvR9EtNtL/aeaHrZ23LP3fAsJogVTIzdnZ5Pi09ZVeHFkiB[dec] , xrefs: 00007FF7BC1F3286

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FreeHeap
String ID: ,(><&*@$ExitStatussrc\lib.rsC:\Windows\Debug\fail.txtwlQYLoPCil3niI7x8CvR9EtNtL/aeaHrZ23LP3fAsJogVTIzdnZ5Pi09ZVeHFkiB[dec]
API String ID: 3298025750-2880284916
Opcode ID: d34abe99ee85a8d81092baebeb2a3be5bca439f4974624b47a44ae069c6c5bcd
Instruction ID: f87189cac7a884b26b1e4fe77ed98f9b769afe29cace8dcd8e758280537368f0
Opcode Fuzzy Hash: d34abe99ee85a8d81092baebeb2a3be5bca439f4974624b47a44ae069c6c5bcd
Instruction Fuzzy Hash: C412D6A1B1964982EA55AB1AF4043B9A795FB66BE0FC88531CF1D677D8CE3CE441C320

Function 00007FF7BC211207 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 358memorythreadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7BC21121C
DuplicateHandle.KERNEL32 ref: 00007FF7BC211247
GetLastError.KERNEL32 ref: 00007FF7BC211329
CloseHandle.KERNEL32 ref: 00007FF7BC211384
HeapFree.KERNEL32 ref: 00007FF7BC2114DF
CreateThread.KERNEL32 ref: 00007FF7BC2116EB
CloseHandle.KERNEL32 ref: 00007FF7BC2116FD

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC211876
RUST_MIN_STACKfatal runtime error: assertion failed: thread_info.stack_guard.get().is_none() && thread_info.thread.get().is_none(), xrefs: 00007FF7BC2113E8
failed to spawn thread, xrefs: 00007FF7BC211833
cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs, xrefs: 00007FF7BC2118B1

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: Handle$Close$CreateCurrentDuplicateErrorFreeHeapLastProcessThread
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs$RUST_MIN_STACKfatal runtime error: assertion failed: thread_info.stack_guard.get().is_none() && thread_info.thread.get().is_none()$cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs$failed to spawn thread
API String ID: 302064629-2049688190
Opcode ID: 5c3aa810bde16558ab61a2e3f7b964e9e2c6a2fa20747e712a247823885c5cb3
Instruction ID: 5366d4957231f7a4221703116671246f9aa6a0c682124d2bf069a49dc5e9d5e2
Opcode Fuzzy Hash: 5c3aa810bde16558ab61a2e3f7b964e9e2c6a2fa20747e712a247823885c5cb3
Instruction Fuzzy Hash: 4F029022A09B8285FB11AB29D8403F9A7A1FB66788F84C535DB4D07B9DDF7CE445C360

Function 00007FF7BC206C60 Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 453COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7BC206E77
GetFullPathNameW.KERNEL32 ref: 00007FF7BC206E90
GetLastError.KERNEL32 ref: 00007FF7BC206E9C
GetLastError.KERNEL32 ref: 00007FF7BC206EB6

Strings

\\?\\\?\UNC\, xrefs: 00007FF7BC206F73, 00007FF7BC206FD3
()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC206F90, 00007FF7BC207022, 00007FF7BC207036

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs$\\?\\\?\UNC\
API String ID: 2482867836-3002053107
Opcode ID: 9de0db11645004223b34e73f359ac36371c9122c59b718ae8da97775cdc01e1c
Instruction ID: bf083b267c7770ce6f07b9b25f4b6e075d2b1bafb64d453592a991265c57074a
Opcode Fuzzy Hash: 9de0db11645004223b34e73f359ac36371c9122c59b718ae8da97775cdc01e1c
Instruction Fuzzy Hash: 6912AF62E08A8685F770AF19D9443F8A3A5FB26B94F80C136DF5D4B798DF389585C320

Function 00007FF7BC212410 Relevance: 18.5, APIs: 12, Instructions: 504memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF7BC212470
BCryptGenRandom.BCRYPT ref: 00007FF7BC2124AD
HeapFree.KERNEL32 ref: 00007FF7BC212580

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: CryptCurrentFreeHeapProcessRandom
String ID:
API String ID: 1323412823-0
Opcode ID: 017971231658408b556b61c2cb63df5b05b7af43835d05adea0601a85bad8706
Instruction ID: 54c9fb022e4a38a55f6683079705af8e4e0c189bb11f2fe9feeb7645bcde8f07
Opcode Fuzzy Hash: 017971231658408b556b61c2cb63df5b05b7af43835d05adea0601a85bad8706
Instruction Fuzzy Hash: EC22A222A08AC189E760DF29DC003EA67A0FB5679CF948235EB6D477DDDF78D5458320

Function 00007FF7BC2097A0 Relevance: 14.0, APIs: 9, Instructions: 541COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00007FF7BC209835
CloseHandle.KERNEL32 ref: 00007FF7BC20A839

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: CloseEnvironmentHandleStrings
String ID:
API String ID: 1140201626-0
Opcode ID: 77e72ca62734a68266d704608df4450f7570c309645dea6245818f786da84e92
Instruction ID: 4963b66358d84323bfc4fb99fc4a9ffb362b04484175bf6372a2ad1edf3956c4
Opcode Fuzzy Hash: 77e72ca62734a68266d704608df4450f7570c309645dea6245818f786da84e92
Instruction Fuzzy Hash: 83427162A05BC189FB70AF29D8453FA63A0FB56798F848136CB6D5B7D8DF789241C310

Function 00007FF7BC211E40 Relevance: 13.8, APIs: 9, Instructions: 264memorythreadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000002,00000004,00000004,?,?,00007FF7BC20CE7C), ref: 00007FF7BC211E87
HeapReAlloc.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000002,00000004,00000004,?,?,00007FF7BC20CE7C), ref: 00007FF7BC211F0A
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7BC21223B

Part of subcall function 00007FF7BC215820: GetProcessHeap.KERNEL32(?,?,?,?,00007FF7BC1FF0AD,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7BC215837

HeapFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000002,00000004,00000004,?,?,00007FF7BC20CE7C), ref: 00007FF7BC211F36
InitializeProcThreadAttributeList.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000002,00000004,00000004,?,?,00007FF7BC20CE7C), ref: 00007FF7BC211F4E
UpdateProcThreadAttribute.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000002,00000004,00000004,?,?,00007FF7BC20CE7C), ref: 00007FF7BC211FBA

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: Heap$AttributeProcThread$FreeInitializeList$AllocProcessUpdate
String ID:
API String ID: 2216397699-0
Opcode ID: e53489ee4274e7c4be6ec7bd31fcc1242f5e101a0b888f9e7c67b0317bd42381
Instruction ID: 4cc5209be337eb5a3c15b36904fdac1892277df2fe8c842373ba7c715937cae1
Opcode Fuzzy Hash: e53489ee4274e7c4be6ec7bd31fcc1242f5e101a0b888f9e7c67b0317bd42381
Instruction Fuzzy Hash: FEA1E925F18A5585EA14AB5EDC047F9A3A1BF6ABB4F948231EF2D173D8DE3D9041C220

Function 00007FF7BC218F70 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7BC218F8C
RtlCaptureContext.KERNEL32 ref: 00007FF7BC218FB9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7BC218FD3
RtlVirtualUnwind.KERNEL32 ref: 00007FF7BC219014
IsDebuggerPresent.KERNEL32 ref: 00007FF7BC219068
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7BC219089
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7BC219094

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: af00a380bd108058a5f6b938f01f43a4e6bd13d564c60caa60252e7e250b45ca
Instruction ID: e4610015b12e608e900ff99bad82d3d285d3026ac463b2484509034ab0c7f700
Opcode Fuzzy Hash: af00a380bd108058a5f6b938f01f43a4e6bd13d564c60caa60252e7e250b45ca
Instruction Fuzzy Hash: 6E319272608B8589EB60AF68E8403EDB365FB95744F848139DB4D47B98DF3CC548C720

Function 00007FF7BC21E54C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7BC21E5C5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7BC21E5DD
RtlVirtualUnwind.KERNEL32 ref: 00007FF7BC21E618
IsDebuggerPresent.KERNEL32 ref: 00007FF7BC21E651
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7BC21E65B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7BC21E666

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 04ed512f23599af0a347c671bdc6bc3996e67deb4400620a88918fab9d843f5e
Instruction ID: 2117f5b019e28c521b8ea65eeea2502a417fccf9ded55834aa738322da6d0ea6
Opcode Fuzzy Hash: 04ed512f23599af0a347c671bdc6bc3996e67deb4400620a88918fab9d843f5e
Instruction Fuzzy Hash: A5317F32618B8185EB60EF29E8442EEB3A4FB95754F904135EB9D47B98DF38C545CB10

Function 00007FF7BC20EC90 Relevance: 8.5, APIs: 3, Strings: 2, Instructions: 967memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7BC210360: CompareStringOrdinal.KERNEL32 ref: 00007FF7BC2103DF

HeapFree.KERNEL32 ref: 00007FF7BC20EE84
HeapFree.KERNEL32 ref: 00007FF7BC20EEA4
HeapFree.KERNEL32 ref: 00007FF7BC20FF86

Strings

assertion failed: idx < CAPACITY/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\alloc\src\collections\btree\node.rsassertion failed: edge.height == self.height - 1, xrefs: 00007FF7BC20FF22
assertion failed: edge.height == self.node.height - 1, xrefs: 00007FF7BC20FDB5

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FreeHeap$CompareOrdinalString
String ID: assertion failed: edge.height == self.node.height - 1$assertion failed: idx < CAPACITY/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\alloc\src\collections\btree\node.rsassertion failed: edge.height == self.height - 1
API String ID: 3984308579-1420224799
Opcode ID: 315e935e0afb3f92c3c381ca3d263db4b97b37bcf75cd4ed15db78d80ccfcace
Instruction ID: 8b12a72dcb98ae7fba6ad12f826d0963d91d4c2c77c107c7056ceeb5306c4160
Opcode Fuzzy Hash: 315e935e0afb3f92c3c381ca3d263db4b97b37bcf75cd4ed15db78d80ccfcace
Instruction Fuzzy Hash: FCB2C232908BC585E7629F28D8457E973A4FF69788F459222DF8C17769EF38A2D5C300

Function 00007FF7BC218E4C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7BC218E78
GetCurrentThreadId.KERNEL32 ref: 00007FF7BC218E86
GetCurrentProcessId.KERNEL32 ref: 00007FF7BC218E92
QueryPerformanceCounter.KERNEL32 ref: 00007FF7BC218EA2

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: bf77ed9bb4f44f4367d8aaf785dcc34d19ac6d3f24457b74f1320783341c77e1
Instruction ID: 67621e186bc914b89f5469d2137cbc32a92ef192885764d6b5f85d2d926f9d01
Opcode Fuzzy Hash: bf77ed9bb4f44f4367d8aaf785dcc34d19ac6d3f24457b74f1320783341c77e1
Instruction Fuzzy Hash: 13114F22B14B0589EB00EB64E8452E873A4F76A758F841A31DB2D86768DF3CD1948350

Function 00007FF7BC1FD590 Relevance: 4.6, Strings: 3, Instructions: 851COMMON

Download Yara Rule

Strings

,(><&*@, xrefs: 00007FF7BC1FDD49
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF7BC1FE1EC
SizeLimitExhausted, xrefs: 00007FF7BC1FE36C

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID: ,(><&*@$SizeLimitExhausted$called `Result::unwrap()` on an `Err` value
API String ID: 0-3044266859
Opcode ID: 919d02489e86dee6ee5af8ec1b10f307c7738dff768c3888ddd1a2566d9161ff
Instruction ID: bfbea401f5e805aa964d047e210c560e01dbac443728c9f8a1ec31931f0bf540
Opcode Fuzzy Hash: 919d02489e86dee6ee5af8ec1b10f307c7738dff768c3888ddd1a2566d9161ff
Instruction Fuzzy Hash: 577246A2A1C59A81EA35BF1CB404AB9E755AB23790FC4C231DB5E267DCDE3DE540D320

Function 00007FF7BC226558 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7BC2267A7
RaiseException.KERNEL32 ref: 00007FF7BC2267B8

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: b072ad7d98caaf0f51c4c16e5e4e561c34b9f2202122b8ab130ad6c6231e2640
Instruction ID: 6a01a2a292b1328cae0d451fc819b15a61992b76f46106f06ef9f8f1719da937
Opcode Fuzzy Hash: b072ad7d98caaf0f51c4c16e5e4e561c34b9f2202122b8ab130ad6c6231e2640
Instruction Fuzzy Hash: 85B17B73600B898BEB15CF2DC9463A87BA0F745B48F58C921DB9D8B7A8CB39D451C710

Function 00007FF7BC1F6D90 Relevance: 1.7, Strings: 1, Instructions: 483COMMON

Download Yara Rule

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC1F746D

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs
API String ID: 0-3449088094
Opcode ID: 56347dc2f99ceb86dad3b301cc21006c8033dfa34a95fabfed49c5dc476ecc07
Instruction ID: 12fe33324c8d89faa6fe819a329989a28ce68b70b6992d17f0687998b209b025
Opcode Fuzzy Hash: 56347dc2f99ceb86dad3b301cc21006c8033dfa34a95fabfed49c5dc476ecc07
Instruction Fuzzy Hash: 13F15EA2B1C6A941FB50EB29E414BB99755BB22B90FC0C231DF5E17BC8DE3CE5458360

Function 00007FF7BC1F8590 Relevance: 1.7, Strings: 1, Instructions: 422COMMON

Download Yara Rule

Strings

punycode{-}0, xrefs: 00007FF7BC1F8AF9

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID: punycode{-}0
API String ID: 0-2450133883
Opcode ID: 3e65c861ce83e9dffb726d1d5c200b3d5866791d32555dd33f3c3a7af79bc62b
Instruction ID: a9d4dbed571322428a71e53a3e56ccfd4cc338f674d0699dfca498033fc805c6
Opcode Fuzzy Hash: 3e65c861ce83e9dffb726d1d5c200b3d5866791d32555dd33f3c3a7af79bc62b
Instruction Fuzzy Hash: 2DE1E3A2B1874982FB609B1AB44476AA795FBA7790F84C131DF4D13BD8DE3CE445C720

Function 00007FF7BC21EF88 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88d822d1eb0e5264bbe4a530db525bd6adf2d53be2a577bebb393a630bca7bde
Instruction ID: 7c7c15203906e400a013f15b7e0bafb22aabd3d4db05925351776d71ba55f383
Opcode Fuzzy Hash: 88d822d1eb0e5264bbe4a530db525bd6adf2d53be2a577bebb393a630bca7bde
Instruction Fuzzy Hash: 7E51C622B086C145FB20AB7AEC445EABBA1BB56794F948135EF6C67B9DCE3CD401C710

Function 00007FF7BC2233FC Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7BC2234E0

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e28a7900140fc26a6ae33d79343b1e6a32e33cbb80f5f0d38021bc220e0e252d
Instruction ID: db13f74a52c96e81101fef498f79b74e929798396b06067f58250a8a08e175e4
Opcode Fuzzy Hash: e28a7900140fc26a6ae33d79343b1e6a32e33cbb80f5f0d38021bc220e0e252d
Instruction Fuzzy Hash: 37410B7354C2828FD702CF78CC9669D7BB0AB9AF08789D065C7818378AD66CB461EB11

Function 00007FF7BC203400 Relevance: 1.6, Strings: 1, Instructions: 347COMMON

Download Yara Rule

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC203730

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs
API String ID: 0-3449088094
Opcode ID: c86a272cf28a89693941e5c4c77f14062295d8c241ff74f78dc21223008ed3d6
Instruction ID: 772370c33de985a8be86ae9b3558b83d16419c3ad3598358d65ac1463a505819
Opcode Fuzzy Hash: c86a272cf28a89693941e5c4c77f14062295d8c241ff74f78dc21223008ed3d6
Instruction Fuzzy Hash: ECC168D2D0C69604F732AA6C94007F9EB81AB27771FD4D332CB6D177D8CE6C98819628

Function 00007FF7BC210BD0 Relevance: 1.6, Strings: 1, Instructions: 337COMMON

Download Yara Rule

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC211077

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs
API String ID: 0-3449088094
Opcode ID: 4a910e5124cc5774d142c4301eefe1bc09809f402f3e125efb366fb81f041762
Instruction ID: a62acb7e59c3635755b59da25eaeabce003ca6bee6e4c9e7b674e14d353f8aab
Opcode Fuzzy Hash: 4a910e5124cc5774d142c4301eefe1bc09809f402f3e125efb366fb81f041762
Instruction Fuzzy Hash: 91C12852E2CA5241EA796A1DD9022BAE7A1FF66790F80D131DF9F077D8EE7CE5408210

Function 00007FF7BC200790 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC20090C, 00007FF7BC200B3F

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs
API String ID: 0-3449088094
Opcode ID: f1365f076186717028ece41abb6c4e959fb992e67ad3cffbd1342937347f7b29
Instruction ID: dd6cdade22342bf7f728c2960ac15d855a962923e4735c19268ed6608f117161
Opcode Fuzzy Hash: f1365f076186717028ece41abb6c4e959fb992e67ad3cffbd1342937347f7b29
Instruction Fuzzy Hash: A3B13362B1865581FB24DB19E0603F8A760FBA6B94F909232DB9E17BE8CE7DC541C710

Function 00007FF7BC1F7520 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC1F7520

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs
API String ID: 0-3449088094
Opcode ID: 4f8db72c49c6d322292b7ac3bcd7d5c32df27eb22d7aadda318209e1911aeee5
Instruction ID: 3b6f0d5e359755d4b1e63bb38a096bdd9e5e75dc559e62a39d50831154ebb400
Opcode Fuzzy Hash: 4f8db72c49c6d322292b7ac3bcd7d5c32df27eb22d7aadda318209e1911aeee5
Instruction Fuzzy Hash: 4C91EA92E18A9981F610AF1CE0005BDE754FB66B94F949631DF5E23798CB3CE5A2C370

Function 00007FF7BC202FE0 Relevance: 1.4, APIs: 1, Instructions: 199memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(?,?,00000000,00000000,?,?,?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00007FF7BC2098E8), ref: 00007FF7BC20329D

Part of subcall function 00007FF7BC215820: GetProcessHeap.KERNEL32(?,?,?,?,00007FF7BC1FF0AD,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7BC215837

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: bea59ab7aa73efa1988e053b0575dfef5fbd8976b2e41216db2a786c28e8cbb4
Instruction ID: d75a26bf9c5ad22e2ff8c31a275b87b52e57699bfcda218237839e80c1f37027
Opcode Fuzzy Hash: bea59ab7aa73efa1988e053b0575dfef5fbd8976b2e41216db2a786c28e8cbb4
Instruction Fuzzy Hash: C6614452F19A4199FB10A76D98013FDAB60AB2A3A8F84C536DF5D077CACE3C9185C324

Function 00007FF7BC21D5F4 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC21D606

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs
API String ID: 485612231-3449088094
Opcode ID: 89a24ec388c35d2dc06fad72842640dd4d6ed97e04d998712c3fdd2efb5b42c6
Instruction ID: 9cb2be07fe722864f7908ce425d9c28092847bd85488229a58aca2b8dd41882d
Opcode Fuzzy Hash: 89a24ec388c35d2dc06fad72842640dd4d6ed97e04d998712c3fdd2efb5b42c6
Instruction Fuzzy Hash: 1B41E262714A9586EF08DF6EED545A9A3A1AB59FD0F89D032EF0D87B5CDE3CD4428300

Function 00007FF7BC221F64 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7BC221F68

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: e6bfa68522c9155e5f88e8bb28e9840ba8f2d4566d67a69f73464c376a1af0f9
Instruction ID: 53638c30012c22f1b3e8fa00e082e3db1bb009ae06a03342a2eca135622c486f
Opcode Fuzzy Hash: e6bfa68522c9155e5f88e8bb28e9840ba8f2d4566d67a69f73464c376a1af0f9
Instruction Fuzzy Hash: BCB09220E07A06C6EA487B1E6C8A29463A5BFA9B00FC88078C20C44328DF2C20A95720

Function 00007FF7BC203D40 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c790383e15cad51f34c7560ab8a95f83bdedd4d9d4300652b785661bd400b18
Instruction ID: 3f7b0f24b825814ef484d591ddca9f71bb9755ec3fcc2c647ccdb0ebf6f76e8f
Opcode Fuzzy Hash: 5c790383e15cad51f34c7560ab8a95f83bdedd4d9d4300652b785661bd400b18
Instruction Fuzzy Hash: 3CC10422F1C68242FE64A728A5057F9D792AF72784FD4C133DB8D02B9DDE6DE5858320

Function 00007FF7BC1F4350 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c2f911e371cb75a3aed87efc73798c5a5262a6cf790cff90cf4e8e59d67609
Instruction ID: b6c58f17b5c65d2245405479fab5943ba693bfaca7806738f733a4353495c098
Opcode Fuzzy Hash: b6c2f911e371cb75a3aed87efc73798c5a5262a6cf790cff90cf4e8e59d67609
Instruction Fuzzy Hash: 56B179D6F39BEA02E713563C6402AB597005FB77E4A40D322FFE471FE9DB18A6428214

Function 00007FF7BC1FB1F0 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751063ff9f6a74047a4e7670127f2ac16f3fe1ac040384f837d0cd51f658fce5
Instruction ID: 359bf10efe55ea887348bc26c300f42f5489342dddd19f060eb79524c0ecfda8
Opcode Fuzzy Hash: 751063ff9f6a74047a4e7670127f2ac16f3fe1ac040384f837d0cd51f658fce5
Instruction Fuzzy Hash: 21613692E297AA42FB23573D2541B748A505F777A4E44C331EFB9B1FE8DB18E6434200

Function 00007FF7BC2263A0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c811c595791a1cb5b4f61768abb1f32bf8b3410c8abb329994fa25137cd73b50
Instruction ID: cf485fc13ef998f8f5b9c620d976b415055a1023ba56d1ca3acbf6a03c940974
Opcode Fuzzy Hash: c811c595791a1cb5b4f61768abb1f32bf8b3410c8abb329994fa25137cd73b50
Instruction Fuzzy Hash: 85F06871B182558FDBA4AF2CA40266977D0FB58384F84C539DA8D83B18D63C90518F14

Function 00007FF7BC219118 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27bc3559bb755f74a976f4cc487aa3fc0794bc8f385e46cb093bab5210b6f78
Instruction ID: e9b3ba554d462c97c26248a9a1c0ced905cf9172af3a8aa5a0ab6db94a0a4608
Opcode Fuzzy Hash: a27bc3559bb755f74a976f4cc487aa3fc0794bc8f385e46cb093bab5210b6f78
Instruction Fuzzy Hash: 21A0022190CC06D0E604BB0CEC561F0B334EB76330BD08271D66D45A789F3CA8C0CB21

Function 00007FF7BC1F3340 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 257memorysynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7BC215820: GetProcessHeap.KERNEL32(?,?,?,?,00007FF7BC1FF0AD,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7BC215837

CloseHandle.KERNEL32 ref: 00007FF7BC1F34CA
WaitForSingleObject.KERNEL32 ref: 00007FF7BC1F34D8
GetLastError.KERNEL32 ref: 00007FF7BC1F34E2
CloseHandle.KERNEL32 ref: 00007FF7BC1F3523
CloseHandle.KERNEL32 ref: 00007FF7BC1F3528
CloseHandle.KERNEL32 ref: 00007FF7BC1F3534
CloseHandle.KERNEL32 ref: 00007FF7BC1F354A
HeapFree.KERNEL32 ref: 00007FF7BC1F35FE
HeapFree.KERNEL32 ref: 00007FF7BC1F364E
HeapFree.KERNEL32 ref: 00007FF7BC1F3660
HeapFree.KERNEL32 ref: 00007FF7BC1F36AE
HeapFree.KERNEL32 ref: 00007FF7BC1F36C0

Strings

,(><&*@, xrefs: 00007FF7BC1F378B
\pay.exe, xrefs: 00007FF7BC1F3379
ExitStatussrc\lib.rsC:\Windows\Debug\fail.txtwlQYLoPCil3niI7x8CvR9EtNtL/aeaHrZ23LP3fAsJogVTIzdnZ5Pi09ZVeHFkiB[dec] , xrefs: 00007FF7BC1F3719

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: Heap$CloseFreeHandle$ErrorLastObjectProcessSingleWait
String ID: ,(><&*@$ExitStatussrc\lib.rsC:\Windows\Debug\fail.txtwlQYLoPCil3niI7x8CvR9EtNtL/aeaHrZ23LP3fAsJogVTIzdnZ5Pi09ZVeHFkiB[dec] $\pay.exe
API String ID: 2854259727-3544524065
Opcode ID: 22743c575b351dc8129c4d77156beb12b5037d421705670aa851a08fdba761ba
Instruction ID: f4fb1b5ba92961df9442504cab1cf6b1f91943182f470b59eb33bf1f05b454ae
Opcode Fuzzy Hash: 22743c575b351dc8129c4d77156beb12b5037d421705670aa851a08fdba761ba
Instruction Fuzzy Hash: 13C18F7260CB8581E760AB19F4443EAB3A1FB96B94F848135DB8D17BA8CF3CD589C710

Function 00007FF7BC200340 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 202COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,00000001), ref: 00007FF7BC2003B8
WriteConsoleW.KERNEL32(?,00000000,00000000,00000001), ref: 00007FF7BC2003F5
WriteConsoleW.KERNEL32(?,00000000,00000000,00000001), ref: 00007FF7BC200454
GetLastError.KERNEL32(?,00000000,00000000,00000001), ref: 00007FF7BC20045E
GetLastError.KERNEL32(?,00000000,00000000,00000001), ref: 00007FF7BC2004EE

Strings

}0x, xrefs: 00007FF7BC20064F
()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC20054C
Utf8Errorvalid_up_toerror_lenNoneSome, xrefs: 00007FF7BC2005BD

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ConsoleErrorLastWrite$ByteCharMultiWide
String ID: }0x$()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs$Utf8Errorvalid_up_toerror_lenNoneSome
API String ID: 1956605914-1433589378
Opcode ID: 2c8f39181c2a85f3241578f204b3b65764471460f9e593faeafd03aaf6abdb1c
Instruction ID: c04bb1cc2ea5541659d3ab791dadff5c1cb480187f77ae893cecf0adf7f2128a
Opcode Fuzzy Hash: 2c8f39181c2a85f3241578f204b3b65764471460f9e593faeafd03aaf6abdb1c
Instruction Fuzzy Hash: 5B81E872A0864286F724AB19E4503F9E761FBA6790F948136DB8D07B9CDF7CD185C720

Function 00007FF7BC221944 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF7BC221AC0
GetProcAddress.KERNEL32 ref: 00007FF7BC221ACC

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC22195A
ext-ms-, xrefs: 00007FF7BC221A1D
api-ms-, xrefs: 00007FF7BC221A0A

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs$api-ms-$ext-ms-
API String ID: 3013587201-1428261835
Opcode ID: 27854819192bb1e705469596f86641bf1167ab03ea361a23070c21164a03724a
Instruction ID: 9e28a2107608a707c8b3ed2a498826d85ef2b243781bd580992e7f163ab729e3
Opcode Fuzzy Hash: 27854819192bb1e705469596f86641bf1167ab03ea361a23070c21164a03724a
Instruction Fuzzy Hash: FD41E622B1960245EB15EB1EA8409F5A394BF66BE0F89C535DF0D4B78CEE3CE845C360

Function 00007FF7BC2135B0 Relevance: 13.7, APIs: 9, Instructions: 189COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00007FF7BC21368A
GetLastError.KERNEL32 ref: 00007FF7BC2136D0

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: c3114bd37775269af682f2c252222103b554aa250cd46148b11147cdffbc5023
Instruction ID: 9fc5f1ba8fd31801f4ed94a0983e97f4c44a9681e656b0706a78e259252e4fc0
Opcode Fuzzy Hash: c3114bd37775269af682f2c252222103b554aa250cd46148b11147cdffbc5023
Instruction Fuzzy Hash: 80814D22604AC699E731AF29EC017F963A0FB55798F448135DF9D4BB9CCF789286D310

Function 00007FF7BC217A60 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 387COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.KERNEL32 ref: 00007FF7BC217B16
ReleaseSRWLockShared.KERNEL32 ref: 00007FF7BC217B89
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF7BC217FD5

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC217AE9, 00007FF7BC21808A, 00007FF7BC218132
Box<dyn Any><unnamed>, xrefs: 00007FF7BC217ED3
cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs, xrefs: 00007FF7BC217E6E, 00007FF7BC21802F

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs$Box<dyn Any><unnamed>$cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs
API String ID: 546267457-4078811413
Opcode ID: 7913979b8a614973f40d5c4fe42bcbdbbeb8e871fb8e91b831b46dd071c9e552
Instruction ID: bc5706e6b1bed5729e477d8c22d6bbd1d8134c48dadd1f1c089ea78c54f5bf03
Opcode Fuzzy Hash: 7913979b8a614973f40d5c4fe42bcbdbbeb8e871fb8e91b831b46dd071c9e552
Instruction Fuzzy Hash: 46127B22A19B8588EB11EF28D8403E8B7A0FBA6758F848135EF4D07798DF7CE145C360

Function 00007FF7BC21AE98 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7BC21AEF5

Part of subcall function 00007FF7BC21BDF4: __GetUnwindTryBlock.LIBCMT ref: 00007FF7BC21BE37
Part of subcall function 00007FF7BC21BDF4: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7BC21BE5C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7BC21AFCD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7BC21B222
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7BC21B32E

Strings

csm, xrefs: 00007FF7BC21AF76
csm, xrefs: 00007FF7BC21AFF0
csm, xrefs: 00007FF7BC21AF0F

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 4e30c55de0b91dc77b64dbf08deb131f22dc990f80f41aa0cb1b3e4eda5b2450
Instruction ID: 1ce6dce49a892ebfae53383fde1761dc5e5af8e51e7db784365d0daf04fcd2c4
Opcode Fuzzy Hash: 4e30c55de0b91dc77b64dbf08deb131f22dc990f80f41aa0cb1b3e4eda5b2450
Instruction Fuzzy Hash: 37E18276A087418AEB20AF69D8402EDB7B0FB66B98F908135DF4D57B59CF38E191C710

Function 00007FF7BC217C68 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF7BC217D58

Strings

lluf, xrefs: 00007FF7BC217D39
<unnamed>, xrefs: 00007FF7BC217DD2
mluf, xrefs: 00007FF7BC217D30
RUST_BACKTRACEfailed to write the buffered data, xrefs: 00007FF7BC217C6C
cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs, xrefs: 00007FF7BC217E6E

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FreeHeap
String ID: <unnamed>$RUST_BACKTRACEfailed to write the buffered data$cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs$lluf$mluf
API String ID: 3298025750-386205353
Opcode ID: ad4fd9229cbc064930d2eea97f2ef1a141b8a082a1b23fc3ce9959d1092e6d71
Instruction ID: fd8fc10596f14433ccd6ba72aa8aa87d6f559b4dbfac597067bbf222b52963f0
Opcode Fuzzy Hash: ad4fd9229cbc064930d2eea97f2ef1a141b8a082a1b23fc3ce9959d1092e6d71
Instruction Fuzzy Hash: A1618026A09B4289FB11EB28D8503F9B3A1EBA6B44F848036DF4D07798DF2CE505C361

Function 00007FF7BC2130F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 91memorythreadCOMMON

Download Yara Rule

APIs

SetThreadStackGuarantee.KERNEL32 ref: 00007FF7BC213111
GetLastError.KERNEL32 ref: 00007FF7BC21311B
HeapFree.KERNEL32 ref: 00007FF7BC213169
HeapFree.KERNEL32 ref: 00007FF7BC21317B
HeapFree.KERNEL32 ref: 00007FF7BC21322E
HeapFree.KERNEL32 ref: 00007FF7BC213241

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC21319D

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FreeHeap$ErrorGuaranteeLastStackThread
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs
API String ID: 3680998240-3449088094
Opcode ID: ab0d3568aa3cbcf3e3b46fa43bed7482bb2dc37e116a5abeba2f0eeadbdce59c
Instruction ID: d48be243e7c138e631b08c50089f225911784893f3ba85b6e992ad7720ff3c7a
Opcode Fuzzy Hash: ab0d3568aa3cbcf3e3b46fa43bed7482bb2dc37e116a5abeba2f0eeadbdce59c
Instruction Fuzzy Hash: AF41BF72E04A4199E700EBA9EC442EC6771FB9AB14F948535CF1D277A8CF38D586C350

Function 00007FF7BC2053B0 Relevance: 12.2, APIs: 8, Instructions: 187memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7BC200F00: HeapFree.KERNEL32 ref: 00007FF7BC201029

SetLastError.KERNEL32 ref: 00007FF7BC2054EA
GetEnvironmentVariableW.KERNEL32 ref: 00007FF7BC2054FD
GetLastError.KERNEL32 ref: 00007FF7BC20550A
GetLastError.KERNEL32 ref: 00007FF7BC205524
HeapFree.KERNEL32 ref: 00007FF7BC2055B1
HeapFree.KERNEL32 ref: 00007FF7BC2055E9

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ErrorFreeHeapLast$EnvironmentVariable
String ID:
API String ID: 3632352037-0
Opcode ID: bb4f76b3cb8763905ed651b88062100f09515afee3cecab56c85ba32dc11819f
Instruction ID: cb05fdafb1f7ce08325a7e6e7d1d83d0f236ead4536e56a4b382093af1ee124b
Opcode Fuzzy Hash: bb4f76b3cb8763905ed651b88062100f09515afee3cecab56c85ba32dc11819f
Instruction Fuzzy Hash: F081B462A04AC649F731AF69D8043F8A364FB267A8F808132DF5D1B798DF7C9285C314

Function 00007FF7BC1FFED0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 216COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00007FF7BC1FFEFF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00007FF7BC1FFF13
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00007FF7BC1FFF4E
CloseHandle.KERNEL32(?,?,?,?,?), ref: 00007FF7BC20021C

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC20013C
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF7BC20019E

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: Handle$CloseConsoleErrorLastMode
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs$called `Result::unwrap()` on an `Err` value
API String ID: 1170577072-3684545863
Opcode ID: bc3e78dff97b7d666ab68dddaff9203c98874487c4416f027db038d95eaf353b
Instruction ID: 7e3b000bae287245e93a894313c42433542cd7bb4aa13ca82a0c0fae4706416b
Opcode Fuzzy Hash: bc3e78dff97b7d666ab68dddaff9203c98874487c4416f027db038d95eaf353b
Instruction Fuzzy Hash: 2DA1AF22E08B5694FB14AB68E8503FCA760BB26758FC4C532DF5D16789DF7CA189C320

Function 00007FF7BC21C13C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7BC21C3EE,?,?,?,00007FF7BC21C0E0,?,?,00000001,00007FF7BC21A6C9), ref: 00007FF7BC21C1C1
GetLastError.KERNEL32(?,?,?,00007FF7BC21C3EE,?,?,?,00007FF7BC21C0E0,?,?,00000001,00007FF7BC21A6C9), ref: 00007FF7BC21C1CF
LoadLibraryExW.KERNEL32(?,?,?,00007FF7BC21C3EE,?,?,?,00007FF7BC21C0E0,?,?,00000001,00007FF7BC21A6C9), ref: 00007FF7BC21C1F9
FreeLibrary.KERNEL32(?,?,?,00007FF7BC21C3EE,?,?,?,00007FF7BC21C0E0,?,?,00000001,00007FF7BC21A6C9), ref: 00007FF7BC21C23F
GetProcAddress.KERNEL32(?,?,?,00007FF7BC21C3EE,?,?,?,00007FF7BC21C0E0,?,?,00000001,00007FF7BC21A6C9), ref: 00007FF7BC21C24B

Strings

api-ms-, xrefs: 00007FF7BC21C1E1

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: d849d5af33cf5d27236ec855a684fe5224e24a7e688637480540ad7396150497
Instruction ID: cb041d0c7643b626663e0999eee7d32aca9236de7350a8cedf13802c0dc8cd47
Opcode Fuzzy Hash: d849d5af33cf5d27236ec855a684fe5224e24a7e688637480540ad7396150497
Instruction Fuzzy Hash: C631C125B1A64292EA51BB4BEC006F5A398BF66FA0F898135DF5D0B748DE3CE4408324

Function 00007FF7BC21E134 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7BC21E143
FlsGetValue.KERNEL32 ref: 00007FF7BC21E158
FlsSetValue.KERNEL32 ref: 00007FF7BC21E179
FlsSetValue.KERNEL32 ref: 00007FF7BC21E1A6
FlsSetValue.KERNEL32 ref: 00007FF7BC21E1B7
FlsSetValue.KERNEL32 ref: 00007FF7BC21E1C8
SetLastError.KERNEL32 ref: 00007FF7BC21E1E3

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4fe95d4d3905b78d08af88f8e4435670123950fd55690bb86d07bec13c73ceeb
Instruction ID: ef28e3e3b1b717fe460541ffc11f60b24e28154618d77e27f48e8d180965fbef
Opcode Fuzzy Hash: 4fe95d4d3905b78d08af88f8e4435670123950fd55690bb86d07bec13c73ceeb
Instruction Fuzzy Hash: 91216020E0C68245F559B72D9E495F9D3425FA6BF0FD4C634EB3E067CEDE2CA8118221

Function 00007FF7BC225E64 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7BC225E95
GetLastError.KERNEL32 ref: 00007FF7BC225EA1
CloseHandle.KERNEL32 ref: 00007FF7BC225EB9
CreateFileW.KERNEL32 ref: 00007FF7BC225EE4
WriteConsoleW.KERNEL32 ref: 00007FF7BC225F03

Strings

CONOUT$, xrefs: 00007FF7BC225EC5

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: cfe0876a18880eed2b5065f9e4bc5c31461504362fa45e9579eed542a4a1a70f
Instruction ID: f81de149e6cec0abdda08be4ac34ccd1884d6d40eda377d3dec40fe541ba2956
Opcode Fuzzy Hash: cfe0876a18880eed2b5065f9e4bc5c31461504362fa45e9579eed542a4a1a70f
Instruction Fuzzy Hash: EF11DA31718A4586E350AB1AE8443A9E3A0FBAAFE0F848234DF5E47798CF3DD5148754

Function 00007FF7BC1FE4D0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7BC1FE4DD
GetProcAddress.KERNEL32 ref: 00007FF7BC1FE4F5
GetProcAddress.KERNEL32 ref: 00007FF7BC1FE50D

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 00007FF7BC1FE4D6
WakeByAddressSingle, xrefs: 00007FF7BC1FE503
WaitOnAddress, xrefs: 00007FF7BC1FE4EB

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: WaitOnAddress$WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 667068680-1826242509
Opcode ID: a929de60061fe27fb78bc8b6119db4c2cdbd057ea0e36910b7ddfbe7c18c880d
Instruction ID: b569085468b113bbc767d2efcbc4bc33609b0325add142a725c12a44cfd64d2c
Opcode Fuzzy Hash: a929de60061fe27fb78bc8b6119db4c2cdbd057ea0e36910b7ddfbe7c18c880d
Instruction Fuzzy Hash: 76F05E24A0E65A82FD15BB09B9441F4A3A46F66B80FC4C034CF0C0A368FF6CB559C220

Function 00007FF7BC2136FE Relevance: 9.1, APIs: 6, Instructions: 104fileCOMMON

Download Yara Rule

APIs

WriteFileEx.KERNEL32 ref: 00007FF7BC213803
SleepEx.KERNEL32 ref: 00007FF7BC21382A
GetLastError.KERNEL32 ref: 00007FF7BC21399C
CloseHandle.KERNEL32 ref: 00007FF7BC2139D6
CloseHandle.KERNEL32 ref: 00007FF7BC2139DF
CloseHandle.KERNEL32 ref: 00007FF7BC213A7F
CloseHandle.KERNEL32 ref: 00007FF7BC213A88

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: CloseHandle$ErrorFileLastSleepWrite
String ID:
API String ID: 3761358819-0
Opcode ID: 3db292af499a8d9b18f179c301415b2cf4b4f4a6c249e98091d7b32f2ca36ebc
Instruction ID: 7195cf002e7226aebc4bf4970e081f59a03e13ff3432b8a8b42ab030c91aaf23
Opcode Fuzzy Hash: 3db292af499a8d9b18f179c301415b2cf4b4f4a6c249e98091d7b32f2ca36ebc
Instruction Fuzzy Hash: 01418422A089C684E731AF29EC017F96761FB55798F448132DF4C1BB9CCF389596D310

Function 00007FF7BC21E2AC Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7BC21E95D,?,?,?,?,00007FF7BC21D3D8,?,?,?,?,00007FF7BC21890C), ref: 00007FF7BC21E2BB
FlsSetValue.KERNEL32(?,?,?,00007FF7BC21E95D,?,?,?,?,00007FF7BC21D3D8,?,?,?,?,00007FF7BC21890C), ref: 00007FF7BC21E2F1
FlsSetValue.KERNEL32(?,?,?,00007FF7BC21E95D,?,?,?,?,00007FF7BC21D3D8,?,?,?,?,00007FF7BC21890C), ref: 00007FF7BC21E31E
FlsSetValue.KERNEL32(?,?,?,00007FF7BC21E95D,?,?,?,?,00007FF7BC21D3D8,?,?,?,?,00007FF7BC21890C), ref: 00007FF7BC21E32F
FlsSetValue.KERNEL32(?,?,?,00007FF7BC21E95D,?,?,?,?,00007FF7BC21D3D8,?,?,?,?,00007FF7BC21890C), ref: 00007FF7BC21E340
SetLastError.KERNEL32(?,?,?,00007FF7BC21E95D,?,?,?,?,00007FF7BC21D3D8,?,?,?,?,00007FF7BC21890C), ref: 00007FF7BC21E35B

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 67955062e48bf263f98f707bfd5dccc33806f6317d67472e428eac5be223accd
Instruction ID: f5b7a020aebc7c4ffc1690ea8243f03cdc83fcf99cbd8dfcdabd2d6a09e4d3aa
Opcode Fuzzy Hash: 67955062e48bf263f98f707bfd5dccc33806f6317d67472e428eac5be223accd
Instruction Fuzzy Hash: C8114C20A0C68241F658B7299E591F993425FAB7B0FD4C634EB3E167CEDE2CA4114221

Function 00007FF7BC21A4C8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7BC21A4F3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7BC21A588
RtlUnwindEx.KERNEL32 ref: 00007FF7BC21A5D7

Strings

csm, xrefs: 00007FF7BC21A56E
f, xrefs: 00007FF7BC21A506

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: d0c4db7e466bca9918b2fe5c0fce57947247f9530faf3c6b1cfe8640c0ebe1be
Instruction ID: 978dc7bcb5b3c4a670b7f1dcaf6e8e3fcffdc939ff8da30e8f5640b81291906d
Opcode Fuzzy Hash: d0c4db7e466bca9918b2fe5c0fce57947247f9530faf3c6b1cfe8640c0ebe1be
Instruction Fuzzy Hash: B051C232B09642CAEB15EF19D840AA9B395FF62B98FA1C130DB1E4774CDF38E8408710

Function 00007FF7BC1FF990 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7BC1FF986), ref: 00007FF7BC1FFA2C
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7BC1FF986), ref: 00007FF7BC1FFAE3
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7BC1FF986), ref: 00007FF7BC1FFB24
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7BC1FF986), ref: 00007FF7BC1FFB78

Strings

lock count overflow in reentrant mutexlibrary\std\src\sync\remutex.rs, xrefs: 00007FF7BC1FFA0D

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap
String ID: lock count overflow in reentrant mutexlibrary\std\src\sync\remutex.rs
API String ID: 2563869513-2303981482
Opcode ID: 57a2554a40511ac4daf8159f8b3a5940003af9393d545a9423a3ab4ae8f18c02
Instruction ID: cd3fe82487685946876e3404f3da566d2aaf71eb2ee12477f2c1641d74fbd3f2
Opcode Fuzzy Hash: 57a2554a40511ac4daf8159f8b3a5940003af9393d545a9423a3ab4ae8f18c02
Instruction Fuzzy Hash: B7515961E1CA4698F700FB2CE8403F8A3A4ABB6B14FC48131CB5D567A9CF7CA595C360

Function 00007FF7BC1FF2D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7BC1FF35B
GetProcAddress.KERNEL32 ref: 00007FF7BC1FF370

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC1FF2F5
ntdll, xrefs: 00007FF7BC1FF354
NtCreateKeyedEvent, xrefs: 00007FF7BC1FF366

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs$NtCreateKeyedEvent$ntdll
API String ID: 1646373207-3469080096
Opcode ID: 8af669f8dbe2c5dfc59aceefb7fe7c3aa4c9ada6e237ab79abc9066fa44c08a8
Instruction ID: 6357497514333019a32b7cda09c96d5e7f273e90265d104a6d9b4a6e56c7dcb0
Opcode Fuzzy Hash: 8af669f8dbe2c5dfc59aceefb7fe7c3aa4c9ada6e237ab79abc9066fa44c08a8
Instruction Fuzzy Hash: 6911B422F19B0998EB00EB59F8806E4A364BB6A750FC4C235DF1C167A8EF7C9585C310

Function 00007FF7BC21D2C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7BC21D2E5
GetProcAddress.KERNEL32 ref: 00007FF7BC21D2FB
FreeLibrary.KERNEL32 ref: 00007FF7BC21D322

Strings

CorExitProcess, xrefs: 00007FF7BC21D2F4
mscoree.dll, xrefs: 00007FF7BC21D2DC

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0d13557986f02a0bff807fb49ceb4b6ee4d0b3276596377211a1255dbd02131c
Instruction ID: 1dfba36b94c0bce8d095c5c7d1c6869b8af07c4b513430481dd338cdb0cde33f
Opcode Fuzzy Hash: 0d13557986f02a0bff807fb49ceb4b6ee4d0b3276596377211a1255dbd02131c
Instruction Fuzzy Hash: C5F04F21A0864681EA14AB2CE8453B9A320BFA6761FD48236DB6D4A3E8CF2CD044C730

Function 00007FF7BC2261B4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7BC2261DC
_set_statfp.LIBCMT ref: 00007FF7BC2261F7
_set_statfp.LIBCMT ref: 00007FF7BC226213
_set_statfp.LIBCMT ref: 00007FF7BC22624F

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: beec5400c6c041fc0fbe7d974327d44f3546951e09f86d00f430d633a5191c08
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 5C119023E4CA1281F764356CD6453F59240AF76374EC88734E76E0E3EF8E6CA8418120

Function 00007FF7BC21E374 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7BC21E4DB,?,?,00000000,00007FF7BC21E776,?,?,?,?,?,00007FF7BC21E702), ref: 00007FF7BC21E393
FlsSetValue.KERNEL32(?,?,?,00007FF7BC21E4DB,?,?,00000000,00007FF7BC21E776,?,?,?,?,?,00007FF7BC21E702), ref: 00007FF7BC21E3B2
FlsSetValue.KERNEL32(?,?,?,00007FF7BC21E4DB,?,?,00000000,00007FF7BC21E776,?,?,?,?,?,00007FF7BC21E702), ref: 00007FF7BC21E3DA
FlsSetValue.KERNEL32(?,?,?,00007FF7BC21E4DB,?,?,00000000,00007FF7BC21E776,?,?,?,?,?,00007FF7BC21E702), ref: 00007FF7BC21E3EB
FlsSetValue.KERNEL32(?,?,?,00007FF7BC21E4DB,?,?,00000000,00007FF7BC21E776,?,?,?,?,?,00007FF7BC21E702), ref: 00007FF7BC21E3FC

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 0710a204add404583144b8574cef90928c15d834f179e5606aedd2138e741efe
Instruction ID: 6d01ec8f6e3a670ab07c058d53801faa8ff500fcc6a6ff955ed1311b9cb59162
Opcode Fuzzy Hash: 0710a204add404583144b8574cef90928c15d834f179e5606aedd2138e741efe
Instruction Fuzzy Hash: B3114D20E0C28241FA59B72A9E451F993425FA67F0E94C234EB2D567DDDE2CE8524221

Function 00007FF7BC21E208 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7BC21E219
FlsSetValue.KERNEL32 ref: 00007FF7BC21E238
FlsSetValue.KERNEL32 ref: 00007FF7BC21E260
FlsSetValue.KERNEL32 ref: 00007FF7BC21E271
FlsSetValue.KERNEL32 ref: 00007FF7BC21E282

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c19338286669fd7890b81c4e32f339c25c8031f1638704835a7fb2fbd58c78a3
Instruction ID: c559823fcaf734e19e51209697bff4e2ed32720ba48eadd033f980184b770b56
Opcode Fuzzy Hash: c19338286669fd7890b81c4e32f339c25c8031f1638704835a7fb2fbd58c78a3
Instruction Fuzzy Hash: A9113614E0C24345F959B7698D2A5F993420FA77B0ED48734EB3E0A3CAED2CB8118222

Function 00007FF7BC211143 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7BC211145
GetLastError.KERNEL32 ref: 00007FF7BC211161
GetCurrentProcess.KERNEL32 ref: 00007FF7BC2112EE
DuplicateHandle.KERNEL32 ref: 00007FF7BC211319
GetLastError.KERNEL32 ref: 00007FF7BC211329

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ErrorHandleLast$CurrentDuplicateProcess
String ID:
API String ID: 3697983210-0
Opcode ID: a707c001ef8fc5e6b2a769b1592f268f80d4b5a40cdf2ab2fde69c3731988af0
Instruction ID: db5782822d252c1be4cc9d270ecc3e6f0c1647691aa89be2792781c9e3acb6c6
Opcode Fuzzy Hash: a707c001ef8fc5e6b2a769b1592f268f80d4b5a40cdf2ab2fde69c3731988af0
Instruction Fuzzy Hash: 1C118221A0865585FB20BBA9F8493FDA360AB267A4F848635DF2E467C8CF7D9055C360

Function 00007FF7BC215780 Relevance: 7.5, APIs: 5, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

TerminateProcess.KERNEL32 ref: 00007FF7BC21578E
GetLastError.KERNEL32 ref: 00007FF7BC21579C
WaitForSingleObject.KERNEL32 ref: 00007FF7BC2157AE
GetLastError.KERNEL32 ref: 00007FF7BC2157DB

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ErrorLast$ObjectProcessSingleTerminateWait
String ID:
API String ID: 536955195-0
Opcode ID: b06682182554f1d77a9b201431c6783ec3460f533654e893d6b5785a88925550
Instruction ID: 214821b8cec2ec6b4cd71bd08df3223d34c5c14957bcb308cb3a6cdb09804b4e
Opcode Fuzzy Hash: b06682182554f1d77a9b201431c6783ec3460f533654e893d6b5785a88925550
Instruction Fuzzy Hash: F7019620E1850681F760BB2DE8462F9D3919FA6B90FD08170CA4E4679CDE2CD486C730

Function 00007FF7BC21B370 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7BC21B3BC
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7BC21B40B

Strings

MOC, xrefs: 00007FF7BC21B3D0
RCC, xrefs: 00007FF7BC21B3D9

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 35b0e96caac7321839730969dc3ae66b295e26b62928a05a88648b484be64640
Instruction ID: d7ef4bbf04232634f475ff0e0a1027a4d56918302a94c1b8ed9776b0572e246d
Opcode Fuzzy Hash: 35b0e96caac7321839730969dc3ae66b295e26b62928a05a88648b484be64640
Instruction Fuzzy Hash: 53617B76A08A458AEB10EF69E8403EDB7B0FB55B88F448225EF4D17B99CF78E145C710

Function 00007FF7BC21B6CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7BC21B6F4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7BC21B7DC

Strings

csm, xrefs: 00007FF7BC21B716
csm, xrefs: 00007FF7BC21B82E

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 503667ffc01cbe35b3a27d909b320673403a8951783089335a5ca17b21e53f36
Instruction ID: b892395a21075d47df70745112654fc23f2188e20417e8b21cfecdd7387fd8c9
Opcode Fuzzy Hash: 503667ffc01cbe35b3a27d909b320673403a8951783089335a5ca17b21e53f36
Instruction Fuzzy Hash: D451C37A90824186EB34AF29D8443A9B7A0FB62F94F958135DB5C47BD9CF3CE451C710

Function 00007FF7BC1FF200 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7BC1FF27C
GetProcAddress.KERNEL32 ref: 00007FF7BC1FF291

Strings

NtWaitForKeyedEvent, xrefs: 00007FF7BC1FF287
ntdll, xrefs: 00007FF7BC1FF275

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 1646373207-2815205136
Opcode ID: 8f065e93f007aaf045e29141d6bb34a5b78a247f85a89a50bc01e2ce17672e55
Instruction ID: 41f3d16c1c57d0ce92c52c4beb01f567676737a6f55cad12cfc8f8654147b328
Opcode Fuzzy Hash: 8f065e93f007aaf045e29141d6bb34a5b78a247f85a89a50bc01e2ce17672e55
Instruction Fuzzy Hash: 0A11B921A18B4591EA10EB09F840395E7A4FFA5784FC08135EF8D57B68EF7CD545C710

Function 00007FF7BC1FF650 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7BC1FF66C
GetProcAddress.KERNEL32 ref: 00007FF7BC1FF681

Strings

ntdll, xrefs: 00007FF7BC1FF665
NtReleaseKeyedEvent, xrefs: 00007FF7BC1FF677

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: 9aba7d101d3a49aca37f8cb9c45d9598934dbe9e6ebb36da2264a44d70f7e170
Instruction ID: 3e92039c07a9a7d0c90349898d591f2a87f273f161e348da72073078ec880487
Opcode Fuzzy Hash: 9aba7d101d3a49aca37f8cb9c45d9598934dbe9e6ebb36da2264a44d70f7e170
Instruction Fuzzy Hash: 7DF08250B0961950E915EB0BBC819A4D3A47F6ABD1FC4C435CE0C57778EE7CA546C310

Function 00007FF7BC2010D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7BC2010E3
GetProcAddress.KERNEL32 ref: 00007FF7BC2010F8

Strings

kernel32, xrefs: 00007FF7BC2010DC
SetThreadDescription, xrefs: 00007FF7BC2010EE

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: 7f6e083fe5b4a8fad8fd13f0e868e29969a0c1481af2f33aed203f5cc6ffa33d
Instruction ID: 5add9b09110b0ff0d99c7e8cd0e4ba78bde2daea84573943bd71adc34d3b7dd3
Opcode Fuzzy Hash: 7f6e083fe5b4a8fad8fd13f0e868e29969a0c1481af2f33aed203f5cc6ffa33d
Instruction Fuzzy Hash: 7CE06510F0960541FD09BB0DAC841E0D3606F7ABD1BC4C036CE0C17768EE6CA54AC320

Function 00007FF7BC223EB8 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7BC223F37
WriteFile.KERNEL32 ref: 00007FF7BC2241FF
WriteFile.KERNEL32 ref: 00007FF7BC224245
GetLastError.KERNEL32 ref: 00007FF7BC2242FB

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 57c5a4d5ddb0c8c2a0012b8ff27468da82cd1945dc0ad48b72b5bf65e989f06c
Instruction ID: 93828a384681eea18abd0e3f28130768cb63fb5d248d3d99ea5c1502e20867ff
Opcode Fuzzy Hash: 57c5a4d5ddb0c8c2a0012b8ff27468da82cd1945dc0ad48b72b5bf65e989f06c
Instruction Fuzzy Hash: 31D11632B086818AEB10DF69D4402ECB7B5FB65798B908236CF5D5BB9DDE38E406C310

Function 00007FF7BC2247E0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7BC2247CB,00000000), ref: 00007FF7BC2248FC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7BC2247CB,00000000), ref: 00007FF7BC224987

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 835e2de12b0829f99cc6f531b9e23aec45acd53e2205226898b4ce0687045bef
Instruction ID: 92086efd091d225c869b0295ba2dad4bc1e92fae4f96e81a75a51b2e5f9f7950
Opcode Fuzzy Hash: 835e2de12b0829f99cc6f531b9e23aec45acd53e2205226898b4ce0687045bef
Instruction Fuzzy Hash: 0091B532E1865186FB50EF6D94502FDABA0FB66788F948135DF4E6A78CCE38D441C724

Function 00007FF7BC21372A Relevance: 6.1, APIs: 4, Instructions: 87fileCOMMON

Download Yara Rule

APIs

WriteFileEx.KERNEL32 ref: 00007FF7BC213803
SleepEx.KERNEL32 ref: 00007FF7BC21382A
GetLastError.KERNEL32 ref: 00007FF7BC21399C
CloseHandle.KERNEL32 ref: 00007FF7BC2139D6
CloseHandle.KERNEL32 ref: 00007FF7BC2139DF
CloseHandle.KERNEL32 ref: 00007FF7BC213A7F
CloseHandle.KERNEL32 ref: 00007FF7BC213A88

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: CloseHandle$ErrorFileLastSleepWrite
String ID:
API String ID: 3761358819-0
Opcode ID: c85bc528515be8f4e142057ec52bf39f317eb3bd0c1efe5fcc62ec3a48194a26
Instruction ID: cc7b9b5c4a2ee9a4ad1a8c28b63729dab5389ae5de18b863182fe5b8b49834da
Opcode Fuzzy Hash: c85bc528515be8f4e142057ec52bf39f317eb3bd0c1efe5fcc62ec3a48194a26
Instruction Fuzzy Hash: 0731B222A08AC688E731AF29DC057F967A1FB55798F448132DF4C1BB9CCF389186D710

Function 00007FF7BC213754 Relevance: 6.1, APIs: 4, Instructions: 85fileCOMMON

Download Yara Rule

APIs

WriteFileEx.KERNEL32 ref: 00007FF7BC213803
SleepEx.KERNEL32 ref: 00007FF7BC21382A
GetLastError.KERNEL32 ref: 00007FF7BC21399C
CloseHandle.KERNEL32 ref: 00007FF7BC2139D6
CloseHandle.KERNEL32 ref: 00007FF7BC2139DF
CloseHandle.KERNEL32 ref: 00007FF7BC213A7F
CloseHandle.KERNEL32 ref: 00007FF7BC213A88

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: CloseHandle$ErrorFileLastSleepWrite
String ID:
API String ID: 3761358819-0
Opcode ID: c7d7a8c47848d60bb537140da09670ae25f7c1c2b7c0eba6cfab248e6fafe539
Instruction ID: 024c368ecf3cdf1cd71737e4e49edc957393b664002b017e8a0d28ecc57d5923
Opcode Fuzzy Hash: c7d7a8c47848d60bb537140da09670ae25f7c1c2b7c0eba6cfab248e6fafe539
Instruction Fuzzy Hash: ED31A222A08AC688E731AF29DC057F967A1FB55798F448131DF8C1BB9CCF389196D714

Function 00007FF7BC213758 Relevance: 6.1, APIs: 4, Instructions: 84fileCOMMON

Download Yara Rule

APIs

WriteFileEx.KERNEL32 ref: 00007FF7BC213803
SleepEx.KERNEL32 ref: 00007FF7BC21382A
GetLastError.KERNEL32 ref: 00007FF7BC21399C
CloseHandle.KERNEL32 ref: 00007FF7BC2139D6
CloseHandle.KERNEL32 ref: 00007FF7BC2139DF
CloseHandle.KERNEL32 ref: 00007FF7BC213A7F
CloseHandle.KERNEL32 ref: 00007FF7BC213A88

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: CloseHandle$ErrorFileLastSleepWrite
String ID:
API String ID: 3761358819-0
Opcode ID: 75e1caeaa96a27c15c4cf29abbe83e3d1b8fe70e64608befafb32cf3dc960c3c
Instruction ID: b1bf8991b81c4f7277c57a0fbd50f9e7dcab463b23aa09f6e540b78ad4227718
Opcode Fuzzy Hash: 75e1caeaa96a27c15c4cf29abbe83e3d1b8fe70e64608befafb32cf3dc960c3c
Instruction Fuzzy Hash: 5531AF22A08AC688E731AF29DC047F967A1FB55798F448131DE8C1BB9CCF389286D710

Function 00007FF7BC21FFB4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7BC21F910: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,00007FF7BC21FC4C), ref: 00007FF7BC21F93A

IsValidCodePage.KERNEL32(?,?,()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs,00000001,?,00000000,?,00007FF7BC21FD7D), ref: 00007FF7BC220021
GetCPInfo.KERNEL32(?,?,()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs,00000001,?,00000000,?,00007FF7BC21FD7D), ref: 00007FF7BC220065

Strings

()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC21FFC4

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs
API String ID: 546120528-3449088094
Opcode ID: 4ad679a0ec5e930f58c604e91c648edc90627324575f535735a95d3dcbb7e775
Instruction ID: a18e1c5c4830912b7d5d8b8fe6d46a8602d4a76536b16468614ab5baee310685
Opcode Fuzzy Hash: 4ad679a0ec5e930f58c604e91c648edc90627324575f535735a95d3dcbb7e775
Instruction Fuzzy Hash: 6681C472A0868286F768AF1D94401F9F7A1EB66740FC4C136CB9E4B798DE3DE545C720

Function 00007FF7BC21CAD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7BC21CB02

Part of subcall function 00007FF7BC21E9EC: HeapFree.KERNEL32(?,?,?,00007FF7BC22122A,?,?,?,00007FF7BC221267,?,?,00000000,00007FF7BC22178D,?,?,FFFFFFFE,00007FF7BC2216BF), ref: 00007FF7BC21EA02
Part of subcall function 00007FF7BC21E9EC: GetLastError.KERNEL32(?,?,?,00007FF7BC22122A,?,?,?,00007FF7BC221267,?,?,00000000,00007FF7BC22178D,?,?,FFFFFFFE,00007FF7BC2216BF), ref: 00007FF7BC21EA0C

Strings

C:\Users\user\Desktop\fxc.exe, xrefs: 00007FF7BC21CB13
()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs, xrefs: 00007FF7BC21CADA

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ErrorFreeHeapLast_invalid_parameter_noinfo
String ID: ()/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\str\pattern.rs$C:\Users\user\Desktop\fxc.exe
API String ID: 2724796048-1783189390
Opcode ID: 145c55661eab690a821310d1bea06efac10a14fa46ffae3c36c9229ac4bded4c
Instruction ID: 7df65f56de13b6f28c46b4dd216dfaab86434071c894f174e9f868b9252d505d
Opcode Fuzzy Hash: 145c55661eab690a821310d1bea06efac10a14fa46ffae3c36c9229ac4bded4c
Instruction Fuzzy Hash: A5415F36A08B5285E754FF2EDC810FCA794AB66794B948035EB8E43B89DE3CE5518320

Function 00007FF7BC217CD8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

ReleaseSRWLockShared.KERNEL32 ref: 00007FF7BC217B89
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF7BC217FD5

Strings

<unnamed>, xrefs: 00007FF7BC217DD2
cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs, xrefs: 00007FF7BC217E6E

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: LockRelease$ExclusiveShared
String ID: <unnamed>$cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs
API String ID: 279184637-616897820
Opcode ID: 819ee0de80142f7b42e4f6a09428c92a38e4975cba76368b54aff0cbf535c805
Instruction ID: b7775016fb21e12fddd163eaf413b18f010a08469c11a00a298e2e796ffa29ea
Opcode Fuzzy Hash: 819ee0de80142f7b42e4f6a09428c92a38e4975cba76368b54aff0cbf535c805
Instruction Fuzzy Hash: 90515C25A09B4188EB11AF28D8503F9B7A4EBAAB98F848032DF4D03759DF3CE505C360

Function 00007FF7BC217CE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

ReleaseSRWLockShared.KERNEL32 ref: 00007FF7BC217B89
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF7BC217FD5

Strings

<unnamed>, xrefs: 00007FF7BC217DD2
cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs, xrefs: 00007FF7BC217E6E

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: LockRelease$ExclusiveShared
String ID: <unnamed>$cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs
API String ID: 279184637-616897820
Opcode ID: 3853aad5fb1508a667e4b2bc62b596613128215376ec651538d725a432014f97
Instruction ID: 7fe3218ccfcb42123f2ab8bafd43cea97521785693d0f5bc3138c1bb7223d6b6
Opcode Fuzzy Hash: 3853aad5fb1508a667e4b2bc62b596613128215376ec651538d725a432014f97
Instruction Fuzzy Hash: 71513C25A09B4189EB51AF28D8502F9B7A4EBAAB98F948032DF4D03759DF3CE545C360

Function 00007FF7BC224550 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7BC224667
GetLastError.KERNEL32 ref: 00007FF7BC224689

Strings

U, xrefs: 00007FF7BC224613

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: e4e6fb404c3c47e4c650737dd0576a2508adeee33a755ed0e4052ca8837e072a
Instruction ID: bb461aceaf78ccc07b79d4ffad4ac274dfeb6e8ba9e2093a43cbf2e9f1f58198
Opcode Fuzzy Hash: e4e6fb404c3c47e4c650737dd0576a2508adeee33a755ed0e4052ca8837e072a
Instruction Fuzzy Hash: 6041B362618A4186EB20AF29E4447F9B7A0FBA9794F818131EF4D8B758DF3CD445C750

Function 00007FF7BC21C5E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7BC21C630
RaiseException.KERNEL32 ref: 00007FF7BC21C671

Strings

csm, xrefs: 00007FF7BC21C65E

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: bb960c809cbb2dab76c1b40bd6011a697851df4bac8c04083f6bca4eb3472f56
Instruction ID: 0b877ef8bd15f28f47b92ddf76d0c277e930509109f6063f371ce5d3b217b9d7
Opcode Fuzzy Hash: bb960c809cbb2dab76c1b40bd6011a697851df4bac8c04083f6bca4eb3472f56
Instruction Fuzzy Hash: 07115E36608B8482EB209B19E840299B7E4FB99B94F588230DFCD0775CDF3CD5518700

Function 00007FF7BC207A8A Relevance: 5.2, APIs: 4, Instructions: 205memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF7BC208056
HeapFree.KERNEL32 ref: 00007FF7BC208070

Memory Dump Source

Source File: 00000000.00000002.1824570649.00007FF7BC1F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7BC1F0000, based on PE: true

Associated: 00000000.00000002.1824558619.00007FF7BC1F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824592978.00007FF7BC229000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824610189.00007FF7BC23D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824622439.00007FF7BC23F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7bc1f0000_fxc.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 8542b6887c440662ea1a5174381c6ddcac829784b0b3aa166601a1f08894c0ec
Instruction ID: b253c7f8b2f783e305059a8df64096dccbb88f1c5c7bda98ae833033f0ca7de5
Opcode Fuzzy Hash: 8542b6887c440662ea1a5174381c6ddcac829784b0b3aa166601a1f08894c0ec
Instruction Fuzzy Hash: 76A16F22E08BC589F721DF29D8443F967A1FB66788F859132DB8D0A759DF38E585C310

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fxc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fxc.exe_d5c59118b01e5ac2e9fe2cdeb3cf1adce977e24e_6f60c9ae_8b4724b5-c86e-4711-b290-a9b5b2b0ec6d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER70B6.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7105.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7135.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\debug\fail.txt

C:\Windows\debug\stop.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Windows Analysis Report
fxc.exe

Function 00007FF7BC1F12D0 Relevance: 72.3, APIs: 35, Strings: 6, Instructions: 595
memorysynchronizationtimeCOMMON

Function 00007FF7BC1F1D30 Relevance: 53.2, APIs: 28, Strings: 2, Instructions: 663
memoryfilenativeCOMMON

Function 00007FF7BC2085E0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 191
filememoryCOMMON

Function 00007FF7BC201B10 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 378
windowCOMMON

Function 00007FF7BC200230 Relevance: 4.6, APIs: 3, Instructions: 66
filenativesynchronizationCOMMON

Function 00007FF7BC206A00 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 173
memoryCOMMON

Function 00007FF7BC1F2920 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 139
memoryCOMMON

Function 00007FF7BC1F1010 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 128
threadCOMMON

Function 00007FF7BC2187E0 Relevance: 6.1, APIs: 4, Instructions: 54
memoryfileCOMMON

Function 00007FF7BC2189D4 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Function 00007FF7BC201611 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 80
memoryCOMMON

Function 00007FF7BC1FE830 Relevance: 4.5, APIs: 3, Instructions: 38
threadmemoryCOMMON

Function 00007FF7BC1F3B90 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 120
memoryCOMMON

Function 00007FF7BC2073F0 Relevance: 2.6, APIs: 2, Instructions: 105
COMMON