Edit tour

Windows Analysis Report
ZJGkxGuyIT.dll

Overview

General Information

Sample name:	ZJGkxGuyIT.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original sample name:	2ebf32f4a6b63b8dad4dac4bddf1cbee.exe
Analysis ID:	1542665
MD5:	2ebf32f4a6b63b8dad4dac4bddf1cbee
SHA1:	8b9f7739a9a64168b50d3bde17c8e8ee1127671c
SHA256:	fde4f048bb013ec3caabbe5862dcb8df0f701659bc9ac04e5bb1c5a3eee58b61
Tags:	64exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Hijacks the control flow in another process

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Conhost Spawned By Uncommon Parent Process

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6556 cmdline: loaddll64.exe "C:\Users\user\Desktop\ZJGkxGuyIT.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 6576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6696 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ZJGkxGuyIT.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 6772 cmdline: rundll32.exe "C:\Users\user\Desktop\ZJGkxGuyIT.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 3004 cmdline: C:\Windows\system32\WerFault.exe -u -p 6772 -s 400 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

regsvr32.exe (PID: 6720 cmdline: regsvr32.exe /i /s C:\Users\user\Desktop\ZJGkxGuyIT.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

WerFault.exe (PID: 8 cmdline: C:\Windows\system32\WerFault.exe -u -p 6720 -s 452 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 6796 cmdline: rundll32.exe C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllInstall MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6976 cmdline: C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllInstall 2580 MD5: EF3179D498793BF4234F708D3BE28633)

conhost.exe (PID: 5804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 3912 cmdline: rundll32.exe C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllRegisterServer MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6220 cmdline: C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllRegisterServer 6976 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4412 cmdline: rundll32.exe C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllUnregisterServer MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6296 cmdline: C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllUnregisterServer 6220 MD5: EF3179D498793BF4234F708D3BE28633)

loaddll64.exe (PID: 5804 cmdline: C:\Windows\system32\loaddll64.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll 6296 MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

cleanup

Sigma Signatures

Sigma detected: Conhost Spawned By Uncommon Parent Process

Source: Process started

Author: Tim Rauch: Data: Command: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine|base64offset|contains: }}, Image: C:\Windows\System32\conhost.exe, NewProcessName: C:\Windows\System32\conhost.exe, OriginalFileName: C:\Windows\System32\conhost.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllInstall, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 6796, ParentProcessName: rundll32.exe, ProcessCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ProcessId: 5804, ProcessName: conhost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ZJGkxGuyIT.dll

Virustotal: Detection: 10%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: ZJGkxGuyIT.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ntdll.pdb source: loaddll64.exe, 00000000.00000002.1792371427.000001FFB8B09000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1793567365.000001FFB930D000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1792792121.000001FFB8F05000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1793330361.000001FFB910A000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1793771115.000001FFB9502000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1792577894.000001FFB8D06000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911803970.00000000036CA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911968562.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911605994.00000000034C6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911359478.00000000032C9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1910092977.0000000002EC2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1910526205.00000000030CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895201861.00000196F17B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895523151.00000196F1BB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895033928.00000196F15B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895364557.00000196F19BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1894645590.00000196F11B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1894832789.00000196F13BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1786543077.00000234B9309000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1787336671.00000234B9D06000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1786878245.00000234B970F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1787187145.00000234B9B0B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1787018729.00000234B990F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1786732122.00000234B9508000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1843129716.000002542840F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1842592948.0000025428008000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1842829424.000002542820D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1841796861.0000025427A07000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1842228317.0000025427E0F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000
Source:	Binary string: ntdll.pdbUGP source: loaddll64.exe, 00000000.00000002.1792371427.000001FFB8B09000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1793567365.000001FFB930D000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1792792121.000001FFB8F05000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1793330361.000001FFB910A000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1793771115.000001FFB9502000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1792577894.000001FFB8D06000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911803970.00000000036CA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911968562.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911605994.00000000034C6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911359478.00000000032C9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1910092977.0000000002EC2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1910526205.00000000030CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895201861.00000196F17B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895523151.00000196F1BB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895033928.00000196F15B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895364557.00000196F19BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1894645590.00000196F11B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1894832789.00000196F13BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1786543077.00000234B9309000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1787336671.00000234B9D06000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1786878245.00000234B970F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1787187145.00000234B9B0B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1787018729.00000234B990F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1786732122.00000234B9508000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1843129716.000002542840F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1842592948.0000025428008000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1842829424.000002542820D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1841796861.0000025427A07000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1842228317.0000025427E0F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0

Source: Amcache.hve.10.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E14D520 HeapCreate,VirtualProtect,LoadLibraryA,GetProcAddress,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,ResumeThread,exit,Sleep,memcpy,CoInitialize,SafeArrayCreate,SafeArrayPutElement,	0_2_00007FFE0E14D520
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E146D40 memcpy,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,fwrite,fflush,	0_2_00007FFE0E146D40
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000027B70B51B10 NtProtectVirtualMemory,NtCreateSection,	6_2_0000027B70B51B10
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000027B70B51BA8 NtCreateSection,	6_2_0000027B70B51BA8
Source: C:\Windows\System32\rundll32.exe	Code function: 13_2_000001E0BE701B10 NtProtectVirtualMemory,NtCreateSection,	13_2_000001E0BE701B10
Source: C:\Windows\System32\rundll32.exe	Code function: 13_2_000001E0BE701BA8 NtCreateSection,	13_2_000001E0BE701BA8
Source: C:\Windows\System32\rundll32.exe	Code function: 15_2_00000224A1FE1B10 NtProtectVirtualMemory,NtCreateSection,	15_2_00000224A1FE1B10
Source: C:\Windows\System32\rundll32.exe	Code function: 15_2_00000224A1FE1BA8 NtCreateSection,	15_2_00000224A1FE1BA8
Source: C:\Windows\System32\loaddll64.exe	Code function: 17_2_0000026F88A31B10 NtProtectVirtualMemory,NtCreateSection,	17_2_0000026F88A31B10
Source: C:\Windows\System32\loaddll64.exe	Code function: 17_2_0000026F88A31BA8 NtCreateSection,	17_2_0000026F88A31BA8

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E14C870	0_2_00007FFE0E14C870
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E14F0D0	0_2_00007FFE0E14F0D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E146D40	0_2_00007FFE0E146D40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E135E40	0_2_00007FFE0E135E40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E14B640	0_2_00007FFE0E14B640
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E13D310	0_2_00007FFE0E13D310
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E13D760	0_2_00007FFE0E13D760
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E135770	0_2_00007FFE0E135770
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E140B70	0_2_00007FFE0E140B70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E14A350	0_2_00007FFE0E14A350
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E1347A0	0_2_00007FFE0E1347A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E14FFC0	0_2_00007FFE0E14FFC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E13FC60	0_2_00007FFE0E13FC60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E137870	0_2_00007FFE0E137870
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E15505A	0_2_00007FFE0E15505A
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E137CE0	0_2_00007FFE0E137CE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E13D970	0_2_00007FFE0E13D970
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E13DD80	0_2_00007FFE0E13DD80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E13BD80	0_2_00007FFE0E13BD80
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E14C870	3_2_00007FFE0E14C870
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E14F0D0	3_2_00007FFE0E14F0D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E135E40	3_2_00007FFE0E135E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E14B640	3_2_00007FFE0E14B640
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E13D310	3_2_00007FFE0E13D310
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E13D760	3_2_00007FFE0E13D760
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E135770	3_2_00007FFE0E135770
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E140B70	3_2_00007FFE0E140B70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E14A350	3_2_00007FFE0E14A350
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E1347A0	3_2_00007FFE0E1347A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E14FFC0	3_2_00007FFE0E14FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E13FC60	3_2_00007FFE0E13FC60
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E137870	3_2_00007FFE0E137870
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E15505A	3_2_00007FFE0E15505A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E137CE0	3_2_00007FFE0E137CE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E13D970	3_2_00007FFE0E13D970
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E146D40	3_2_00007FFE0E146D40
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E13DD80	3_2_00007FFE0E13DD80
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E13BD80	3_2_00007FFE0E13BD80
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E14C870	4_2_00007FFE0E14C870
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E14F0D0	4_2_00007FFE0E14F0D0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E135E40	4_2_00007FFE0E135E40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E14B640	4_2_00007FFE0E14B640
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E13D310	4_2_00007FFE0E13D310
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E13D760	4_2_00007FFE0E13D760
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E135770	4_2_00007FFE0E135770
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E140B70	4_2_00007FFE0E140B70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E14A350	4_2_00007FFE0E14A350
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E1347A0	4_2_00007FFE0E1347A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E14FFC0	4_2_00007FFE0E14FFC0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E13FC60	4_2_00007FFE0E13FC60
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E137870	4_2_00007FFE0E137870
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E15505A	4_2_00007FFE0E15505A
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E137CE0	4_2_00007FFE0E137CE0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E13D970	4_2_00007FFE0E13D970
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E146D40	4_2_00007FFE0E146D40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E13DD80	4_2_00007FFE0E13DD80
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E13BD80	4_2_00007FFE0E13BD80
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000027B70B50730	6_2_0000027B70B50730
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000027B70B50BAD	6_2_0000027B70B50BAD
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000027B70B50AB3	6_2_0000027B70B50AB3
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000027B70B50B36	6_2_0000027B70B50B36
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000027B70B50999	6_2_0000027B70B50999
Source: C:\Windows\System32\rundll32.exe	Code function: 13_2_000001E0BE700730	13_2_000001E0BE700730
Source: C:\Windows\System32\rundll32.exe	Code function: 13_2_000001E0BE700AB3	13_2_000001E0BE700AB3
Source: C:\Windows\System32\rundll32.exe	Code function: 13_2_000001E0BE700B36	13_2_000001E0BE700B36
Source: C:\Windows\System32\rundll32.exe	Code function: 13_2_000001E0BE700BAD	13_2_000001E0BE700BAD
Source: C:\Windows\System32\rundll32.exe	Code function: 13_2_000001E0BE700999	13_2_000001E0BE700999
Source: C:\Windows\System32\rundll32.exe	Code function: 15_2_00000224A1FE0999	15_2_00000224A1FE0999
Source: C:\Windows\System32\rundll32.exe	Code function: 15_2_00000224A1FE0B36	15_2_00000224A1FE0B36
Source: C:\Windows\System32\rundll32.exe	Code function: 15_2_00000224A1FE0AB3	15_2_00000224A1FE0AB3
Source: C:\Windows\System32\rundll32.exe	Code function: 15_2_00000224A1FE0730	15_2_00000224A1FE0730
Source: C:\Windows\System32\rundll32.exe	Code function: 15_2_00000224A1FE0BAD	15_2_00000224A1FE0BAD
Source: C:\Windows\System32\loaddll64.exe	Code function: 17_2_0000026F88A30730	17_2_0000026F88A30730
Source: C:\Windows\System32\loaddll64.exe	Code function: 17_2_0000026F88A30B36	17_2_0000026F88A30B36
Source: C:\Windows\System32\loaddll64.exe	Code function: 17_2_0000026F88A30AB3	17_2_0000026F88A30AB3
Source: C:\Windows\System32\loaddll64.exe	Code function: 17_2_0000026F88A30999	17_2_0000026F88A30999
Source: C:\Windows\System32\loaddll64.exe	Code function: 17_2_0000026F88A30BAD	17_2_0000026F88A30BAD

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6720 -s 452

Source: ZJGkxGuyIT.dll

Static PE information: Number of sections : 12 > 10

Source: classification engine

Classification label: mal60.evad.winDLL@25/9@0/0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE0E14D040 RtlAddVectoredExceptionHandler,memset,CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,CloseHandle,OpenThread,GetThreadContext,SetThreadContext,CloseHandle,GetModuleHandleA,GetProcAddress,RtlInitUnicodeString,LdrLoadDll,

0_2_00007FFE0E14D040

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6772
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5804:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6720

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\d0677b87-b77c-4db0-83a1-98f8c6085e6c

Jump to behavior

Source: ZJGkxGuyIT.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ZJGkxGuyIT.dll",#1

Source: ZJGkxGuyIT.dll

Virustotal: Detection: 10%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\ZJGkxGuyIT.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ZJGkxGuyIT.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /i /s C:\Users\user\Desktop\ZJGkxGuyIT.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ZJGkxGuyIT.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllInstall
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllInstall 2580
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6720 -s 452
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6772 -s 400
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllRegisterServer
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllRegisterServer 6976
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllUnregisterServer
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllUnregisterServer 6220
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\loaddll64.exe C:\Windows\system32\loaddll64.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll 6296
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ZJGkxGuyIT.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /i /s C:\Users\user\Desktop\ZJGkxGuyIT.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllInstall	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllUnregisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\loaddll64.exe C:\Windows\system32\loaddll64.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll 6296	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ZJGkxGuyIT.dll",#1	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllInstall 2580	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllRegisterServer 6976	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllUnregisterServer 6220	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: ZJGkxGuyIT.dll

Static PE information: Image base 0x357620000 > 0x60000000

Source: ZJGkxGuyIT.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ntdll.pdb source: loaddll64.exe, 00000000.00000002.1792371427.000001FFB8B09000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1793567365.000001FFB930D000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1792792121.000001FFB8F05000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1793330361.000001FFB910A000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1793771115.000001FFB9502000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1792577894.000001FFB8D06000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911803970.00000000036CA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911968562.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911605994.00000000034C6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911359478.00000000032C9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1910092977.0000000002EC2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1910526205.00000000030CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895201861.00000196F17B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895523151.00000196F1BB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895033928.00000196F15B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895364557.00000196F19BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1894645590.00000196F11B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1894832789.00000196F13BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1786543077.00000234B9309000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1787336671.00000234B9D06000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1786878245.00000234B970F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1787187145.00000234B9B0B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1787018729.00000234B990F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1786732122.00000234B9508000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1843129716.000002542840F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1842592948.0000025428008000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1842829424.000002542820D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1841796861.0000025427A07000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1842228317.0000025427E0F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000
Source:	Binary string: ntdll.pdbUGP source: loaddll64.exe, 00000000.00000002.1792371427.000001FFB8B09000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1793567365.000001FFB930D000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1792792121.000001FFB8F05000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1793330361.000001FFB910A000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1793771115.000001FFB9502000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.1792577894.000001FFB8D06000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911803970.00000000036CA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911968562.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911605994.00000000034C6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1911359478.00000000032C9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1910092977.0000000002EC2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000003.00000002.1910526205.00000000030CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895201861.00000196F17B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895523151.00000196F1BB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895033928.00000196F15B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1895364557.00000196F19BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1894645590.00000196F11B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1894832789.00000196F13BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1786543077.00000234B9309000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1787336671.00000234B9D06000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1786878245.00000234B970F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1787187145.00000234B9B0B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1787018729.00000234B990F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1786732122.00000234B9508000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1843129716.000002542840F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1842592948.0000025428008000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1842829424.000002542820D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1841796861.0000025427A07000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.1842228317.0000025427E0F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE0E14D520 HeapCreate,VirtualProtect,LoadLibraryA,GetProcAddress,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,ResumeThread,exit,Sleep,memcpy,CoInitialize,SafeArrayCreate,SafeArrayPutElement,

0_2_00007FFE0E14D520

Source: ZJGkxGuyIT.dll	Static PE information: section name: .eh_fram
Source: ZJGkxGuyIT.dll	Static PE information: section name: .xdata

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /i /s C:\Users\user\Desktop\ZJGkxGuyIT.dll

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE0E13C670 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FFE0E13C670

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

0_2_00007FFE0E14D040

Source: C:\Windows\System32\regsvr32.exe	API coverage: 9.1 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 9.0 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\loaddll64.exe

0_2_00007FFE0E14D040

Source: C:\Windows\System32\loaddll64.exe

0_2_00007FFE0E14D040

Source: C:\Windows\System32\loaddll64.exe

0_2_00007FFE0E14D520

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE0E14C870 CreateFileA,GetFileSize,ReadFile,strcmp,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,

0_2_00007FFE0E14C870

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFE0E14D040 RtlAddVectoredExceptionHandler,memset,CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,CloseHandle,OpenThread,GetThreadContext,SetThreadContext,CloseHandle,GetModuleHandleA,GetProcAddress,RtlInitUnicodeString,LdrLoadDll,	0_2_00007FFE0E14D040
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00007FFE0E14D040 RtlAddVectoredExceptionHandler,memset,CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,CloseHandle,OpenThread,GetThreadContext,SetThreadContext,CloseHandle,GetModuleHandleA,GetProcAddress,RtlInitUnicodeString,LdrLoadDll,	3_2_00007FFE0E14D040
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FFE0E14D040 RtlAddVectoredExceptionHandler,memset,CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,CloseHandle,OpenThread,GetThreadContext,SetThreadContext,CloseHandle,GetModuleHandleA,GetProcAddress,RtlInitUnicodeString,LdrLoadDll,	4_2_00007FFE0E14D040

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Indirect: 0x7FFE0E14D9BE	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Indirect: 0x7FFE0E146E1A	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Indirect: 0x7FFE0E14DB26	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtWriteVirtualMemory: Indirect: 0x7FFE0E146E3E	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtWriteVirtualMemory: Indirect: 0x7FFE0E14DAF1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Indirect: 0x7FFE0E146E90	Jump to behavior

Hijacks the control flow in another process

Source: C:\Windows\System32\loaddll64.exe	Memory written: PID: 5804 base: 26F88A30000 value: E9	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 6976 base: 27B70B50000 value: E9	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 6220 base: 1E0BE700000 value: E9	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 6296 base: 224A1FE0000 value: E9	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\loaddll64.exe C:\Windows\system32\loaddll64.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll 6296	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ZJGkxGuyIT.dll",#1	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllInstall 2580	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllRegisterServer 6976	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllUnregisterServer 6220	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFE0E14F0D0 RtlGetVersion,GetTickCount,memcpy,exit,exit,

0_2_00007FFE0E14F0D0

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\System32\rundll32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\rundll32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Regsvr32	OS Credential Dumping	41 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Rundll32	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	111 Process Injection	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ZJGkxGuyIT.dll	8%	ReversingLabs
ZJGkxGuyIT.dll	11%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.10.dr	false	URL Reputation: safe URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542665
Start date and time:	2024-10-26 05:35:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZJGkxGuyIT.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original Sample Name:	2ebf32f4a6b63b8dad4dac4bddf1cbee.exe
Detection:	MAL
Classification:	mal60.evad.winDLL@25/9@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 50 Number of non-executed functions: 138

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
23:36:20	API Interceptor	2x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_regsvr32.exe_535451c67ed13a7d61656632ce4c87290bfb9a_e29f7403_f08926e4-7646-4698-b05e-04c478fb93ab\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8234442945424231
Encrypted:	false
SSDEEP:	96:2pFXMvEAh+6J+AECyyssm+9sn2Gj5MSRQXIDcQec6OcE2cw3Tdadz+nbHg/BwAS5:OszcAESslc0QKs7eTPzuiFNZ24lO8w
MD5:	F9CB05D2F7397B75FE99BF8FE29C6645
SHA1:	CDCE580C475EA130AC702A585215A623A70150F2
SHA-256:	F67B75AB5F82CA836E2A6846C13AC33489C940AFC4F61EB41BF3C934E378F890
SHA-512:	153D12AC07C2CDC933EAA74B2A4F06870E117B8BAD183494091F47624386FDEDDB51BB0896051589B3561FCF2715D3D492C290B7D326D56D6717A7F6A82A77DB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.3.8.7.3.6.1.7.6.7.6.2.9.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.3.8.7.3.6.2.4.0.8.2.6.0.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.0.8.9.2.6.e.4.-.7.6.4.6.-.4.6.9.8.-.b.0.5.e.-.0.4.c.4.7.8.f.b.9.3.a.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.2.1.1.5.4.d.e.-.0.c.4.6.-.4.1.e.d.-.8.1.8.0.-.d.c.8.1.0.6.3.b.f.8.8.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.e.g.s.v.r.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.E.G.S.V.R.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.4.0.-.0.0.0.1.-.0.0.1.4.-.3.3.5.d.-.3.3.2.c.5.8.2.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.d.7.c.2.f.d.3.5.4.3.6.3.d.a.e.e.6.3.e.8.f.5.9.1.e.c.5.2.f.a.5.d.0.e.2.3.f.6.f.!.r.e.g.s.v.r.3.2...e.x.e.....T.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ZJG_21de29d3d03af62e3c347fc53eb90afbeb77c51_8423aa97_ca914613-ecdc-4770-9312-bb71d7b1943e\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8005334179435284
Encrypted:	false
SSDEEP:	96:3LFwULi7yKy0sjS4Rv2Gj5MSRQXIDcQUc6kAmGcEUFcw3UyXaXz+nbHgSQgJj1h9:7ti7y0R0qNmGSFY8VszuiFNZ24lO8iL
MD5:	5C1A635F4A6783791C156E7F1D35D1EE
SHA1:	401B9F6D01EC6797CA01E77654498247AD3853C9
SHA-256:	2772A3B7AE658DBEAD4678FC83323F74F666B9FDF6D9448DBC7372BA03DF8825
SHA-512:	DBAA27F3EA25EC672EFF12935FEBD3F28082102B5AAB743BC0F9A873EA51A7DCAB77D4F5AA2A66415E80EB630BE930E853FE9C7CD37CBC1AC792F2CE39B342A0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.3.8.7.3.6.1.8.4.1.7.3.4.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.3.8.7.3.6.2.5.1.3.5.8.8.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.a.9.1.4.6.1.3.-.e.c.d.c.-.4.7.7.0.-.9.3.1.2.-.b.b.7.1.d.7.b.1.9.4.3.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.5.2.d.2.8.8.c.-.c.2.9.0.-.4.a.2.a.-.b.d.e.c.-.0.5.0.4.1.0.1.9.3.e.0.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.Z.J.G.k.x.G.u.y.I.T...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.7.4.-.0.0.0.1.-.0.0.1.4.-.2.b.4.7.-.3.5.2.c.5.8.2.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER460A.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Oct 26 03:36:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57422
Entropy (8bit):	1.6444097497596473
Encrypted:	false
SSDEEP:	96:5W86W+cZCMtuYkrvVmgQz+RT7y2ePXloi75BL63u/WU9MS4VS+v2rXqdFa+wA+Yt:TTTIIUGJSO50+/T9kV/v2U7qla
MD5:	CF9474486094D1E929A3F00647BEE87A
SHA1:	36560A7AB6DB785FCFDEF5AC31A0A1E5E7D21D8A
SHA-256:	42015496F47B62FD26C6A4EDC813C79454C85548326D76465EE7A7AF0B8C84BC
SHA-512:	0B5D3C8104E92DE8CBB1652B0DC9E376069D0A873AC54419472B55236C2A4F70DFE8685B95912AB5CA3FE87A971EAD391F7463E5BC4908073B28A74100585B0F
Malicious:	false
Preview:	MDMP..a..... ........c.g....................................$...x-..........T.......8...........T...............F...........H...........4...............................................................................eJ..............Lw......................T.......@....c.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4658.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Oct 26 03:36:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	52566
Entropy (8bit):	1.520529918881532
Encrypted:	false
SSDEEP:	96:5W8njjIYqDqxUowLlaBTpZxH+AOIOgLoi7Mc+6e+JSRC6jryEWnpWIFTIBbjqYH0:TnjcNyVHlOgcOMG0DGE5qY0xxu2
MD5:	BF7131ABF4BE27F8331FE1899BAF5AD2
SHA1:	D7907056B9DB8BC12A09913CAFF55CD7E1FB208D
SHA-256:	0CC734C49F1651556EF2FD84A2E5E5DBB506A13DDFEA0E8013259622AB9DDE0F
SHA-512:	F5D14D2DC4D19E752E81EA9BA91133B6AF2ED58E5BC8BFED9F24C7B2943AD216F6B7A28EBB68EAF1BF18068EA5F47C41B5EEDE66A030082890E0BCF85AEAC7A9
Malicious:	false
Preview:	MDMP..a..... ........c.g........................................X+..........T.......8...........T...............V.......................................................................................................eJ..............Lw......................T.......t....c.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER46F6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8590
Entropy (8bit):	3.6896074328161466
Encrypted:	false
SSDEEP:	192:R6l7wVeJEfiqP6YJC/Bgmf8BnyRcpDy89bnF0fANm:R6lXJ0X6Yspgmf8BnyR6nWfH
MD5:	16BEA2AC469AEFC294FD77B0B022D4E6
SHA1:	214F85866CEF923D457C70AD9A9DA0B9E26C4FDC
SHA-256:	4F2401A085B183EAF83A21C9FC30C94425FFCBD852F88301910D99702F5C7B6D
SHA-512:	1E8B9A8082C03FF99D226DAEFD6EB5AB95A0601936FB3D51C2CF8FFB3D864AA676DBE4A0D29CCC41A410D88C59D62538C620E011225CE949FC65D526617CE72F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4725.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4826
Entropy (8bit):	4.4415034413212355
Encrypted:	false
SSDEEP:	48:cvIwWl8zsiJg771I9RizWpW8VY8Ym8M4JPNoF8fcyq8vkN4tEfsigd:uIjfwI7TC7VAJPvkWkqKfsigd
MD5:	AAF11E71B65BAA05FE3E2A289815BF83
SHA1:	88700177344100128B06B25B304F6B6E304D7CAC
SHA-256:	90B6932843A952CFECC4D9F95D9E63B5DA2F7DD7649CEF7D0A3EE7755988C062
SHA-512:	EB38F2F1A8E7E2F4A1706756783840B57AC0CB37527E235AF3073881F6795C5094A37FBAB07AAB27558DB11062662F3EE4919C9E8F83E23F75EA9B3871C7C5FC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="559838" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4783.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8884
Entropy (8bit):	3.6988325818191132
Encrypted:	false
SSDEEP:	192:R6l7wVeJB05TqYe6YsEt5gmfz7ncm2a9RcpDG89bn96f2Nm:R6lXJC5TU6Ynzgmfz7nz2a9R+nwfd
MD5:	CEE42678D958FA5414E376BD5E8A5EC9
SHA1:	AC85C7F9A06B6801BA3D39C21106CAC2F2EEFC4B
SHA-256:	100454CB621EDCB78D30237DBD60F9230DD2233C8C1A9815A88AAC560CA24863
SHA-512:	9C6998BA194388673926044DB2088E71A74D9C5CC8165E133A262E36C772E354C9047BB19AFE631C6734126D524CCA4C28B9C83CE6526A2F0155115AD404FB7C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4801.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4877
Entropy (8bit):	4.487115316534731
Encrypted:	false
SSDEEP:	48:cvIwWl8zsiJg771I9RizWpW8VYrw0Ym8M4JCbCjoFXyq8vhj8ptSTStd:uIjfwI7TC7VSwBJ0WypoOtd
MD5:	55C497F7868EA21C51543348FE110320
SHA1:	2E8CBF663AD2E8F0E188CF866F232AC0639F29BE
SHA-256:	FF7799C4583EDC2BD9F8586A212442A6D4341490DA8ECE62B34F016B0F2953D7
SHA-512:	BA195B1E8DD0C696B8B4C0D9A3FB839DB1F2AE8E0AEB502C5B6F08AF048697A5DF6458136B10899C726C9E00117C33F8052209717F214AE7381EDED18946C11A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="559838" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469866079576607
Encrypted:	false
SSDEEP:	6144:mIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNfdwBCswSbNX:LXD94+WlLZMM6YFHx+N
MD5:	59146C3ADFBEB5A73FA6CFC649106D1F
SHA1:	A52F9E1459DABE0E5FE9A99314371256DD4F5175
SHA-256:	EC86EB274C41BD6B09C9CCFA860DDA5217A081E52DCED6501C75CF38DBA13775
SHA-512:	C8EB5B63FAB832CB1528D428132F896C66EFB2DF1746EF637152A6DDE9D50173EEDE28568154CFEE731B669988753996EDF4FB530C18916DAF20187204179702
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...-X'...............................................................................................................................................................................................................................................................................................................................................[..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.663904734307042
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	ZJGkxGuyIT.dll
File size:	249'344 bytes
MD5:	2ebf32f4a6b63b8dad4dac4bddf1cbee
SHA1:	8b9f7739a9a64168b50d3bde17c8e8ee1127671c
SHA256:	fde4f048bb013ec3caabbe5862dcb8df0f701659bc9ac04e5bb1c5a3eee58b61
SHA512:	a52273a23daaec0ea1b07c97e850809ea23a09f75907a0d3573faa5aef9dd1f91936b4926b17d8434fed06756905074c35e9e2d9f5b8fb76f19e2f6fdde47539
SSDEEP:	6144:ycPbDxd4SjM1N2GZpnqQs8vlOIUtUCHBYcHvG23JJJ655ZZo:hFjEASqN8vQIGCcH
TLSH:	BA346B3BE36358BCC86BC2745A9B99B27571FC540270A82B06949B303F1BC605B7EF59
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...,..g..........."...$.x.......`............bW..........................................`... ............................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x357621290
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x357620000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x670F7F2C [Wed Oct 16 08:54:04 2024 UTC]
TLS Callbacks:	0x57641210, 0x3, 0x576412cf, 0x3
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	9dee5c6e2779603605dedf99c35cff63

Entrypoint Preview

Instruction
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 20h
dec eax
mov dword ptr [ebp+10h], ecx
mov dword ptr [ebp+18h], edx
dec esp
mov dword ptr [ebp+20h], eax
dec eax
mov eax, dword ptr [00038D96h]
mov dword ptr [eax], 00000000h
dec eax
mov edx, dword ptr [ebp+20h]
mov eax, dword ptr [ebp+18h]
dec ecx
mov eax, edx
mov edx, eax
dec eax
mov ecx, dword ptr [ebp+10h]
call 00007FA31547CE3Bh
dec eax
add esp, 20h
pop ebp
ret
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
dec eax
mov dword ptr [ebp+10h], ecx
mov dword ptr [ebp+18h], edx
dec esp
mov dword ptr [ebp+20h], eax
mov dword ptr [ebp-04h], 00000001h
dec eax
mov eax, dword ptr [00038BD4h]
mov edx, dword ptr [ebp+18h]
mov dword ptr [eax], edx
cmp dword ptr [ebp+18h], 00000000h
jne 00007FA31547CE48h
mov eax, dword ptr [0003ED03h]
test eax, eax
jne 00007FA31547CE3Eh
mov dword ptr [ebp-04h], 00000000h
jmp 00007FA31547CF65h
call 00007FA31549D5A0h
cmp dword ptr [ebp+18h], 01h
je 00007FA31547CE38h
cmp dword ptr [ebp+18h], 02h
jne 00007FA31547CE96h
dec eax
mov edx, dword ptr [ebp+20h]
mov eax, dword ptr [ebp+18h]
dec ecx
mov eax, edx
mov edx, eax
dec eax
mov ecx, dword ptr [ebp+10h]
call 00007FA31547CB1Fh
mov dword ptr [ebp-04h], eax
cmp dword ptr [ebp-04h], 00000000h
je 00007FA31547CF2Ch
dec eax
mov edx, dword ptr [ebp+20h]
mov eax, dword ptr [ebp+18h]
dec ecx
mov eax, edx
mov edx, eax
dec eax
mov ecx, dword ptr [ebp+10h]
call 00007FA31549DE10h
mov dword ptr [ebp-04h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x56000	0xb4	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x57000	0x730	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3c000	0x1824	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a000	0x1e0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x39040	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x571e4	0x1a8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x27698	0x27800	b83dfeff50b262410611caa9fac8bcf6	False	0.499443730221519	data	6.325811919972983	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x29000	0x150	0x200	50870ec7f383fcc2e8b6eeb64e3f814f	False	0.24609375	data	1.9503265794495694	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2a000	0x10c00	0x10c00	31ad200d256fac9c7ff0039eeb5d36ac	False	0.7173361707089553	data	7.2062052344397065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.eh_fram	0x3b000	0x4	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x3c000	0x1824	0x1a00	f7ec1b89acfcae13c1867c658aef9224	False	0.455078125	data	5.0663982156105885	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x3e000	0x1634	0x1800	5999f7e98daf8952ea12949c796e07c6	False	0.22998046875	, SYS \003\001P	4.237229923920545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x40000	0x15fa0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x56000	0xb4	0x200	6682e61b2c562c12d63076a4958b3874	False	0.283203125	data	2.181347600828191	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x57000	0x730	0x800	c7295d857041e582edf3b60ba0dac05b	False	0.32958984375	data	3.8466687637486072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x58000	0x58	0x200	de4da1b0adc00fecedc43206b7235f08	False	0.0546875	data	0.25470559145657956	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x59000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x5a000	0x1e0	0x200	719b62a08a0d64bf647b428942335524	False	0.697265625	data	4.767069455457626	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, FreeLibrary, GetLastError, GetModuleHandleA, GetProcAddress, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, MultiByteToWideChar, Sleep, TlsGetValue, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WideCharToMultiByte
msvcrt.dll	___lc_codepage_func, ___mb_cur_max_func, __iob_func, _amsg_exit, _errno, _fileno, _initterm, _lock, _setjmp, _setmode, _unlock, abort, calloc, exit, fflush, fputc, free, fwrite, localeconv, longjmp, malloc, memchr, memcpy, memset, realloc, signal, strcmp, strerror, strlen, strncmp, strstr, vfprintf, wcslen

Exports

Name	Ordinal	Address
DllInstall	1	0x35763ebd0
DllRegisterServer	2	0x35763eb70
DllUnregisterServer	3	0x35763eba0
NimMain	4	0x35763eb40
main	5	0x357648640

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 05:36:20.414817095 CEST	53	56811	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	23:35:58
Start date:	25/10/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\ZJGkxGuyIT.dll"
Imagebase:	0x7ff64d9b0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:35:58
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:35:58
Start date:	25/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ZJGkxGuyIT.dll",#1
Imagebase:	0x7ff658d00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:35:58
Start date:	25/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /i /s C:\Users\user\Desktop\ZJGkxGuyIT.dll
Imagebase:	0x7ff78ec50000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:35:58
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\ZJGkxGuyIT.dll",#1
Imagebase:	0x7ff780440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:35:58
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllInstall
Imagebase:	0x7ff780440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:36:01
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllInstall 2580
Imagebase:	0x7ff780440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:36:01
Start date:	25/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6720 -s 452
Imagebase:	0x7ff651ef0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:36:01
Start date:	25/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6772 -s 400
Imagebase:	0x7ff651ef0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:36:02
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllRegisterServer
Imagebase:	0x7ff780440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:36:03
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllRegisterServer 6976
Imagebase:	0x7ff780440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:36:05
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllUnregisterServer
Imagebase:	0x7ff780440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:36:06
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll,DllUnregisterServer 6220
Imagebase:	0x7ff780440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:36:09
Start date:	25/10/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\loaddll64.exe C:\Users\user\Desktop\C:\Users\user\Desktop\ZJGkxGuyIT.dll 6296
Imagebase:	0x7ff64d9b0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:36:20
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.5%
Total number of Nodes:	1803
Total number of Limit Nodes:	15

Executed Functions

Function 00007FFE0E14F0D0 Relevance: 53.2, APIs: 4, Strings: 26, Instructions: 672
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlGetVersion.NTDLL ref: 00007FFE0E14F24A
memcpy.MSVCRT ref: 00007FFE0E14F326

Part of subcall function 00007FFE0E13C390: MultiByteToWideChar.KERNEL32 ref: 00007FFE0E13C3E7
Part of subcall function 00007FFE0E13C390: MultiByteToWideChar.KERNEL32 ref: 00007FFE0E13C44A

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

exit.MSVCRT ref: 00007FFE0E14F981
exit.MSVCRT ref: 00007FFE0E14F9B2

Strings

GetTickCount, xrefs: 00007FFE0E14F864
MultiByteToWideChar, xrefs: 00007FFE0E14F80F
GetModuleHandleA, xrefs: 00007FFE0E14F6DE
GetProcessHeap, xrefs: 00007FFE0E14F656
GetFileSize, xrefs: 00007FFE0E14F8BC
GetComputerNameExA, xrefs: 00007FFE0E14FAC7
GlobalMemoryStatusEx, xrefs: 00007FFE0E14FAF0
SetThreadContext, xrefs: 00007FFE0E14F739
ReadFile, xrefs: 00007FFE0E14F919
GetDiskFreeSpaceExA, xrefs: 00007FFE0E14FB19
WaitForSingleObject, xrefs: 00007FFE0E14F7E6
T], xrefs: 00007FFE0E14FC0F
RtlAllocateHeap, xrefs: 00007FFE0E14F8F0
LdrLoadDll, xrefs: 00007FFE0E14F51E
VirtualProtect, xrefs: 00007FFE0E14F601
GetProcAddress, xrefs: 00007FFE0E14F682
OpenThread, xrefs: 00007FFE0E14F791
OpenProcess, xrefs: 00007FFE0E14F62D
RtlAddVectoredExceptionHandler, xrefs: 00007FFE0E14F6B5
GetCurrentProcessId, xrefs: 00007FFE0E14F5D5
CreateFileA, xrefs: 00007FFE0E14F890
GetCurrentThreadId, xrefs: 00007FFE0E14F7BD
Sleep, xrefs: 00007FFE0E14F838
GetThreadContext, xrefs: 00007FFE0E14F70D
RtlInitUnicodeString, xrefs: 00007FFE0E14F552
CloseHandle, xrefs: 00007FFE0E14F765

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy$ByteCharMultiWideexit$Version
String ID: CloseHandle$CreateFileA$GetComputerNameExA$GetCurrentProcessId$GetCurrentThreadId$GetDiskFreeSpaceExA$GetFileSize$GetModuleHandleA$GetProcAddress$GetProcessHeap$GetThreadContext$GetTickCount$GlobalMemoryStatusEx$LdrLoadDll$MultiByteToWideChar$OpenProcess$OpenThread$ReadFile$RtlAddVectoredExceptionHandler$RtlAllocateHeap$RtlInitUnicodeString$SetThreadContext$Sleep$VirtualProtect$WaitForSingleObject$T]
API String ID: 206777904-685478019
Opcode ID: 38e647b285acce572d2b06f85b1db45c1e6d2934eba878912ed0140cac11a025
Instruction ID: 6c2b76d9e2dcf6567f574f206e0d4934e61591816cbdcff9d8d3bd1f98a7c4b3
Opcode Fuzzy Hash: 38e647b285acce572d2b06f85b1db45c1e6d2934eba878912ed0140cac11a025
Instruction Fuzzy Hash: 726208B5F19B0781FA14ABA9E455AB923A1FF89B80F845437D98D1B7B6DE3CE011C340

Function 00007FFE0E14D520 Relevance: 26.9, APIs: 11, Strings: 4, Instructions: 619
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE0E136B50: memset.MSVCRT ref: 00007FFE0E136BE2

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

HeapCreate.KERNELBASE ref: 00007FFE0E14D581
LoadLibraryA.KERNEL32 ref: 00007FFE0E14D8EF
GetProcAddress.KERNEL32 ref: 00007FFE0E14D92B
ResumeThread.KERNELBASE ref: 00007FFE0E14DB57
exit.MSVCRT ref: 00007FFE0E14DB71
VirtualProtect.KERNEL32 ref: 00007FFE0E14D781

Part of subcall function 00007FFE0E14EF30: fwrite.MSVCRT ref: 00007FFE0E14EF6F

Strings

com.nim, xrefs: 00007FFE0E14E053
toVariant, xrefs: 00007FFE0E14E066
Jo ., xrefs: 00007FFE0E14DBBE
VariantConversionError, xrefs: 00007FFE0E14DFFF

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy$AddressCreateHeapLibraryLoadProcProtectResumeThreadVirtualexitfwritememset
String ID: Jo .$VariantConversionError$com.nim$toVariant
API String ID: 2577474293-479195221
Opcode ID: e79772847887c0e1f1e5046551ef7054be59b8ca2f684dc9a77833c47d3171bc
Instruction ID: b180b70066d2219dc2e5d860d64a013653b37e144978ef48df02bc3f3d9c8809
Opcode Fuzzy Hash: e79772847887c0e1f1e5046551ef7054be59b8ca2f684dc9a77833c47d3171bc
Instruction Fuzzy Hash: 066246A2B09B4691EB10DB60E8543BA23A1FF85B94F804137DA9E477B6DF3CE545C380

Function 00007FFE0E14C870 Relevance: 12.4, APIs: 8, Instructions: 352
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

CreateFileA.KERNEL32 ref: 00007FFE0E14C948
GetFileSize.KERNEL32 ref: 00007FFE0E14C956
ReadFile.KERNEL32 ref: 00007FFE0E14C9A5

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy$File$CreateReadSize
String ID:
API String ID: 3349561689-0
Opcode ID: a8202178b302e06c8707e63b6a2b76a7fa594dfccb05227361a63074442d66f1
Instruction ID: 9ea9f028ffebf61283f37a72def0b60319a3bec4377fd314401ede3a39822efd
Opcode Fuzzy Hash: a8202178b302e06c8707e63b6a2b76a7fa594dfccb05227361a63074442d66f1
Instruction Fuzzy Hash: 67F112A2A0E7C182EB20CB65E45477ABFA1FB85B80F098136DADE477A5DE3CD145C350

Function 00007FFE0E146D40 Relevance: 4.9, APIs: 3, Instructions: 364
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FFE0E146DE7
fwrite.MSVCRT ref: 00007FFE0E146FF7
fflush.MSVCRT ref: 00007FFE0E147006

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

Part of subcall function 00007FFE0E136B50: memset.MSVCRT ref: 00007FFE0E136BE2

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy$fflushfwritememset
String ID:
API String ID: 361287032-0
Opcode ID: 06349382353ebc58b7a2661a41be20b74beb036f04aed4321b20beb69a80aee4
Instruction ID: e62a824232e9978068669e32ac81b505a21c45f5bba700f78786666fe0c17046
Opcode Fuzzy Hash: 06349382353ebc58b7a2661a41be20b74beb036f04aed4321b20beb69a80aee4
Instruction Fuzzy Hash: 07F1C2A2A1878282EA15CB12A9502793B61FF91BA4F090637DEED0B7F6DF3CD504D350

Function 00007FFE0E14C1D0 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FFE0E14C2DC
memcpy.MSVCRT ref: 00007FFE0E14C3F9
memcpy.MSVCRT ref: 00007FFE0E14C41B
memcpy.MSVCRT ref: 00007FFE0E14C440
memcpy.MSVCRT ref: 00007FFE0E14C465
memcpy.MSVCRT ref: 00007FFE0E14C48A

Strings

p, xrefs: 00007FFE0E14C2A1
*7;u, xrefs: 00007FFE0E14C496

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy$FileModuleName
String ID: *7;u$p
API String ID: 1955653913-3490293476
Opcode ID: 645625445c2e909ecbe63e0be60bb5919e0017e978dff1b72ba1033b1c89a85e
Instruction ID: 347d2f54ae6f7b132ff34f6c40c5f5ae0114f50581e7bbe922afd297b2952dac
Opcode Fuzzy Hash: 645625445c2e909ecbe63e0be60bb5919e0017e978dff1b72ba1033b1c89a85e
Instruction Fuzzy Hash: 89022AB2B09B8692EB54DF15E4543AAB7A1FB84B84F458037DA9C0B7A9EF3CD505C340

Function 00007FFE0E150950 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 218
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fileno.MSVCRT ref: 00007FFE0E15096D
_setmode.MSVCRT ref: 00007FFE0E15097E
_fileno.MSVCRT ref: 00007FFE0E15098A
_setmode.MSVCRT ref: 00007FFE0E150994
_fileno.MSVCRT ref: 00007FFE0E1509A0
_setmode.MSVCRT ref: 00007FFE0E1509AA
LoadLibraryA.KERNEL32 ref: 00007FFE0E1509B7
GetProcAddress.KERNEL32 ref: 00007FFE0E1509D6
CoInitializeEx.COMBASE ref: 00007FFE0E150BDD

Strings

inet_ntop, xrefs: 00007FFE0E1509CF

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: _fileno_setmode$AddressInitializeLibraryLoadProc
String ID: inet_ntop
API String ID: 2337794837-448242623
Opcode ID: 63bcff974b24ba70f64acc777d788e640980a957896653db4294a53ead9a9139
Instruction ID: 3d0441a3fd2b9ae56ad53d10fe99b28e43d44d038bf4b2224a30da2c72688827
Opcode Fuzzy Hash: 63bcff974b24ba70f64acc777d788e640980a957896653db4294a53ead9a9139
Instruction Fuzzy Hash: 81A14172A09B4A81EB119F99E8143A873A0FB89B80F948537DADC233A5DF3DE455C740

Function 00007FFE0E13C530 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 77
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13C548
GetProcAddress.KERNEL32 ref: 00007FFE0E13C571
LoadLibraryA.KERNELBASE ref: 00007FFE0E13C58A

Strings

WideCharToMultiByte, xrefs: 00007FFE0E13C55D
oleaut32, xrefs: 00007FFE0E13C583
SysStringLen, xrefs: 00007FFE0E13C59F
kernel32, xrefs: 00007FFE0E13C541
MultiByteToWideChar, xrefs: 00007FFE0E13C5BE
lstrlenW, xrefs: 00007FFE0E13C5E0

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: LibraryLoad$AddressProc
String ID: MultiByteToWideChar$SysStringLen$WideCharToMultiByte$kernel32$lstrlenW$oleaut32
API String ID: 1469910268-1955535950
Opcode ID: ee6e375a4fb4bccd2b28a38eab41fe4ff48691f0217c803988e2de915c1ce671
Instruction ID: 50fddb0466cb1475f479da3eb50a48eac9ff7740cd49e34045d11df1bbe58fc8
Opcode Fuzzy Hash: ee6e375a4fb4bccd2b28a38eab41fe4ff48691f0217c803988e2de915c1ce671
Instruction Fuzzy Hash: 2031F3A5B1AA03D0ED559B22B854476B3A1BF48B88B98153BDCDD473B1EE3CE405D3A0

Function 00007FFE0E145CC0 Relevance: 10.6, APIs: 7, Instructions: 98
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00007FFE0E145CC7
Sleep.KERNEL32 ref: 00007FFE0E145CD4
SleepEx.KERNELBASE ref: 00007FFE0E145CDA
exit.MSVCRT ref: 00007FFE0E145CEB
memcpy.MSVCRT ref: 00007FFE0E145D6B
memcpy.MSVCRT ref: 00007FFE0E145D8B

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: Sleepmemcpy$CountTickexit
String ID:
API String ID: 3478675858-0
Opcode ID: 934748a70d9580f8422fdbc3d75066d3fc5a1298d14a71ce3d3422b9bef00fa9
Instruction ID: c2debfd109fb03b81b8e0001fd55044452663093610d125ae3361cfdf44075bc
Opcode Fuzzy Hash: 934748a70d9580f8422fdbc3d75066d3fc5a1298d14a71ce3d3422b9bef00fa9
Instruction Fuzzy Hash: 22413B72B09A5692EB11AF18E9943AC73A1FF44B84F448437CA8D177A5EF3CE952C340

Function 00007FFE0E13A9B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13ABE6
GetProcAddress.KERNEL32 ref: 00007FFE0E13AC08

Strings

IsEqualGUID, xrefs: 00007FFE0E13ABFB
ole32, xrefs: 00007FFE0E13AB9C

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: IsEqualGUID$ole32
API String ID: 2574300362-2239048069
Opcode ID: 7ff10b3fd0906f5e01960bbf5f10ae61445133da43785ccd3f84570ed7f384fa
Instruction ID: 196fcbb036f43c9fc6d75697a3f333a8677996702306e6ec7d5d33c57413b403
Opcode Fuzzy Hash: 7ff10b3fd0906f5e01960bbf5f10ae61445133da43785ccd3f84570ed7f384fa
Instruction Fuzzy Hash: 3661AE2191DB8296F6528B58F8857B573B4BF4CB44F80223BC9DD872B0EF3DA6858340

Function 00007FFE0E1317F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

exit.MSVCRT(?,?,?,?,00007FFE0E1318E5,?,?,?,?,00007FFE0E17E968,?,3F000000,000001FFB6F2C260,00007FFE0E13244D,0000040F), ref: 00007FFE0E131821
memset.MSVCRT ref: 00007FFE0E131871

Strings

out of memory, xrefs: 00007FFE0E13180D

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: exitmemset
String ID: out of memory
API String ID: 2099101326-49810860
Opcode ID: aa074db8ca2f3381a55ba80d916c02d22f109c2cf6b225c79be01f7c65ade9da
Instruction ID: 6de8e848fd82886408c6efd7dea4b4eb269f35c18a616f8305ae4af0bc787711
Opcode Fuzzy Hash: aa074db8ca2f3381a55ba80d916c02d22f109c2cf6b225c79be01f7c65ade9da
Instruction Fuzzy Hash: 0B218132F0AB8580FB185F66E4483A963A0EB48FD4F088076DE8C0B7A5DE3CE481C340

Function 00007FFE0E144E70 Relevance: 5.2, APIs: 4, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

memcpy.MSVCRT ref: 00007FFE0E144F09
memcpy.MSVCRT ref: 00007FFE0E144FB9
memcpy.MSVCRT ref: 00007FFE0E144FDA

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cdbec6f9a2dd2351946039720b62acdf348dc7ef4a10d577622d7a41df4bf1b5
Instruction ID: a01483521fc8d50d56d325ca0927091d0fb8182adbaa78c166a4981e769a3133
Opcode Fuzzy Hash: cdbec6f9a2dd2351946039720b62acdf348dc7ef4a10d577622d7a41df4bf1b5
Instruction Fuzzy Hash: E9614872609B8592EA21DF05E8503ED77A0FB88B84F868533DA9D4B7A5EF3CD509C340

Function 00007FFE0E131A00 Relevance: 3.9, APIs: 3, Instructions: 159
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00007FFE0E131A5D

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 68b5536e91810cc27808bf6625663023f2b188fd92dcfb590efa3df9a6d2dc30
Instruction ID: 06a006730b62e0267ec61fb51f24ffb8a6b85390ebef0bf4687352f3647e94a6
Opcode Fuzzy Hash: 68b5536e91810cc27808bf6625663023f2b188fd92dcfb590efa3df9a6d2dc30
Instruction Fuzzy Hash: 26514BB2706B9590EF159B2AD8483B936A5FB54FC4F588536DE8D0B7A8EE3DE441C300

Function 00007FFE0E146C30 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

GetFileAttributesW.KERNEL32 ref: 00007FFE0E146C78
GetFileAttributesW.KERNEL32 ref: 00007FFE0E146CE4

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy$AttributesFile
String ID:
API String ID: 3559115319-0
Opcode ID: 42e9d04e5c697c9ee4175a46a3db53c6dcec2e3e28c3b2640cf8511a3308ae26
Instruction ID: 5989012367a89036984a62e59ce8330c00f6a6eacdac5422eabe04bca07363be
Opcode Fuzzy Hash: 42e9d04e5c697c9ee4175a46a3db53c6dcec2e3e28c3b2640cf8511a3308ae26
Instruction Fuzzy Hash: 8021A752F4AA0781FE09EB25B9541B52392EF95794F988037DC8E0B3B5EE3CE8428340

Function 00007FFE0E131830 Relevance: 2.6, APIs: 2, Instructions: 88
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FFE0E131871
VirtualAlloc.KERNEL32 ref: 00007FFE0E131893

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: AllocVirtualmemset
String ID:
API String ID: 921305906-0
Opcode ID: 6496729da8c964ddebf59c9aa6cdada848c01b8722516d3519af174f54379de9
Instruction ID: c3b093a9a93828be7432a1894dc2ed9c6c9d17280894121fcd594aa5816508cd
Opcode Fuzzy Hash: 6496729da8c964ddebf59c9aa6cdada848c01b8722516d3519af174f54379de9
Instruction Fuzzy Hash: 4E318C32B06B8081EB158F66F8447AD76A4EB48FD4F198076DE8C0B7A5DE38D582C300

Function 00007FFE0E1327D0 Relevance: 1.4, APIs: 1, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FFE0E1328E1

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7a838eac63a25573b851f49d3af618f8f0d33cadf4e87795c7358daf39240612
Instruction ID: 275b8aa8fe5266c9a39243b75965f2374c643625345a15a870d3e7f12dd3053c
Opcode Fuzzy Hash: 7a838eac63a25573b851f49d3af618f8f0d33cadf4e87795c7358daf39240612
Instruction Fuzzy Hash: 6271CEB2A05B4191EA19AF29D4443A833E5FF04B84F58823ADA8D077B5EF38E5D1C300

Function 00007FFE0E136B50 Relevance: 1.3, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FFE0E136BE2

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: b532521561d45849a7f1e55b540afb33b99293abbe439fb3ef002cd9d2cb91db
Instruction ID: 245f4d5451fb1f29f08d8851f56c16b25a6ce852d24118106d61ca69cafec03f
Opcode Fuzzy Hash: b532521561d45849a7f1e55b540afb33b99293abbe439fb3ef002cd9d2cb91db
Instruction Fuzzy Hash: FA416CB7A09A46A0EA10CF25D4502BC73A4FB58BA0F844237CA9E077F4DF78D995C340

Non-executed Functions

Function 00007FFE0E13C670 Relevance: 45.7, APIs: 12, Strings: 14, Instructions: 158libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13C680
GetProcAddress.KERNEL32 ref: 00007FFE0E13C6AD
GetProcAddress.KERNEL32 ref: 00007FFE0E13C6D3
GetProcAddress.KERNEL32 ref: 00007FFE0E13C6F9
GetProcAddress.KERNEL32 ref: 00007FFE0E13C71F
GetProcAddress.KERNEL32 ref: 00007FFE0E13C745
GetProcAddress.KERNEL32 ref: 00007FFE0E13C76B
GetProcAddress.KERNEL32 ref: 00007FFE0E13C791

Part of subcall function 00007FFE0E13A8E0: GetProcAddress.KERNEL32 ref: 00007FFE0E13A8EE

GetProcAddress.KERNEL32 ref: 00007FFE0E13C7D1
GetProcAddress.KERNEL32 ref: 00007FFE0E13C811
GetProcAddress.KERNEL32 ref: 00007FFE0E13C837
GetProcAddress.KERNEL32 ref: 00007FFE0E13C85D

Strings

GetProcAddress, xrefs: 00007FFE0E13C77D
ResumeThread, xrefs: 00007FFE0E13C823
GetThreadContext, xrefs: 00007FFE0E13C6BF
UpdateProcThreadAttribute, xrefs: 00007FFE0E13C7B1
GetCurrentProcess, xrefs: 00007FFE0E13C7F1
GetCurrentThread, xrefs: 00007FFE0E13C699
CreateProcessW, xrefs: 00007FFE0E13C7E3
HeapCreate, xrefs: 00007FFE0E13C6E5
WaitForSingleObject, xrefs: 00007FFE0E13C849
kernel32, xrefs: 00007FFE0E13C679
InitializeProcThreadAttributeList, xrefs: 00007FFE0E13C7A3
HeapAlloc, xrefs: 00007FFE0E13C70B
LoadLibraryA, xrefs: 00007FFE0E13C757
GetProcessHeap, xrefs: 00007FFE0E13C731

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessW$GetCurrentProcess$GetCurrentThread$GetProcAddress$GetProcessHeap$GetThreadContext$HeapAlloc$HeapCreate$InitializeProcThreadAttributeList$LoadLibraryA$ResumeThread$UpdateProcThreadAttribute$WaitForSingleObject$kernel32
API String ID: 2238633743-547029440
Opcode ID: c58de225f95c152ab6af1b470b37807868feafa623f41c2bcfb802640fa2ff2c
Instruction ID: c5433b138257bcf5935ced3e29fb4480aba456a09241f37610f58a11cc730beb
Opcode Fuzzy Hash: c58de225f95c152ab6af1b470b37807868feafa623f41c2bcfb802640fa2ff2c
Instruction Fuzzy Hash: 3761E765B0AA0390ED44A722B91447673A1BF48BC8F98547BCCCD5B3B1EF3CA545E3A4

Function 00007FFE0E14D040 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 219threadlibraryloaderCOMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 00007FFE0E14D07C
memset.MSVCRT ref: 00007FFE0E14D08D
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FFE0E14D0F5
Thread32First.KERNEL32 ref: 00007FFE0E14D153
GetCurrentProcessId.KERNEL32 ref: 00007FFE0E14D16F
CloseHandle.KERNEL32 ref: 00007FFE0E14D19A
OpenThread.KERNEL32 ref: 00007FFE0E14D1C8
GetThreadContext.KERNEL32 ref: 00007FFE0E14D1E0
SetThreadContext.KERNEL32 ref: 00007FFE0E14D234
CloseHandle.KERNEL32 ref: 00007FFE0E14D25D
GetModuleHandleA.KERNEL32 ref: 00007FFE0E14D2AC
GetProcAddress.KERNEL32 ref: 00007FFE0E14D304
RtlInitUnicodeString.NTDLL ref: 00007FFE0E14D3A3
LdrLoadDll.NTDLL ref: 00007FFE0E14D3B3

Strings

J*!=, xrefs: 00007FFE0E14D1FF
jt+9, xrefs: 00007FFE0E14D322

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: HandleThread$CloseContext$AddressCreateCurrentExceptionFirstHandlerInitLoadModuleOpenProcProcessSnapshotStringThread32Toolhelp32UnicodeVectoredmemset
String ID: J*!=$jt+9
API String ID: 3419048117-242937532
Opcode ID: a9628e8f766383207b41f0b76916dcf45cde8c8b4db2eb96fa1eba45f2c1ec0d
Instruction ID: d1f3e824dc2ef7e7fccb7f6ab6f49cfe4c63fe7e469a0700dea47e5572a20720
Opcode Fuzzy Hash: a9628e8f766383207b41f0b76916dcf45cde8c8b4db2eb96fa1eba45f2c1ec0d
Instruction Fuzzy Hash: ADA18FA2B09B4292EE10DB11F8443BA63A1FF84B94F844537DA8E077A8DF3CE546C340

Function 00007FFE0E13D310 Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 229COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E1395B0: memcpy.MSVCRT ref: 00007FFE0E13960B

memcpy.MSVCRT ref: 00007FFE0E13D527

Strings

ValueError, xrefs: 00007FFE0E13D56F
invalid , xrefs: 00007FFE0E13D59D
strformat.nim, xrefs: 00007FFE0E13D667
tring fo, xrefs: 00007FFE0E13D5C6
, expect, xrefs: 00007FFE0E13D5E2
format s, xrefs: 00007FFE0E13D5B8
ed 's', , xrefs: 00007FFE0E13D5F0
r string, xrefs: 00007FFE0E13D5D4
but got , xrefs: 00007FFE0E13D5FE
formatValue, xrefs: 00007FFE0E13D67D
type in , xrefs: 00007FFE0E13D5A7

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy
String ID: , expect$ValueError$but got $ed 's', $format s$formatValue$invalid $r string$strformat.nim$tring fo$type in
API String ID: 3510742995-1773161451
Opcode ID: 3b737671fdecec1ccda9928ca60f407ce4e1cf31fb0526f2aeb49fa47f716a7c
Instruction ID: 2b1e73820ed8ecfebfca614a9b5ffa596e317c80d73e65a884f85d03059282aa
Opcode Fuzzy Hash: 3b737671fdecec1ccda9928ca60f407ce4e1cf31fb0526f2aeb49fa47f716a7c
Instruction Fuzzy Hash: 5A9101A2B08A4282EB15CB25F41477E36A0EB85B84F419133EE9D077E1DF7DE880C341

Function 00007FFE0E1347A0 Relevance: 14.3, APIs: 11, Instructions: 504COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E1348E6

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 8833e5876ba722ff6c55536d39e65e07ac13d76a2c30ec7d9c4d34630e55e252
Instruction ID: ef3c6ce9a40ef6aead49c06c1adc3db59f5d49e4f3a8b10ffdc61df622f7cef0
Opcode Fuzzy Hash: 8833e5876ba722ff6c55536d39e65e07ac13d76a2c30ec7d9c4d34630e55e252
Instruction Fuzzy Hash: F2223CB6A25B5A82DB549F29D0403AD3765FB48FC8F405032DEAD1B3A9EF79E485C340

Function 00007FFE0E14A350 Relevance: 11.0, APIs: 7, Instructions: 544COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E1395B0: memcpy.MSVCRT ref: 00007FFE0E13960B

_setjmp.MSVCRT ref: 00007FFE0E14A3E0
_setjmp.MSVCRT ref: 00007FFE0E14A4DF
CLRCreateInstance.MSCOREE ref: 00007FFE0E14A596
_setjmp.MSVCRT ref: 00007FFE0E14A61B
_setjmp.MSVCRT ref: 00007FFE0E14A67E

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: _setjmp$CreateInstancememcpy
String ID:
API String ID: 1399768382-0
Opcode ID: 49ac5ef823a84596ff31e852dd8982470d31eea043c91aa51cc8c9ce90597c40
Instruction ID: bf6d9cee1b7d1fce2820102b7a23fef7557f02abfc18a4c308ce55da2ccf30db
Opcode Fuzzy Hash: 49ac5ef823a84596ff31e852dd8982470d31eea043c91aa51cc8c9ce90597c40
Instruction Fuzzy Hash: 975246B6A09B8691EB609B15E4503AA73A1FF84B84F458133DACE477B8EF3CE545C740

Function 00007FFE0E15505A Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 1364COMMON

Download Yara Rule

Strings

Infinity, xrefs: 00007FFE0E15515D
NaN, xrefs: 00007FFE0E15518E

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID:
String ID: Infinity$NaN
API String ID: 0-4285296124
Opcode ID: 2309f461be310f35730d3e23802c4fafe742c0745b2dad148695cb11957a8981
Instruction ID: 2cc431693c110d5af33532649cdea8860afb3b41c798e8386d3c5ba04ea46c4e
Opcode Fuzzy Hash: 2309f461be310f35730d3e23802c4fafe742c0745b2dad148695cb11957a8981
Instruction Fuzzy Hash: 70E2E533A14B85CEE751CF79C4442AD37A6FB45788F108236EA4D5BBA9DB78E481CB40

Function 00007FFE0E13DD80 Relevance: 3.2, Strings: 2, Instructions: 656COMMON

Download Yara Rule

Strings

"""""""", xrefs: 00007FFE0E13E7D4
DDDDDDDD, xrefs: 00007FFE0E13E7E6

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID:
String ID: """"""""$DDDDDDDD
API String ID: 0-1621327129
Opcode ID: 7f47960f10962cb472b862ac8583192cd9337daafb42ac3aa465280148bd6481
Instruction ID: bb988797a30864d059d08bbacb317fb830ccb5a3c53ff94cf77dbeb7b638dc84
Opcode Fuzzy Hash: 7f47960f10962cb472b862ac8583192cd9337daafb42ac3aa465280148bd6481
Instruction Fuzzy Hash: 24425B62718BD485E660CFA1B92179BB7A1F7897D4F04A626EECC67F18DB3CD0518B00

Function 00007FFE0E137CE0 Relevance: 2.8, Strings: 2, Instructions: 307COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00007FFE0E137D1C, 00007FFE0E137F86
c, xrefs: 00007FFE0E137CFE

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$c
API String ID: 0-131350621
Opcode ID: e340d7e56e4692bb5786cda8b84092ee4f54f2b7db2075c6980ad0bfea6462c1
Instruction ID: 01ed7f31a9ea24a76443f715adc0e95c77579ef38a9d2f6322556f0dcccbb2a9
Opcode Fuzzy Hash: e340d7e56e4692bb5786cda8b84092ee4f54f2b7db2075c6980ad0bfea6462c1
Instruction Fuzzy Hash: D3B1D796B14B5946EE248B3998013BE7651EB58BE4F548333EEBD873E4EA7CE504C300

Function 00007FFE0E13D760 Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

UUUUUUUU, xrefs: 00007FFE0E13D772
33333333, xrefs: 00007FFE0E13D828

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID:
String ID: 33333333$UUUUUUUU
API String ID: 0-3483174168
Opcode ID: 441117c694ab834bf65894c7cf1b76a728a697286da176495cad2e6614abf1fb
Instruction ID: ce635fbe03f273c4060d4f95008f9c0126ce9dda3d0ee2486fa34e039c3354eb
Opcode Fuzzy Hash: 441117c694ab834bf65894c7cf1b76a728a697286da176495cad2e6614abf1fb
Instruction Fuzzy Hash: 7D41C3E3B70BB895EA01CF559905AD56761F314FE8A19E026DF0E3BB0EC638DA47C241

Function 00007FFE0E140B70 Relevance: 2.4, Strings: 1, Instructions: 1166COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFE0E14162F

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 58eec61b0fce6bff770a7f4d666c12284ade7261e7a004fbc32f0a8f4b18339a
Instruction ID: 8082d9e7327b19849bad2eb26df8d68ec5752dd43fe7595db0a99f38d7dfb0cd
Opcode Fuzzy Hash: 58eec61b0fce6bff770a7f4d666c12284ade7261e7a004fbc32f0a8f4b18339a
Instruction Fuzzy Hash: A88208A3724BD442FA11CBB569327E7E351FB99BC4F04B222EE8D27B19DA3CD1419604

Function 00007FFE0E13FC60 Relevance: 1.7, APIs: 1, Instructions: 466COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E13FD00

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 3c289374dc0602da4094f4b3e91c7ea0ca76e51020ebd8990796c05a85a45c94
Instruction ID: 490a2195da4b8b8b1042b37527c3cf640184af70e1aa8184bfe1d29233a39a11
Opcode Fuzzy Hash: 3c289374dc0602da4094f4b3e91c7ea0ca76e51020ebd8990796c05a85a45c94
Instruction Fuzzy Hash: 67023B23E24FC104E746467DBC029F57A059FE73E4B49D326FAA792FE6CA64D3068244

Function 00007FFE0E14FFC0 Relevance: 1.6, Strings: 1, Instructions: 346COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFE0E1503D8

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a5482531008f66ad118c62eb3fea4e08a44aa0f25f2557dd40036cffbec3998c
Instruction ID: 7313992baf599cc2ab6321cad58922c5075cf500768fdeaf7844d833f9f1e4ac
Opcode Fuzzy Hash: a5482531008f66ad118c62eb3fea4e08a44aa0f25f2557dd40036cffbec3998c
Instruction Fuzzy Hash: BAE1ADA3A09B99C2EE909F45D5587AA33A9FF48BC4F054536DE8D077A5DF38E881C300

Function 00007FFE0E137870 Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00007FFE0E1378A4, 00007FFE0E137AF6

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
API String ID: 0-2272463933
Opcode ID: 10d5fe361e85f25da197178b78d998a42f6e716d6a3dc1e380e21bc638164139
Instruction ID: a301aec411d849e155d93acd0d348cf7341326b509e0927f75362b7882168450
Opcode Fuzzy Hash: 10d5fe361e85f25da197178b78d998a42f6e716d6a3dc1e380e21bc638164139
Instruction Fuzzy Hash: E0A1C5D7F1469981EE609B2A980127E3661BB95BE0F548333EEBD437E4E93CE645C300

Function 00007FFE0E14B640 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: Initialize$ArraySafe_setjmp$AllocCreateElementStringmemset
String ID:
API String ID: 3120011687-0
Opcode ID: db1fd1c3ab73ffda1965cf88b46968f15bc7b3f8479b6e35a7ef9fd5872a79be
Instruction ID: 5317b05fd811cc42ed5859cb01346d3c110a673033938ce1c614924824e4495d
Opcode Fuzzy Hash: db1fd1c3ab73ffda1965cf88b46968f15bc7b3f8479b6e35a7ef9fd5872a79be
Instruction Fuzzy Hash: DB22A662A1CBD685E725CB74E411BAA7BA0F745788F404236EACD03BA5CF7CE145CB40

Function 00007FFE0E135E40 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865bdca27666f05459e3a4654917e4fe474d7f3810578d5aefd4b828c6e4451e
Instruction ID: 798e23d5c8c9c8c9e7ac2c0a0bfda30c7bcc2bba0e2e7894b053a01478156a6b
Opcode Fuzzy Hash: 865bdca27666f05459e3a4654917e4fe474d7f3810578d5aefd4b828c6e4451e
Instruction Fuzzy Hash: D6A186A6B04B9582EE54CB26D4497AA77AAFB94F84F454437DE9E073A1DF38E484C300

Function 00007FFE0E13D970 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e728d3a4eb32ca9e2495c8a909e21b47505aa6a3e8fa849587d970dafa8d858
Instruction ID: 4d9fb04d4b8faa91147cd29a4c87f1cae50be2956427299c29d0f24f56abf9aa
Opcode Fuzzy Hash: 4e728d3a4eb32ca9e2495c8a909e21b47505aa6a3e8fa849587d970dafa8d858
Instruction Fuzzy Hash: CD910D63318BE485E660CFA1B921B8BA7A5F389BD4F556025EECC57B18CB3CD455CB00

Function 00007FFE0E13BD80 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 07d993c8840e344863858bdc0ef3939090e20d3d94aff34fc09b80d278887b35
Instruction ID: e2a1c6a154587ec2397193ba3993f03c5ae0902e86f95323eb0ff1b3cb2620c2
Opcode Fuzzy Hash: 07d993c8840e344863858bdc0ef3939090e20d3d94aff34fc09b80d278887b35
Instruction Fuzzy Hash: 2EA13A37A1C6CB82EF1E8F3980101BC7F50AB49B48B45C23BDE9A13396D66CD7458752

Function 00007FFE0E135770 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35101741505c06d83e356add1bbbeb86e29ee3cc90c3769817f5699dc250d040
Instruction ID: 8ecb1840716cb2033e88c76a1a13ad5f26f0d34c6e0e7cf77243aec244eb67c0
Opcode Fuzzy Hash: 35101741505c06d83e356add1bbbeb86e29ee3cc90c3769817f5699dc250d040
Instruction Fuzzy Hash: 7581CBA2B18B9582EE548F26D4846B93766FB54FD4F494477CE8E177A1DE3CE881C300

Function 00007FFE0E139290 Relevance: 28.1, APIs: 6, Strings: 10, Instructions: 89stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FFE0E139393
exit.MSVCRT ref: 00007FFE0E1393A8
signal.MSVCRT ref: 00007FFE0E1393C5
signal.MSVCRT ref: 00007FFE0E1393D2
signal.MSVCRT ref: 00007FFE0E1393DF
signal.MSVCRT ref: 00007FFE0E1393EC

Strings

SIGINT: Interrupted by Ctrl-C., xrefs: 00007FFE0E139346
SIGSEGV: Illegal storage access. (Attempt to read from nil?), xrefs: 00007FFE0E139352
sysFatal, xrefs: 00007FFE0E139325
unknown signal, xrefs: 00007FFE0E139379, 00007FFE0E1393B0
5, xrefs: 00007FFE0E13930F
SIGFPE: Arithmetic error., xrefs: 00007FFE0E13936A
fatal.nim, xrefs: 00007FFE0E139318
SIGILL: Illegal operation., xrefs: 00007FFE0E139380
ReraiseDefect, xrefs: 00007FFE0E1392BA
SIGABRT: Abnormal termination., xrefs: 00007FFE0E13935E

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: signal$exitstrlen
String ID: 5$ReraiseDefect$SIGABRT: Abnormal termination.$SIGFPE: Arithmetic error.$SIGILL: Illegal operation.$SIGINT: Interrupted by Ctrl-C.$SIGSEGV: Illegal storage access. (Attempt to read from nil?)$fatal.nim$sysFatal$unknown signal
API String ID: 1414789275-2829261224
Opcode ID: b6e0bdcc391af1caf04f3276b165d43eeb7e1cd316d219e9f57022f1951daea0
Instruction ID: a7053e46752a173a43a732335e2fd9168a531fd799413bc9e0b354a34205d696
Opcode Fuzzy Hash: b6e0bdcc391af1caf04f3276b165d43eeb7e1cd316d219e9f57022f1951daea0
Instruction Fuzzy Hash: 5D315C66E18A02E0FA18AB25E8596BDB365BF45784F880437EE9D473F5DF3CA644C340

Function 00007FFE0E14E250 Relevance: 26.5, APIs: 3, Strings: 12, Instructions: 203libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

LoadLibraryA.KERNEL32 ref: 00007FFE0E14E5B3
GetProcAddress.KERNEL32 ref: 00007FFE0E14E5DC
LoadLibraryA.KERNEL32 ref: 00007FFE0E14E5F2

Strings

OpenProcess, xrefs: 00007FFE0E14E626
key5, xrefs: 00007FFE0E14E465
treadHandle3, xrefs: 00007FFE0E14E2FE
NtFlushInstructionCache4, xrefs: 00007FFE0E14E33F
tProcess1, xrefs: 00007FFE0E14E2D4
:state, xrefs: 00007FFE0E14E2C0
cipher, xrefs: 00007FFE0E14E492
RtlGetVersion, xrefs: 00007FFE0E14E5C8
dctx6, xrefs: 00007FFE0E14E4F0
remoteProcID2, xrefs: 00007FFE0E14E2E4
GetFileAttributesW, xrefs: 00007FFE0E14E603
kernel32.dll, xrefs: 00007FFE0E14E5EB

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy$LibraryLoad$AddressProc
String ID: :state$GetFileAttributesW$NtFlushInstructionCache4$OpenProcess$RtlGetVersion$cipher$dctx6$kernel32.dll$key5$remoteProcID2$tProcess1$treadHandle3
API String ID: 3980900384-2224378161
Opcode ID: 5024ca8dcfbd9f7da15cbb3ce75fc2b1b4ac0722f133e5d66a90e89f756bd335
Instruction ID: 38a1b40b4bd4aa54716553016ded1f9e1eec2551bd6e2a1a233d381790414c33
Opcode Fuzzy Hash: 5024ca8dcfbd9f7da15cbb3ce75fc2b1b4ac0722f133e5d66a90e89f756bd335
Instruction Fuzzy Hash: 9CB10321A19B4385FB129B28A9403A573A2FF55744F84527BCDDC563B2EF7DB289C380

Function 00007FFE0E1464C0 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 202COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FFE0E1464E2

Strings

0 .., xrefs: 00007FFE0E146711
paramStr, xrefs: 00007FFE0E14660A
IndexDefect, xrefs: 00007FFE0E146587
not in , xrefs: 00007FFE0E1466F7
os.nim, xrefs: 00007FFE0E1465F4
not in , xrefs: 00007FFE0E14676F
inde, xrefs: 00007FFE0E146808
0 .., xrefs: 00007FFE0E146818
not in , xrefs: 00007FFE0E1467D7

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: CommandLine
String ID: not in $ not in $ not in $0 ..$0 ..$IndexDefect$inde$os.nim$paramStr
API String ID: 3253501508-369068400
Opcode ID: 176fa0095b720560e638bb860fa3f59553cefa47951e64ab9f53068569c9af63
Instruction ID: c75b100ea3c77a68e98ffa9a6a52b1f7038a7919dc14654df91ce1f41104dd78
Opcode Fuzzy Hash: 176fa0095b720560e638bb860fa3f59553cefa47951e64ab9f53068569c9af63
Instruction Fuzzy Hash: 719167B2A09B4281EB11DF15E9483A97BA4FF85B94F458037DA9D0B3A5EF3CE505C380

Function 00007FFE0E146140 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E136B50: memset.MSVCRT ref: 00007FFE0E136BE2

FormatMessageW.KERNEL32 ref: 00007FFE0E1461B5
memcpy.MSVCRT ref: 00007FFE0E146329
LocalFree.KERNEL32 ref: 00007FFE0E1463D2

Strings

OS error, xrefs: 00007FFE0E146363
unknown , xrefs: 00007FFE0E146449
OS error, xrefs: 00007FFE0E146453
unknown , xrefs: 00007FFE0E14636D
al info:, xrefs: 00007FFE0E1462AD
OSError, xrefs: 00007FFE0E146173
Addition, xrefs: 00007FFE0E14629A

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: FormatFreeLocalMessagememcpymemset
String ID: Addition$OS error$OS error$OSError$al info:$unknown $unknown
API String ID: 4084645559-3457963805
Opcode ID: e43746b6d3e31976e80ed3e78efbe06e3184e3a06d24456f847f49f2a0480dcd
Instruction ID: 1cccb3bbc91015aeeee5e269373db9da998e94715edf409a3f9cc118bffac880
Opcode Fuzzy Hash: e43746b6d3e31976e80ed3e78efbe06e3184e3a06d24456f847f49f2a0480dcd
Instruction Fuzzy Hash: C38189B6B09B5681EE519B19E45877E37A8FF85B88F14843BDA8C073A5EF38D544C380

Function 00007FFE0E149DA0 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 175memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E13C390: MultiByteToWideChar.KERNEL32 ref: 00007FFE0E13C3E7
Part of subcall function 00007FFE0E13C390: MultiByteToWideChar.KERNEL32 ref: 00007FFE0E13C44A

SysAllocString.OLEAUT32 ref: 00007FFE0E149DDE
_setjmp.MSVCRT ref: 00007FFE0E149E34
CoInitialize.OLE32 ref: 00007FFE0E149FF0

Part of subcall function 00007FFE0E136B50: memset.MSVCRT ref: 00007FFE0E136BE2

memcpy.MSVCRT ref: 00007FFE0E149FA2
SysFreeString.OLEAUT32 ref: 00007FFE0E14A071

Strings

unable t, xrefs: 00007FFE0E149F2B
specifi, xrefs: 00007FFE0E149F4F
ed membe, xrefs: 00007FFE0E149F5D
o invoke, xrefs: 00007FFE0E149F35
r: , xrefs: 00007FFE0E149F73

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: ByteCharMultiStringWide$AllocFreeInitialize_setjmpmemcpymemset
String ID: specifi$ed membe$o invoke$r: $unable t
API String ID: 909372610-4084315218
Opcode ID: e426f8c4deaaf8e3db560116b79f21edf749721eaba173ae76d85139aeb9888e
Instruction ID: 3608184739cf9a4ce5186de14096b6b2228846c6f17fbbf68c7013223949e7e0
Opcode Fuzzy Hash: e426f8c4deaaf8e3db560116b79f21edf749721eaba173ae76d85139aeb9888e
Instruction Fuzzy Hash: E0A1B376609F8681EB60CF15E8943AAB7A4FB88B80F448136DACD47B69DF7CD454CB40

Function 00007FFE0E141E50 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 90libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E141E60
GetProcAddress.KERNEL32 ref: 00007FFE0E141E8D
GetProcAddress.KERNEL32 ref: 00007FFE0E141EB3

Strings

kernel32, xrefs: 00007FFE0E141E59
LocalFree, xrefs: 00007FFE0E141F11
GetModuleFileNameW, xrefs: 00007FFE0E141E9F
FormatMessageW, xrefs: 00007FFE0E141EEB
GetLastError, xrefs: 00007FFE0E141F37
GetCurrentDirectoryW, xrefs: 00007FFE0E141EC5
GetCommandLineW, xrefs: 00007FFE0E141E79

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: FormatMessageW$GetCommandLineW$GetCurrentDirectoryW$GetLastError$GetModuleFileNameW$LocalFree$kernel32
API String ID: 2238633743-3391179580
Opcode ID: 1287cbde34c9a01a5778edf70d3b897d3a7a108950112f86db042cfb1d222104
Instruction ID: 1a3c7d1cdd112e4c16a35ba3fc7ffd52b4cc74f30727a0f6db4887a477b311ce
Opcode Fuzzy Hash: 1287cbde34c9a01a5778edf70d3b897d3a7a108950112f86db042cfb1d222104
Instruction Fuzzy Hash: 9E312FA5B0AA0390EE45D71279544B663A1BF49BC8B84047BDCCD4B3B5EE3CA449E394

Function 00007FFE0E1489C0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E1489E2
SafeArrayCreate.OLEAUT32 ref: 00007FFE0E148A52
SafeArrayPutElement.OLEAUT32 ref: 00007FFE0E148AAD

Strings

com.nim, xrefs: 00007FFE0E148BEE
toVariant, xrefs: 00007FFE0E148C04
VariantConversionError, xrefs: 00007FFE0E148B77

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: c08b0d58058a0f32ae0a1837bf93386a5446338a07ec94b11b969de91180961c
Instruction ID: 77c4aba7d489da3a5bcb68e766c46eb7d55baee26957496e03fcf80fb2983331
Opcode Fuzzy Hash: c08b0d58058a0f32ae0a1837bf93386a5446338a07ec94b11b969de91180961c
Instruction Fuzzy Hash: 1B81ADA2B0AB4295EA54AB15E8587BE67A1FF40B80F944437EACD073B1DF7CE446C340

Function 00007FFE0E149600 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E149622
SafeArrayCreate.OLEAUT32 ref: 00007FFE0E149692
SafeArrayPutElement.OLEAUT32 ref: 00007FFE0E1496ED

Strings

com.nim, xrefs: 00007FFE0E14982E
toVariant, xrefs: 00007FFE0E149844
VariantConversionError, xrefs: 00007FFE0E1497B7

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: 77a330c70f31aafe8eac7d8a143992661a41d3b79795a8f6de167adef57fb92c
Instruction ID: cf9360ad58d506b4d4411ee2f788713b9d940a7b0920e67bde18c9f8771412e8
Opcode Fuzzy Hash: 77a330c70f31aafe8eac7d8a143992661a41d3b79795a8f6de167adef57fb92c
Instruction Fuzzy Hash: 128157A2B0AB4791EB109B15E9586BE63A1FF84B84F844537DA9D073B5DF3CE845C380

Function 00007FFE0E148270 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E148292
SafeArrayCreate.OLEAUT32 ref: 00007FFE0E148302
SafeArrayPutElement.OLEAUT32 ref: 00007FFE0E148358

Strings

com.nim, xrefs: 00007FFE0E148476
toVariant, xrefs: 00007FFE0E14848C
VariantConversionError, xrefs: 00007FFE0E1483FF

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: 697b9fa782d9ff8b20fb0e63cbcfd5e65f50ec7fbf6534a61681d9b41f57343c
Instruction ID: 3b37c313002a21b2ad2d699b6e3e66c0c83775dd160362aac333aefe52bf781d
Opcode Fuzzy Hash: 697b9fa782d9ff8b20fb0e63cbcfd5e65f50ec7fbf6534a61681d9b41f57343c
Instruction Fuzzy Hash: 75718CA2B0AB0695EA55AB05E9587BE63A1FF44B84F844537EACD073B0DF3CE441C380

Function 00007FFE0E13CA70 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 333COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E13CDFE

Strings

ValueError, xrefs: 00007FFE0E13CBEA
tring, c, xrefs: 00007FFE0E13CDB5
strformat.nim, xrefs: 00007FFE0E13CE43
format s, xrefs: 00007FFE0E13CDA4
invalid , xrefs: 00007FFE0E13CD9A
annot pa, xrefs: 00007FFE0E13CDC3
., xrefs: 00007FFE0E13CB98
parseStandardFormatSpecifier, xrefs: 00007FFE0E13CE59
rse:, xrefs: 00007FFE0E13CDE0

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy
String ID: .$ValueError$annot pa$format s$invalid $parseStandardFormatSpecifier$rse:$strformat.nim$tring, c
API String ID: 3510742995-876510697
Opcode ID: 06778b7551d1d1e2799e8a2043c97a13a64522767c93a9a919c662244adb7339
Instruction ID: 7776b066975a9f385217b065751afe5a250ae8ace22864d0174df733bc84a7c0
Opcode Fuzzy Hash: 06778b7551d1d1e2799e8a2043c97a13a64522767c93a9a919c662244adb7339
Instruction Fuzzy Hash: 50E1D2A2A0879596EB148B3495003E9BBA1FB157D4F488633DAAC277E9DB3CE145C390

Function 00007FFE0E1389D0 Relevance: 15.2, APIs: 6, Strings: 4, Instructions: 194stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E138A7A
strlen.MSVCRT ref: 00007FFE0E138AAE
strlen.MSVCRT ref: 00007FFE0E138AEF
strlen.MSVCRT ref: 00007FFE0E138C16
memcpy.MSVCRT ref: 00007FFE0E138C36
strlen.MSVCRT ref: 00007FFE0E138C3E

Strings

nhandled, xrefs: 00007FFE0E138A2C
Error: u, xrefs: 00007FFE0E138A1B
on: , xrefs: 00007FFE0E138A47
excepti, xrefs: 00007FFE0E138A39

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: strlen$memcpy
String ID: excepti$Error: u$nhandled$on:
API String ID: 3396830738-1220997370
Opcode ID: 620df2181a99c2d9f432fa450793f222c34056ad9a437eb17abca127aa62c4ed
Instruction ID: 0860cd6b5c6136fceca5f0858951ba55b5e27d08b3b4de618a5f36831518e937
Opcode Fuzzy Hash: 620df2181a99c2d9f432fa450793f222c34056ad9a437eb17abca127aa62c4ed
Instruction Fuzzy Hash: 0981C162B19A8686FB299B25D4113BA7361FF44B84F888537EB8D177E5EF2CE505C300

Function 00007FFE0E146830 Relevance: 15.2, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E1468E2
memcpy.MSVCRT ref: 00007FFE0E146A52
memcpy.MSVCRT ref: 00007FFE0E146A94

Part of subcall function 00007FFE0E137040: memcpy.MSVCRT ref: 00007FFE0E1370DC

Strings

VED|, xrefs: 00007FFE0E1469B5
VT_VECTO, xrefs: 00007FFE0E14694C
VT_ARRAY, xrefs: 00007FFE0E14687D
VT_ARRAY, xrefs: 00007FFE0E146B00
VT_ARRAY, xrefs: 00007FFE0E146A28
VT_RESER, xrefs: 00007FFE0E146998
VT_BYREF, xrefs: 00007FFE0E146908

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy
String ID: VED|$VT_ARRAY$VT_ARRAY$VT_ARRAY$VT_BYREF$VT_RESER$VT_VECTO
API String ID: 3510742995-291823325
Opcode ID: aec648f9a95a20fb432d11329cea1dfd7ef1e45c34c68d363635f803f7b74143
Instruction ID: aee1af98b61cc4981106b5ef7f74e08e1f7bbb9a1864352cea63abcd810622de
Opcode Fuzzy Hash: aec648f9a95a20fb432d11329cea1dfd7ef1e45c34c68d363635f803f7b74143
Instruction Fuzzy Hash: 4E7158B2708B4A85EB119F15E8443AA77A4FB95B88F598037DF8D0B3A1EE7CD544C300

Function 00007FFE0E144610 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E144620
GetProcAddress.KERNEL32 ref: 00007FFE0E144649
GetProcAddress.KERNEL32 ref: 00007FFE0E14466B

Strings

CreateToolhelp32Snapshot, xrefs: 00007FFE0E144635
Thread32First, xrefs: 00007FFE0E144657
Thread32Next, xrefs: 00007FFE0E144679
kernel32, xrefs: 00007FFE0E144619

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateToolhelp32Snapshot$Thread32First$Thread32Next$kernel32
API String ID: 2238633743-3935561650
Opcode ID: 6c442825502bc7901ecd661716a16d1c8b49b900e669c40a7a4c98e00781447f
Instruction ID: e2279771b7ff47ad42abcbd4b35610a98292c3fefe455890bd81f046e47ab824
Opcode Fuzzy Hash: 6c442825502bc7901ecd661716a16d1c8b49b900e669c40a7a4c98e00781447f
Instruction Fuzzy Hash: B0113DA5B0EA0390FE159722BD1457A63A1BF49B84F980877CCED473B0EE7CA046D350

Function 00007FFE0E1314A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFE0E1314B9
LoadLibraryA.KERNEL32 ref: 00007FFE0E1314CA
GetProcAddress.KERNEL32 ref: 00007FFE0E1314E8
GetProcAddress.KERNEL32 ref: 00007FFE0E1314F8

Strings

libgcc_s_dw2-1.dll, xrefs: 00007FFE0E1314AF
__deregister_frame_info, xrefs: 00007FFE0E1314EB
__register_frame_info, xrefs: 00007FFE0E1314D7

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: 4b359fa39a413980578f20d51ef9706400725c07471b7bbc5a8fdffd70197d7b
Instruction ID: d19d629a3b53e0613472d1ea1b25a2e68c325c9ec19438d3f450bfa31d0aa70a
Opcode Fuzzy Hash: 4b359fa39a413980578f20d51ef9706400725c07471b7bbc5a8fdffd70197d7b
Instruction Fuzzy Hash: EF01C561A5AA07E0EA169B15BC505B933A5BF49788F840533DCDD43270EF3CE149D340

Function 00007FFE0E13B7F0 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E13B8DB

Strings

integer:, xrefs: 00007FFE0E13B899
ValueError, xrefs: 00007FFE0E13B857, 00007FFE0E13B963
invalid , xrefs: 00007FFE0E13B9A8
strutils.nim, xrefs: 00007FFE0E13B923
parseInt, xrefs: 00007FFE0E13B939
invalid , xrefs: 00007FFE0E13B8AA
integer:, xrefs: 00007FFE0E13B993

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy
String ID: ValueError$integer:$integer:$invalid $invalid $parseInt$strutils.nim
API String ID: 3510742995-2575869123
Opcode ID: 15bf003bdc77111694311591c6e8ce157c1d6e781086ecfc85e6e3deb4704f3f
Instruction ID: 5a9a41dc9289ddd13fb2f5b9cfcd51a7063a2017a68e2d04a786aa847ba646f9
Opcode Fuzzy Hash: 15bf003bdc77111694311591c6e8ce157c1d6e781086ecfc85e6e3deb4704f3f
Instruction Fuzzy Hash: A9413672A09B0AD1EA209F25E8547AA73A4FF48B84F848437DACD477A5EF7CE545C340

Function 00007FFE0E13CFC0 Relevance: 11.5, APIs: 9, Instructions: 220COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FFE0E13D06B
memcpy.MSVCRT ref: 00007FFE0E13D0B1
memcpy.MSVCRT ref: 00007FFE0E13D0CD

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 9a95c766a421aee8bda3d61193bee614ed9ff932fcd03d974b4030aef223b19b
Instruction ID: 41aeaf78b52ac6210492a8ff25d33e0c52ba71c80a6da48fe58a854cd26ec7ec
Opcode Fuzzy Hash: 9a95c766a421aee8bda3d61193bee614ed9ff932fcd03d974b4030aef223b19b
Instruction Fuzzy Hash: D381C062B09A5681EE05EB25E8052BE77A1BF84F84F468533EE5D173A6EF3CE545C300

Function 00007FFE0E14BF00 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E14BF52
SafeArrayCreate.OLEAUT32 ref: 00007FFE0E14BFC0
SafeArrayPutElement.OLEAUT32 ref: 00007FFE0E14BFFD

Strings

com.nim, xrefs: 00007FFE0E14C0DC
toVariant, xrefs: 00007FFE0E14C0F2
VariantConversionError, xrefs: 00007FFE0E14C05F

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: 9eae0cf97d50d8a67c4e201ceeba8e2c2a17758a0522804396163c04e92e8b07
Instruction ID: 94c0ce4550d521aa69181214f9235ea93ed49713d9e6e50d5c96af1dc0b70f1f
Opcode Fuzzy Hash: 9eae0cf97d50d8a67c4e201ceeba8e2c2a17758a0522804396163c04e92e8b07
Instruction Fuzzy Hash: 876136A2B0AB0291FA159B15A8187BE63A1FF85B84F544537DADD073B1EF3DE445C380

Function 00007FFE0E144CB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E144D49
memcpy.MSVCRT ref: 00007FFE0E144D89

Strings

convert , xrefs: 00007FFE0E144E2C
from, xrefs: 00007FFE0E144E55
convert , xrefs: 00007FFE0E144DD7
to , xrefs: 00007FFE0E144E60
convert , xrefs: 00007FFE0E144D15

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpy
String ID: to $convert $convert $convert $from
API String ID: 3510742995-220309676
Opcode ID: dc9e2aa1a007e4dd8d834762d87609655c69aa9ff4af3a690f529dd9e52cdbfa
Instruction ID: 46eab1de0f5cbbf42e484e6d0fad7764f6ac1a23ede92afb688f0b11b2e74fd2
Opcode Fuzzy Hash: dc9e2aa1a007e4dd8d834762d87609655c69aa9ff4af3a690f529dd9e52cdbfa
Instruction Fuzzy Hash: 9E4159B2A09B4681EB05DF15D5483987BA1FB94B80F4A8037DB9C5B3A5EFB8D510C780

Function 00007FFE0E13C940 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13C950
GetProcAddress.KERNEL32 ref: 00007FFE0E13C979
GetProcAddress.KERNEL32 ref: 00007FFE0E13C99B

Strings

GetForegroundWindow, xrefs: 00007FFE0E13C965
GetWindowThreadProcessId, xrefs: 00007FFE0E13C987
user32, xrefs: 00007FFE0E13C949

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetForegroundWindow$GetWindowThreadProcessId$user32
API String ID: 2238633743-4060728576
Opcode ID: 099e45388bdc18e5a7f021420b8990e432f484574424dfb494841c910785b762
Instruction ID: 630a981e584bdba30fab39d1ae15849b5d385d5a2824ec11c675f526db689beb
Opcode Fuzzy Hash: 099e45388bdc18e5a7f021420b8990e432f484574424dfb494841c910785b762
Instruction Fuzzy Hash: 97011A65A5AB03D0EE459B22BC5457AB3A2BF49B84F88457BDCCD873B0EE3CA044C355

Function 00007FFE0E148FA0 Relevance: 9.3, APIs: 6, Instructions: 285stringCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00007FFE0E14908D
_setjmp.MSVCRT ref: 00007FFE0E149227
VariantCopy.OLEAUT32 ref: 00007FFE0E1492CD
strlen.MSVCRT ref: 00007FFE0E149347
memcpy.MSVCRT ref: 00007FFE0E14938A

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: CopyFreeStringVariant_setjmpmemcpystrlen
String ID:
API String ID: 649350220-0
Opcode ID: 1c8747582f73588acd678ea3ed29cea2ab5c6abdbe1ab605578c608991d5d4c0
Instruction ID: 83f494b72e32496d6c2e9bf6150034332e80dd3b47d8dc8f56378582060d80d6
Opcode Fuzzy Hash: 1c8747582f73588acd678ea3ed29cea2ab5c6abdbe1ab605578c608991d5d4c0
Instruction Fuzzy Hash: 73D138B6A19B8681EA55CB16E4403AE73A1FBC8B94F448133EE9D077A9DF3CE441C340

Function 00007FFE0E13101D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_amsg_exit.MSVCRT ref: 00007FFE0E131102
_initterm.MSVCRT ref: 00007FFE0E131137
_initterm.MSVCRT ref: 00007FFE0E13115E
_amsg_exit.MSVCRT ref: 00007FFE0E131240

Strings

0, xrefs: 00007FFE0E131070

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: _amsg_exit_initterm
String ID: 0
API String ID: 194249164-4108050209
Opcode ID: efee7c7564053665e09315d1a3c1bf29b97e43912d1bab046c58282f71b617ec
Instruction ID: cf483ee752bba1ee092aa0b48df9fb5434bd270b85cf89d27e2af28b6a70408b
Opcode Fuzzy Hash: efee7c7564053665e09315d1a3c1bf29b97e43912d1bab046c58282f71b617ec
Instruction Fuzzy Hash: 3D719236B09B068AEB508B65E8903AC37B1BB49B88F504436DE8D977A9CF7DE540C740

Function 00007FFE0E1486A0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E1486B9
VariantCopy.OLEAUT32 ref: 00007FFE0E14870A

Strings

com.nim, xrefs: 00007FFE0E14879E
toVariant, xrefs: 00007FFE0E1487B4
VariantConversionError, xrefs: 00007FFE0E14872F

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: CopyInitializeVariant
String ID: VariantConversionError$com.nim$toVariant
API String ID: 633353902-3035603046
Opcode ID: d53b74f056ed678ce3979812d694a4fd568094c6bbedb9c3d2a401089230e449
Instruction ID: 461681aa21f6c7ccf9b375c3dad53e9ae85f69ce65ac773a99064d7fd5f7dd60
Opcode Fuzzy Hash: d53b74f056ed678ce3979812d694a4fd568094c6bbedb9c3d2a401089230e449
Instruction Fuzzy Hash: F24169A2B0A70790EA55AB19A91877E6394FF44B84F844937D9DC073B1DF3CE1468390

Function 00007FFE0E148080 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E148099
VariantCopy.OLEAUT32 ref: 00007FFE0E1480EA

Strings

com.nim, xrefs: 00007FFE0E14817E
newVariant, xrefs: 00007FFE0E148194
VariantConversionError, xrefs: 00007FFE0E14810F

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: CopyInitializeVariant
String ID: VariantConversionError$com.nim$newVariant
API String ID: 633353902-805458017
Opcode ID: 37dc1bba5de7eb6d8a84ede9a51d855650d8d586e6755152db3d4b614f213599
Instruction ID: ecc9d3259361cb518f91bb8b3c38e6b09ea3a35ff29167eee4a4fd90462cc2d7
Opcode Fuzzy Hash: 37dc1bba5de7eb6d8a84ede9a51d855650d8d586e6755152db3d4b614f213599
Instruction Fuzzy Hash: 0D414EA2B0AB4794EA55AB19A91877E6394FF44B84F844537D9DC073B1DF3CE046C390

Function 00007FFE0E145220 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 263COMMON

Download Yara Rule

Strings

T], xrefs: 00007FFE0E145530
T], xrefs: 00007FFE0E145570
.~&, xrefs: 00007FFE0E145379

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID:
String ID: .~&$T]$T]
API String ID: 0-361263744
Opcode ID: 1c310ccbf74c847df73c694cb3f318e6f7db29470bae7075e5a2e3ab811cc63c
Instruction ID: 737f3dd802abeea36cf84ed44e215d04f3f96e6f9b70bfb8c9c50e33c4859dab
Opcode Fuzzy Hash: 1c310ccbf74c847df73c694cb3f318e6f7db29470bae7075e5a2e3ab811cc63c
Instruction Fuzzy Hash: C8C1A0A2E1874292EA50DF54E8412BA7762FF80754F944433EA8E5B7B6EF3CE905C700

Function 00007FFE0E157F88 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 00007FFE0E157FAE
_unlock.MSVCRT ref: 00007FFE0E157FE9

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: _lock_unlock
String ID:
API String ID: 2848772494-0
Opcode ID: 839b6c95f21c298f95560e90b5800166fcecef062897bb39a6bf96ebd563a10a
Instruction ID: a91daa40c4a94aa909ffea281c5bd156041a777517c0243bf2c3d72c1b0da163
Opcode Fuzzy Hash: 839b6c95f21c298f95560e90b5800166fcecef062897bb39a6bf96ebd563a10a
Instruction Fuzzy Hash: F54198A7704B49C9EB048F6AD8813AC73A1F748BD8F448936EE6C477A8DF38D5508350

Function 00007FFE0E13A6D0 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00007FFE0E13A76E
signal.MSVCRT ref: 00007FFE0E13A77B
signal.MSVCRT ref: 00007FFE0E13A788
signal.MSVCRT ref: 00007FFE0E13A795
signal.MSVCRT ref: 00007FFE0E13A7A2

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: bf485fdfbc23fad22185c773462e25f357ff4534891f566f7045c9d656fb77c6
Instruction ID: 92b1b0121fdf782b0c5b44786352a90867d866971b827b6c1e96419257b0d640
Opcode Fuzzy Hash: bf485fdfbc23fad22185c773462e25f357ff4534891f566f7045c9d656fb77c6
Instruction Fuzzy Hash: FA112865A08A0294FA106B65E8027BA7365FF45B90FC45837E9DD173F6DF2CA262C304

Function 00007FFE0E131748 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

_fileno.MSVCRT ref: 00007FFE0E13176C
_setmode.MSVCRT ref: 00007FFE0E13177C
_fileno.MSVCRT ref: 00007FFE0E131788
_setmode.MSVCRT ref: 00007FFE0E131791
_fileno.MSVCRT ref: 00007FFE0E13179D

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: _fileno$_setmode
String ID:
API String ID: 2194614063-0
Opcode ID: b8499c141844f940aab8dce16dfdacb536d3285c549e13282d0a74ac03962638
Instruction ID: ef0d0c46a369d3c3b4741644165682ea344c24e22cd3aecf5669e34ba1b111e4
Opcode Fuzzy Hash: b8499c141844f940aab8dce16dfdacb536d3285c549e13282d0a74ac03962638
Instruction Fuzzy Hash: FAF01C11B1455542EF08A7B2BA6437E5A96AFD9BD0F18807B8D4E473D4ED3CD8424340

Function 00007FFE0E139450 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E1315B0: strlen.MSVCRT ref: 00007FFE0E1315C9
Part of subcall function 00007FFE0E1315B0: fwrite.MSVCRT ref: 00007FFE0E1315DC

GetLastError.KERNEL32 ref: 00007FFE0E1394A2
exit.MSVCRT ref: 00007FFE0E1394CA

Strings

(bad format; library may be wrong architecture), xrefs: 00007FFE0E1394D6
could not load: , xrefs: 00007FFE0E139470

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: ErrorLastexitfwritestrlen
String ID: (bad format; library may be wrong architecture)$could not load:
API String ID: 671075621-2754783905
Opcode ID: 117fd5a3a2a7ce401932fb2f3a82b0c514b2f1c3ea1c25d69b640083474da6a8
Instruction ID: 912da432add6e74778a2bdec200ba20ded235543e9cefd23af3096e229ffcebb
Opcode Fuzzy Hash: 117fd5a3a2a7ce401932fb2f3a82b0c514b2f1c3ea1c25d69b640083474da6a8
Instruction Fuzzy Hash: FD016252B1965791FE04B771E8553B86265AF85780F44413BDE8E473F6EE6CE400C301

Function 00007FFE0E13C9F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13C9FF
GetProcAddress.KERNEL32 ref: 00007FFE0E13CA21

Strings

kernel32, xrefs: 00007FFE0E13C9F8
AttachConsole, xrefs: 00007FFE0E13CA14

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: AttachConsole$kernel32
API String ID: 2574300362-374305082
Opcode ID: 960aa4397a13f9497081fe059081674e85d4f086b5cc47264218468e45188bc1
Instruction ID: 665f73e8cd5fb583f99a231c4d618fb360f3bc216d38f9cdee39dd6ab87e9412
Opcode Fuzzy Hash: 960aa4397a13f9497081fe059081674e85d4f086b5cc47264218468e45188bc1
Instruction Fuzzy Hash: B9F09A61A4AA02C0E949DB22BC4407672E6BF88B94F84057BCCCD463B0EF3CA185C340

Function 00007FFE0E13EC00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13EC0B
GetProcAddress.KERNEL32 ref: 00007FFE0E13EC27

Strings

Ws2_32.dll, xrefs: 00007FFE0E13EC04
inet_ntop, xrefs: 00007FFE0E13EC20

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Ws2_32.dll$inet_ntop
API String ID: 2574300362-2739477577
Opcode ID: 5960f70dcc3cb8590bd01532b6b5409507b56dd736a63677e676c6170141e528
Instruction ID: 2770fbf9e73e83282f27653529ab8f7d835d26911a596c3faf8ff1d072e33a94
Opcode Fuzzy Hash: 5960f70dcc3cb8590bd01532b6b5409507b56dd736a63677e676c6170141e528
Instruction Fuzzy Hash: 08E04224A5AA53C1EA5A9B15AD500A463E1BF59700F90407BC88D423B0EF7CA559C750

Function 00007FFE0E1381D0 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 332COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E136B50: memset.MSVCRT ref: 00007FFE0E136BE2

memcpy.MSVCRT ref: 00007FFE0E138484

Strings

[[rerais, xrefs: 00007FFE0E138648
]], xrefs: 00007FFE0E138628
ed from:, xrefs: 00007FFE0E138652

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpymemset
String ID: [[rerais$]]$ed from:
API String ID: 1297977491-96586220
Opcode ID: 90a0d65fc59c30596d76e004c169f122685fd9251a9e3b138b75c5044e9bbe11
Instruction ID: f7c80199c0b70cb48b408c1629cdcee2bae7ae9cbfd1150b626d2d80fd41c999
Opcode Fuzzy Hash: 90a0d65fc59c30596d76e004c169f122685fd9251a9e3b138b75c5044e9bbe11
Instruction Fuzzy Hash: 27E18776A09B8681EA648F25E4003AE77A8FB49B98F544637EEAD077E0DF3DD545C300

Function 00007FFE0E149920 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 204COMMON

Download Yara Rule

Strings

clr.nim, xrefs: 00007FFE0E149B95
clrError, xrefs: 00007FFE0E149B9C
CLRError, xrefs: 00007FFE0E14997A

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: memcpymemset
String ID: CLRError$clr.nim$clrError
API String ID: 1297977491-2830349459
Opcode ID: 10f23ab442f7161de1a4e5cab30c6324a6b80ed03321f59bc245b0addc95e8d4
Instruction ID: 8a7f37976afbcc7d8265fd4e740e01cbcc64f7f71c5c44684600640f3594a22a
Opcode Fuzzy Hash: 10f23ab442f7161de1a4e5cab30c6324a6b80ed03321f59bc245b0addc95e8d4
Instruction Fuzzy Hash: 3D91D6A2A0CB8685E7118B15D8006BE3BA0FB557A4F554272DFEC0B7E2DE3CE550C350

Function 00007FFE0E135460 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

virtualFree failing!, xrefs: 00007FFE0E135730

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID:
String ID: virtualFree failing!
API String ID: 0-3108117800
Opcode ID: 0147eb758d93df5900c16ac84850479e79e40d14cf0588b13aa4d51046a2b85b
Instruction ID: a6150c2ef07ea4b7b117c1b4b172c77d97d92af8be1a8ce848d3802047161daa
Opcode Fuzzy Hash: 0147eb758d93df5900c16ac84850479e79e40d14cf0588b13aa4d51046a2b85b
Instruction Fuzzy Hash: CB81AEB2A05B4680EB18CB25E9457B933A2FF54B94F518236DEAD073A4EF7DE185C340

Function 00007FFE0E1351B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

virtualFree failing!, xrefs: 00007FFE0E135420

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID:
String ID: virtualFree failing!
API String ID: 0-3108117800
Opcode ID: 39050be00d2c71d6c1b79541cb4b9b738faebff94102a6b652ad7961b740deac
Instruction ID: c20db5cccaff5d85b454a73eb6533fbe1eb464e1ca1d6cb2a88ac849398377a4
Opcode Fuzzy Hash: 39050be00d2c71d6c1b79541cb4b9b738faebff94102a6b652ad7961b740deac
Instruction Fuzzy Hash: 5961CEB2A05B4680FA28CB25E8457B973A2FF54B94F558236DE9D033A4EF7DE185C340

Function 00007FFE0E1334F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00007FFE0E1335F6
exit.MSVCRT ref: 00007FFE0E133611

Strings

virtualFree failing!, xrefs: 00007FFE0E133600

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: FreeVirtualexit
String ID: virtualFree failing!
API String ID: 1212090140-3108117800
Opcode ID: e24e67ac07752086788b380265c5cd36709ef847bbd2efcd059adf36909927b0
Instruction ID: 3f980147961cdb566abdf14ee684a89b7d0b399b74ba98bcae9804b30cfabae2
Opcode Fuzzy Hash: e24e67ac07752086788b380265c5cd36709ef847bbd2efcd059adf36909927b0
Instruction Fuzzy Hash: 6351A0B2B15B4584EE19CB25C458BA833A6FB44790F62C23ADABD473A4EF79D5848340

Function 00007FFE0E133430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00007FFE0E1334C6
exit.MSVCRT ref: 00007FFE0E1334E6

Strings

virtualFree failing!, xrefs: 00007FFE0E1334D5

Memory Dump Source

Source File: 00000000.00000002.1794036043.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000000.00000002.1793972669.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794096360.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794182859.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794270427.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794320655.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794435960.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794491096.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794516403.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1794542521.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe0e130000_loaddll64.jbxd

Similarity

API ID: FreeVirtualexit
String ID: virtualFree failing!
API String ID: 1212090140-3108117800
Opcode ID: 5bd5ea1a5a541078cee00e56ef0cf7cd7231e07ee3c72ea0638374ee87e1ac87
Instruction ID: 262d2b4795d11a36a548eea8ea02828c9e7e9667d7de8b72672e043d00c4397b
Opcode Fuzzy Hash: 5bd5ea1a5a541078cee00e56ef0cf7cd7231e07ee3c72ea0638374ee87e1ac87
Instruction Fuzzy Hash: C011C4A2B15B4A81FE59DB26D8512B86791FF94BD0F58D13BC95D433A1DE6CE488C300

Analysis Process: regsvr32.exePID: 6720, Parent PID: 6556COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1814
Total number of Limit Nodes:	12

Executed Functions

Function 00007FFE0E14F0D0 Relevance: 53.2, APIs: 4, Strings: 26, Instructions: 672
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlGetVersion.NTDLL ref: 00007FFE0E14F24A
memcpy.MSVCRT ref: 00007FFE0E14F326

Part of subcall function 00007FFE0E13C390: MultiByteToWideChar.KERNEL32 ref: 00007FFE0E13C3E7
Part of subcall function 00007FFE0E13C390: MultiByteToWideChar.KERNEL32 ref: 00007FFE0E13C44A

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

exit.MSVCRT ref: 00007FFE0E14F981
exit.MSVCRT ref: 00007FFE0E14F9B2

Strings

GetProcAddress, xrefs: 00007FFE0E14F682
RtlInitUnicodeString, xrefs: 00007FFE0E14F552
OpenProcess, xrefs: 00007FFE0E14F62D
WaitForSingleObject, xrefs: 00007FFE0E14F7E6
T], xrefs: 00007FFE0E14FC0F
GetComputerNameExA, xrefs: 00007FFE0E14FAC7
RtlAllocateHeap, xrefs: 00007FFE0E14F8F0
CloseHandle, xrefs: 00007FFE0E14F765
VirtualProtect, xrefs: 00007FFE0E14F601
GetCurrentThreadId, xrefs: 00007FFE0E14F7BD
GetModuleHandleA, xrefs: 00007FFE0E14F6DE
LdrLoadDll, xrefs: 00007FFE0E14F51E
OpenThread, xrefs: 00007FFE0E14F791
CreateFileA, xrefs: 00007FFE0E14F890
Sleep, xrefs: 00007FFE0E14F838
GetProcessHeap, xrefs: 00007FFE0E14F656
ReadFile, xrefs: 00007FFE0E14F919
RtlAddVectoredExceptionHandler, xrefs: 00007FFE0E14F6B5
GetDiskFreeSpaceExA, xrefs: 00007FFE0E14FB19
GetTickCount, xrefs: 00007FFE0E14F864
MultiByteToWideChar, xrefs: 00007FFE0E14F80F
GlobalMemoryStatusEx, xrefs: 00007FFE0E14FAF0
GetThreadContext, xrefs: 00007FFE0E14F70D
SetThreadContext, xrefs: 00007FFE0E14F739
GetFileSize, xrefs: 00007FFE0E14F8BC
GetCurrentProcessId, xrefs: 00007FFE0E14F5D5

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpy$ByteCharMultiWideexit$Version
String ID: CloseHandle$CreateFileA$GetComputerNameExA$GetCurrentProcessId$GetCurrentThreadId$GetDiskFreeSpaceExA$GetFileSize$GetModuleHandleA$GetProcAddress$GetProcessHeap$GetThreadContext$GetTickCount$GlobalMemoryStatusEx$LdrLoadDll$MultiByteToWideChar$OpenProcess$OpenThread$ReadFile$RtlAddVectoredExceptionHandler$RtlAllocateHeap$RtlInitUnicodeString$SetThreadContext$Sleep$VirtualProtect$WaitForSingleObject$T]
API String ID: 206777904-685478019
Opcode ID: b45f2f8461dc00cc225e3df3eeb2e6f5cb47b4b7ce774521207b75bae5f129ac
Instruction ID: 6c2b76d9e2dcf6567f574f206e0d4934e61591816cbdcff9d8d3bd1f98a7c4b3
Opcode Fuzzy Hash: b45f2f8461dc00cc225e3df3eeb2e6f5cb47b4b7ce774521207b75bae5f129ac
Instruction Fuzzy Hash: 726208B5F19B0781FA14ABA9E455AB923A1FF89B80F845437D98D1B7B6DE3CE011C340

Function 00007FFE0E14C870 Relevance: 12.4, APIs: 8, Instructions: 352
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

CreateFileA.KERNEL32 ref: 00007FFE0E14C948
GetFileSize.KERNEL32 ref: 00007FFE0E14C956
ReadFile.KERNEL32 ref: 00007FFE0E14C9A5

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpy$File$CreateReadSize
String ID:
API String ID: 3349561689-0
Opcode ID: a8202178b302e06c8707e63b6a2b76a7fa594dfccb05227361a63074442d66f1
Instruction ID: 9ea9f028ffebf61283f37a72def0b60319a3bec4377fd314401ede3a39822efd
Opcode Fuzzy Hash: a8202178b302e06c8707e63b6a2b76a7fa594dfccb05227361a63074442d66f1
Instruction Fuzzy Hash: 67F112A2A0E7C182EB20CB65E45477ABFA1FB85B80F098136DADE477A5DE3CD145C350

Function 00007FFE0E14D520 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 619
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE0E136B50: memset.MSVCRT ref: 00007FFE0E136BE2

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

HeapCreate.KERNELBASE ref: 00007FFE0E14D581
LoadLibraryA.KERNEL32 ref: 00007FFE0E14D8EF
GetProcAddress.KERNEL32 ref: 00007FFE0E14D92B
exit.MSVCRT ref: 00007FFE0E14DB71
VirtualProtect.KERNEL32 ref: 00007FFE0E14D781

Part of subcall function 00007FFE0E14EF30: fwrite.MSVCRT ref: 00007FFE0E14EF6F

Strings

VariantConversionError, xrefs: 00007FFE0E14DFFF
Jo ., xrefs: 00007FFE0E14DBBE
toVariant, xrefs: 00007FFE0E14E066
com.nim, xrefs: 00007FFE0E14E053

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpy$AddressCreateHeapLibraryLoadProcProtectVirtualexitfwritememset
String ID: Jo .$VariantConversionError$com.nim$toVariant
API String ID: 1711561947-479195221
Opcode ID: 267aad6122c0e13e02fc832062a4c5bc73dba4db2a22413d8cfe2e07d4621de0
Instruction ID: b180b70066d2219dc2e5d860d64a013653b37e144978ef48df02bc3f3d9c8809
Opcode Fuzzy Hash: 267aad6122c0e13e02fc832062a4c5bc73dba4db2a22413d8cfe2e07d4621de0
Instruction Fuzzy Hash: 066246A2B09B4691EB10DB60E8543BA23A1FF85B94F804137DA9E477B6DF3CE545C380

Function 00007FFE0E150950 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 218
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fileno.MSVCRT ref: 00007FFE0E15096D
_setmode.MSVCRT ref: 00007FFE0E15097E
_fileno.MSVCRT ref: 00007FFE0E15098A
_setmode.MSVCRT ref: 00007FFE0E150994
_fileno.MSVCRT ref: 00007FFE0E1509A0
_setmode.MSVCRT ref: 00007FFE0E1509AA
LoadLibraryA.KERNEL32 ref: 00007FFE0E1509B7
GetProcAddress.KERNEL32 ref: 00007FFE0E1509D6

Strings

inet_ntop, xrefs: 00007FFE0E1509CF

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: _fileno_setmode$AddressLibraryLoadProc
String ID: inet_ntop
API String ID: 3115319449-448242623
Opcode ID: 63bcff974b24ba70f64acc777d788e640980a957896653db4294a53ead9a9139
Instruction ID: 3d0441a3fd2b9ae56ad53d10fe99b28e43d44d038bf4b2224a30da2c72688827
Opcode Fuzzy Hash: 63bcff974b24ba70f64acc777d788e640980a957896653db4294a53ead9a9139
Instruction Fuzzy Hash: 81A14172A09B4A81EB119F99E8143A873A0FB89B80F948537DADC233A5DF3DE455C740

Function 00007FFE0E13C530 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 77
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13C548
GetProcAddress.KERNEL32 ref: 00007FFE0E13C571
LoadLibraryA.KERNELBASE ref: 00007FFE0E13C58A

Strings

WideCharToMultiByte, xrefs: 00007FFE0E13C55D
SysStringLen, xrefs: 00007FFE0E13C59F
MultiByteToWideChar, xrefs: 00007FFE0E13C5BE
kernel32, xrefs: 00007FFE0E13C541
lstrlenW, xrefs: 00007FFE0E13C5E0
oleaut32, xrefs: 00007FFE0E13C583

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: LibraryLoad$AddressProc
String ID: MultiByteToWideChar$SysStringLen$WideCharToMultiByte$kernel32$lstrlenW$oleaut32
API String ID: 1469910268-1955535950
Opcode ID: ee6e375a4fb4bccd2b28a38eab41fe4ff48691f0217c803988e2de915c1ce671
Instruction ID: 50fddb0466cb1475f479da3eb50a48eac9ff7740cd49e34045d11df1bbe58fc8
Opcode Fuzzy Hash: ee6e375a4fb4bccd2b28a38eab41fe4ff48691f0217c803988e2de915c1ce671
Instruction Fuzzy Hash: 2031F3A5B1AA03D0ED559B22B854476B3A1BF48B88B98153BDCDD473B1EE3CE405D3A0

Function 00007FFE0E145CC0 Relevance: 10.6, APIs: 7, Instructions: 98
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00007FFE0E145CC7
Sleep.KERNEL32 ref: 00007FFE0E145CD4
SleepEx.KERNELBASE ref: 00007FFE0E145CDA
exit.MSVCRT ref: 00007FFE0E145CEB
memcpy.MSVCRT ref: 00007FFE0E145D6B
memcpy.MSVCRT ref: 00007FFE0E145D8B

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: Sleepmemcpy$CountTickexit
String ID:
API String ID: 3478675858-0
Opcode ID: 0bdc9acf1ffa6991366d1e7dbc8e9db2be78bbb090259d4902cde132a9111b43
Instruction ID: c2debfd109fb03b81b8e0001fd55044452663093610d125ae3361cfdf44075bc
Opcode Fuzzy Hash: 0bdc9acf1ffa6991366d1e7dbc8e9db2be78bbb090259d4902cde132a9111b43
Instruction Fuzzy Hash: 22413B72B09A5692EB11AF18E9943AC73A1FF44B84F448437CA8D177A5EF3CE952C340

Function 00007FFE0E1317F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

exit.MSVCRT(?,?,?,?,00007FFE0E1318E5,?,?,?,?,00007FFE0E17E968,?,3F000000,02B3C260,00007FFE0E13244D,0000040F), ref: 00007FFE0E131821
memset.MSVCRT ref: 00007FFE0E131871

Strings

out of memory, xrefs: 00007FFE0E13180D

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: exitmemset
String ID: out of memory
API String ID: 2099101326-49810860
Opcode ID: a22d6bbd68ecaa542f404404ab495eed28682d22c7e6bab6dcadafd07e105a1a
Instruction ID: 6de8e848fd82886408c6efd7dea4b4eb269f35c18a616f8305ae4af0bc787711
Opcode Fuzzy Hash: a22d6bbd68ecaa542f404404ab495eed28682d22c7e6bab6dcadafd07e105a1a
Instruction Fuzzy Hash: 0B218132F0AB8580FB185F66E4483A963A0EB48FD4F088076DE8C0B7A5DE3CE481C340

Function 00007FFE0E144E70 Relevance: 5.2, APIs: 4, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

memcpy.MSVCRT ref: 00007FFE0E144F09
memcpy.MSVCRT ref: 00007FFE0E144FB9
memcpy.MSVCRT ref: 00007FFE0E144FDA

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cdbec6f9a2dd2351946039720b62acdf348dc7ef4a10d577622d7a41df4bf1b5
Instruction ID: a01483521fc8d50d56d325ca0927091d0fb8182adbaa78c166a4981e769a3133
Opcode Fuzzy Hash: cdbec6f9a2dd2351946039720b62acdf348dc7ef4a10d577622d7a41df4bf1b5
Instruction Fuzzy Hash: E9614872609B8592EA21DF05E8503ED77A0FB88B84F868533DA9D4B7A5EF3CD509C340

Function 00007FFE0E131A00 Relevance: 3.9, APIs: 3, Instructions: 159
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00007FFE0E131A5D

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1790b6db0320995f7436345c45903ecaa4b7fcd4b84692f55c2bdba6814a56ae
Instruction ID: 06a006730b62e0267ec61fb51f24ffb8a6b85390ebef0bf4687352f3647e94a6
Opcode Fuzzy Hash: 1790b6db0320995f7436345c45903ecaa4b7fcd4b84692f55c2bdba6814a56ae
Instruction Fuzzy Hash: 26514BB2706B9590EF159B2AD8483B936A5FB54FC4F588536DE8D0B7A8EE3DE441C300

Function 00007FFE0E146C30 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

GetFileAttributesW.KERNEL32 ref: 00007FFE0E146C78
GetFileAttributesW.KERNEL32 ref: 00007FFE0E146CE4

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpy$AttributesFile
String ID:
API String ID: 3559115319-0
Opcode ID: 42e9d04e5c697c9ee4175a46a3db53c6dcec2e3e28c3b2640cf8511a3308ae26
Instruction ID: 5989012367a89036984a62e59ce8330c00f6a6eacdac5422eabe04bca07363be
Opcode Fuzzy Hash: 42e9d04e5c697c9ee4175a46a3db53c6dcec2e3e28c3b2640cf8511a3308ae26
Instruction Fuzzy Hash: 8021A752F4AA0781FE09EB25B9541B52392EF95794F988037DC8E0B3B5EE3CE8428340

Function 00007FFE0E131830 Relevance: 2.6, APIs: 2, Instructions: 88
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FFE0E131871
VirtualAlloc.KERNEL32 ref: 00007FFE0E131893

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: AllocVirtualmemset
String ID:
API String ID: 921305906-0
Opcode ID: 3ff3c6db38c44a7a331b5cd085444be021dc225577a1303040b3e8ac49655f0c
Instruction ID: c3b093a9a93828be7432a1894dc2ed9c6c9d17280894121fcd594aa5816508cd
Opcode Fuzzy Hash: 3ff3c6db38c44a7a331b5cd085444be021dc225577a1303040b3e8ac49655f0c
Instruction Fuzzy Hash: 4E318C32B06B8081EB158F66F8447AD76A4EB48FD4F198076DE8C0B7A5DE38D582C300

Function 00007FFE0E1327D0 Relevance: 1.4, APIs: 1, Instructions: 165
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00007FFE0E1328E1

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7a838eac63a25573b851f49d3af618f8f0d33cadf4e87795c7358daf39240612
Instruction ID: 275b8aa8fe5266c9a39243b75965f2374c643625345a15a870d3e7f12dd3053c
Opcode Fuzzy Hash: 7a838eac63a25573b851f49d3af618f8f0d33cadf4e87795c7358daf39240612
Instruction Fuzzy Hash: 6271CEB2A05B4191EA19AF29D4443A833E5FF04B84F58823ADA8D077B5EF38E5D1C300

Function 00007FFE0E136B50 Relevance: 1.3, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FFE0E136BE2

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: b532521561d45849a7f1e55b540afb33b99293abbe439fb3ef002cd9d2cb91db
Instruction ID: 245f4d5451fb1f29f08d8851f56c16b25a6ce852d24118106d61ca69cafec03f
Opcode Fuzzy Hash: b532521561d45849a7f1e55b540afb33b99293abbe439fb3ef002cd9d2cb91db
Instruction Fuzzy Hash: FA416CB7A09A46A0EA10CF25D4502BC73A4FB58BA0F844237CA9E077F4DF78D995C340

Non-executed Functions

Function 00007FFE0E14D040 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 219threadlibraryloaderCOMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 00007FFE0E14D07C
memset.MSVCRT ref: 00007FFE0E14D08D
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FFE0E14D0F5
Thread32First.KERNEL32 ref: 00007FFE0E14D153
GetCurrentProcessId.KERNEL32 ref: 00007FFE0E14D16F
CloseHandle.KERNEL32 ref: 00007FFE0E14D19A
OpenThread.KERNEL32 ref: 00007FFE0E14D1C8
GetThreadContext.KERNEL32 ref: 00007FFE0E14D1E0
SetThreadContext.KERNEL32 ref: 00007FFE0E14D234
CloseHandle.KERNEL32 ref: 00007FFE0E14D25D
GetModuleHandleA.KERNEL32 ref: 00007FFE0E14D2AC
GetProcAddress.KERNEL32 ref: 00007FFE0E14D304
RtlInitUnicodeString.NTDLL ref: 00007FFE0E14D3A3
LdrLoadDll.NTDLL ref: 00007FFE0E14D3B3

Strings

jt+9, xrefs: 00007FFE0E14D322
J*!=, xrefs: 00007FFE0E14D1FF

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: HandleThread$CloseContext$AddressCreateCurrentExceptionFirstHandlerInitLoadModuleOpenProcProcessSnapshotStringThread32Toolhelp32UnicodeVectoredmemset
String ID: J*!=$jt+9
API String ID: 3419048117-242937532
Opcode ID: a9628e8f766383207b41f0b76916dcf45cde8c8b4db2eb96fa1eba45f2c1ec0d
Instruction ID: d1f3e824dc2ef7e7fccb7f6ab6f49cfe4c63fe7e469a0700dea47e5572a20720
Opcode Fuzzy Hash: a9628e8f766383207b41f0b76916dcf45cde8c8b4db2eb96fa1eba45f2c1ec0d
Instruction Fuzzy Hash: ADA18FA2B09B4292EE10DB11F8443BA63A1FF84B94F844537DA8E077A8DF3CE546C340

Function 00007FFE0E13D310 Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 229COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E1395B0: memcpy.MSVCRT ref: 00007FFE0E13960B

memcpy.MSVCRT ref: 00007FFE0E13D527

Strings

ValueError, xrefs: 00007FFE0E13D56F
ed 's', , xrefs: 00007FFE0E13D5F0
format s, xrefs: 00007FFE0E13D5B8
, expect, xrefs: 00007FFE0E13D5E2
but got , xrefs: 00007FFE0E13D5FE
tring fo, xrefs: 00007FFE0E13D5C6
type in , xrefs: 00007FFE0E13D5A7
invalid , xrefs: 00007FFE0E13D59D
strformat.nim, xrefs: 00007FFE0E13D667
r string, xrefs: 00007FFE0E13D5D4
formatValue, xrefs: 00007FFE0E13D67D

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID: , expect$ValueError$but got $ed 's', $format s$formatValue$invalid $r string$strformat.nim$tring fo$type in
API String ID: 3510742995-1773161451
Opcode ID: 3b737671fdecec1ccda9928ca60f407ce4e1cf31fb0526f2aeb49fa47f716a7c
Instruction ID: 2b1e73820ed8ecfebfca614a9b5ffa596e317c80d73e65a884f85d03059282aa
Opcode Fuzzy Hash: 3b737671fdecec1ccda9928ca60f407ce4e1cf31fb0526f2aeb49fa47f716a7c
Instruction Fuzzy Hash: 5A9101A2B08A4282EB15CB25F41477E36A0EB85B84F419133EE9D077E1DF7DE880C341

Function 00007FFE0E13C670 Relevance: 45.7, APIs: 12, Strings: 14, Instructions: 158libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13C680
GetProcAddress.KERNEL32 ref: 00007FFE0E13C6AD
GetProcAddress.KERNEL32 ref: 00007FFE0E13C6D3
GetProcAddress.KERNEL32 ref: 00007FFE0E13C6F9
GetProcAddress.KERNEL32 ref: 00007FFE0E13C71F
GetProcAddress.KERNEL32 ref: 00007FFE0E13C745
GetProcAddress.KERNEL32 ref: 00007FFE0E13C76B
GetProcAddress.KERNEL32 ref: 00007FFE0E13C791

Part of subcall function 00007FFE0E13A8E0: GetProcAddress.KERNEL32 ref: 00007FFE0E13A8EE

GetProcAddress.KERNEL32 ref: 00007FFE0E13C7D1
GetProcAddress.KERNEL32 ref: 00007FFE0E13C811
GetProcAddress.KERNEL32 ref: 00007FFE0E13C837
GetProcAddress.KERNEL32 ref: 00007FFE0E13C85D

Strings

GetProcAddress, xrefs: 00007FFE0E13C77D
UpdateProcThreadAttribute, xrefs: 00007FFE0E13C7B1
WaitForSingleObject, xrefs: 00007FFE0E13C849
GetCurrentThread, xrefs: 00007FFE0E13C699
HeapCreate, xrefs: 00007FFE0E13C6E5
GetThreadContext, xrefs: 00007FFE0E13C6BF
HeapAlloc, xrefs: 00007FFE0E13C70B
GetCurrentProcess, xrefs: 00007FFE0E13C7F1
ResumeThread, xrefs: 00007FFE0E13C823
CreateProcessW, xrefs: 00007FFE0E13C7E3
LoadLibraryA, xrefs: 00007FFE0E13C757
InitializeProcThreadAttributeList, xrefs: 00007FFE0E13C7A3
GetProcessHeap, xrefs: 00007FFE0E13C731
kernel32, xrefs: 00007FFE0E13C679

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessW$GetCurrentProcess$GetCurrentThread$GetProcAddress$GetProcessHeap$GetThreadContext$HeapAlloc$HeapCreate$InitializeProcThreadAttributeList$LoadLibraryA$ResumeThread$UpdateProcThreadAttribute$WaitForSingleObject$kernel32
API String ID: 2238633743-547029440
Opcode ID: c58de225f95c152ab6af1b470b37807868feafa623f41c2bcfb802640fa2ff2c
Instruction ID: c5433b138257bcf5935ced3e29fb4480aba456a09241f37610f58a11cc730beb
Opcode Fuzzy Hash: c58de225f95c152ab6af1b470b37807868feafa623f41c2bcfb802640fa2ff2c
Instruction Fuzzy Hash: 3761E765B0AA0390ED44A722B91447673A1BF48BC8F98547BCCCD5B3B1EF3CA545E3A4

Function 00007FFE0E14C1D0 Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 396COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FFE0E14C2DC
memcpy.MSVCRT ref: 00007FFE0E14C3F9
memcpy.MSVCRT ref: 00007FFE0E14C41B
memcpy.MSVCRT ref: 00007FFE0E14C440
memcpy.MSVCRT ref: 00007FFE0E14C465
memcpy.MSVCRT ref: 00007FFE0E14C48A

Strings

p, xrefs: 00007FFE0E14C2A1
*7;u, xrefs: 00007FFE0E14C496

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpy$FileModuleName
String ID: *7;u$p
API String ID: 1955653913-3490293476
Opcode ID: 645625445c2e909ecbe63e0be60bb5919e0017e978dff1b72ba1033b1c89a85e
Instruction ID: 347d2f54ae6f7b132ff34f6c40c5f5ae0114f50581e7bbe922afd297b2952dac
Opcode Fuzzy Hash: 645625445c2e909ecbe63e0be60bb5919e0017e978dff1b72ba1033b1c89a85e
Instruction Fuzzy Hash: 89022AB2B09B8692EB54DF15E4543AAB7A1FB84B84F458037DA9C0B7A9EF3CD505C340

Function 00007FFE0E139290 Relevance: 28.1, APIs: 6, Strings: 10, Instructions: 89stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FFE0E139393
exit.MSVCRT ref: 00007FFE0E1393A8
signal.MSVCRT ref: 00007FFE0E1393C5
signal.MSVCRT ref: 00007FFE0E1393D2
signal.MSVCRT ref: 00007FFE0E1393DF
signal.MSVCRT ref: 00007FFE0E1393EC

Strings

sysFatal, xrefs: 00007FFE0E139325
SIGSEGV: Illegal storage access. (Attempt to read from nil?), xrefs: 00007FFE0E139352
fatal.nim, xrefs: 00007FFE0E139318
SIGINT: Interrupted by Ctrl-C., xrefs: 00007FFE0E139346
ReraiseDefect, xrefs: 00007FFE0E1392BA
SIGILL: Illegal operation., xrefs: 00007FFE0E139380
unknown signal, xrefs: 00007FFE0E139379, 00007FFE0E1393B0
5, xrefs: 00007FFE0E13930F
SIGABRT: Abnormal termination., xrefs: 00007FFE0E13935E
SIGFPE: Arithmetic error., xrefs: 00007FFE0E13936A

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: signal$exitstrlen
String ID: 5$ReraiseDefect$SIGABRT: Abnormal termination.$SIGFPE: Arithmetic error.$SIGILL: Illegal operation.$SIGINT: Interrupted by Ctrl-C.$SIGSEGV: Illegal storage access. (Attempt to read from nil?)$fatal.nim$sysFatal$unknown signal
API String ID: 1414789275-2829261224
Opcode ID: db43e712b9be7a93631420e14b105a0930ecd6170e45012433f711954e299830
Instruction ID: a7053e46752a173a43a732335e2fd9168a531fd799413bc9e0b354a34205d696
Opcode Fuzzy Hash: db43e712b9be7a93631420e14b105a0930ecd6170e45012433f711954e299830
Instruction Fuzzy Hash: 5D315C66E18A02E0FA18AB25E8596BDB365BF45784F880437EE9D473F5DF3CA644C340

Function 00007FFE0E14E250 Relevance: 26.5, APIs: 3, Strings: 12, Instructions: 203libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

LoadLibraryA.KERNEL32 ref: 00007FFE0E14E5B3
GetProcAddress.KERNEL32 ref: 00007FFE0E14E5DC
LoadLibraryA.KERNEL32 ref: 00007FFE0E14E5F2

Strings

tProcess1, xrefs: 00007FFE0E14E2D4
GetFileAttributesW, xrefs: 00007FFE0E14E603
RtlGetVersion, xrefs: 00007FFE0E14E5C8
key5, xrefs: 00007FFE0E14E465
NtFlushInstructionCache4, xrefs: 00007FFE0E14E33F
OpenProcess, xrefs: 00007FFE0E14E626
cipher, xrefs: 00007FFE0E14E492
kernel32.dll, xrefs: 00007FFE0E14E5EB
treadHandle3, xrefs: 00007FFE0E14E2FE
dctx6, xrefs: 00007FFE0E14E4F0
remoteProcID2, xrefs: 00007FFE0E14E2E4
:state, xrefs: 00007FFE0E14E2C0

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpy$LibraryLoad$AddressProc
String ID: :state$GetFileAttributesW$NtFlushInstructionCache4$OpenProcess$RtlGetVersion$cipher$dctx6$kernel32.dll$key5$remoteProcID2$tProcess1$treadHandle3
API String ID: 3980900384-2224378161
Opcode ID: 5024ca8dcfbd9f7da15cbb3ce75fc2b1b4ac0722f133e5d66a90e89f756bd335
Instruction ID: 38a1b40b4bd4aa54716553016ded1f9e1eec2551bd6e2a1a233d381790414c33
Opcode Fuzzy Hash: 5024ca8dcfbd9f7da15cbb3ce75fc2b1b4ac0722f133e5d66a90e89f756bd335
Instruction Fuzzy Hash: 9CB10321A19B4385FB129B28A9403A573A2FF55744F84527BCDDC563B2EF7DB289C380

Function 00007FFE0E1464C0 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 202COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FFE0E1464E2

Strings

IndexDefect, xrefs: 00007FFE0E146587
paramStr, xrefs: 00007FFE0E14660A
not in , xrefs: 00007FFE0E1467D7
not in , xrefs: 00007FFE0E14676F
os.nim, xrefs: 00007FFE0E1465F4
0 .., xrefs: 00007FFE0E146818
not in , xrefs: 00007FFE0E1466F7
0 .., xrefs: 00007FFE0E146711
inde, xrefs: 00007FFE0E146808

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: CommandLine
String ID: not in $ not in $ not in $0 ..$0 ..$IndexDefect$inde$os.nim$paramStr
API String ID: 3253501508-369068400
Opcode ID: 176fa0095b720560e638bb860fa3f59553cefa47951e64ab9f53068569c9af63
Instruction ID: c75b100ea3c77a68e98ffa9a6a52b1f7038a7919dc14654df91ce1f41104dd78
Opcode Fuzzy Hash: 176fa0095b720560e638bb860fa3f59553cefa47951e64ab9f53068569c9af63
Instruction Fuzzy Hash: 719167B2A09B4281EB11DF15E9483A97BA4FF85B94F458037DA9D0B3A5EF3CE505C380

Function 00007FFE0E146140 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E136B50: memset.MSVCRT ref: 00007FFE0E136BE2

FormatMessageW.KERNEL32 ref: 00007FFE0E1461B5
memcpy.MSVCRT ref: 00007FFE0E146329
LocalFree.KERNEL32 ref: 00007FFE0E1463D2

Strings

OS error, xrefs: 00007FFE0E146453
unknown , xrefs: 00007FFE0E146449
unknown , xrefs: 00007FFE0E14636D
al info:, xrefs: 00007FFE0E1462AD
OS error, xrefs: 00007FFE0E146363
OSError, xrefs: 00007FFE0E146173
Addition, xrefs: 00007FFE0E14629A

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: FormatFreeLocalMessagememcpymemset
String ID: Addition$OS error$OS error$OSError$al info:$unknown $unknown
API String ID: 4084645559-3457963805
Opcode ID: e43746b6d3e31976e80ed3e78efbe06e3184e3a06d24456f847f49f2a0480dcd
Instruction ID: 1cccb3bbc91015aeeee5e269373db9da998e94715edf409a3f9cc118bffac880
Opcode Fuzzy Hash: e43746b6d3e31976e80ed3e78efbe06e3184e3a06d24456f847f49f2a0480dcd
Instruction Fuzzy Hash: C38189B6B09B5681EE519B19E45877E37A8FF85B88F14843BDA8C073A5EF38D544C380

Function 00007FFE0E149DA0 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 175memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E13C390: MultiByteToWideChar.KERNEL32 ref: 00007FFE0E13C3E7
Part of subcall function 00007FFE0E13C390: MultiByteToWideChar.KERNEL32 ref: 00007FFE0E13C44A

SysAllocString.OLEAUT32 ref: 00007FFE0E149DDE
_setjmp.MSVCRT ref: 00007FFE0E149E34
CoInitialize.OLE32 ref: 00007FFE0E149FF0

Part of subcall function 00007FFE0E136B50: memset.MSVCRT ref: 00007FFE0E136BE2

memcpy.MSVCRT ref: 00007FFE0E149FA2
SysFreeString.OLEAUT32 ref: 00007FFE0E14A071

Strings

ed membe, xrefs: 00007FFE0E149F5D
unable t, xrefs: 00007FFE0E149F2B
specifi, xrefs: 00007FFE0E149F4F
r: , xrefs: 00007FFE0E149F73
o invoke, xrefs: 00007FFE0E149F35

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiStringWide$AllocFreeInitialize_setjmpmemcpymemset
String ID: specifi$ed membe$o invoke$r: $unable t
API String ID: 909372610-4084315218
Opcode ID: e426f8c4deaaf8e3db560116b79f21edf749721eaba173ae76d85139aeb9888e
Instruction ID: 3608184739cf9a4ce5186de14096b6b2228846c6f17fbbf68c7013223949e7e0
Opcode Fuzzy Hash: e426f8c4deaaf8e3db560116b79f21edf749721eaba173ae76d85139aeb9888e
Instruction Fuzzy Hash: E0A1B376609F8681EB60CF15E8943AAB7A4FB88B80F448136DACD47B69DF7CD454CB40

Function 00007FFE0E141E50 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 90libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E141E60
GetProcAddress.KERNEL32 ref: 00007FFE0E141E8D
GetProcAddress.KERNEL32 ref: 00007FFE0E141EB3

Strings

GetCommandLineW, xrefs: 00007FFE0E141E79
GetCurrentDirectoryW, xrefs: 00007FFE0E141EC5
FormatMessageW, xrefs: 00007FFE0E141EEB
GetModuleFileNameW, xrefs: 00007FFE0E141E9F
LocalFree, xrefs: 00007FFE0E141F11
GetLastError, xrefs: 00007FFE0E141F37
kernel32, xrefs: 00007FFE0E141E59

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: FormatMessageW$GetCommandLineW$GetCurrentDirectoryW$GetLastError$GetModuleFileNameW$LocalFree$kernel32
API String ID: 2238633743-3391179580
Opcode ID: 1287cbde34c9a01a5778edf70d3b897d3a7a108950112f86db042cfb1d222104
Instruction ID: 1a3c7d1cdd112e4c16a35ba3fc7ffd52b4cc74f30727a0f6db4887a477b311ce
Opcode Fuzzy Hash: 1287cbde34c9a01a5778edf70d3b897d3a7a108950112f86db042cfb1d222104
Instruction Fuzzy Hash: 9E312FA5B0AA0390EE45D71279544B663A1BF49BC8B84047BDCCD4B3B5EE3CA449E394

Function 00007FFE0E1489C0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E1489E2
SafeArrayCreate.OLEAUT32 ref: 00007FFE0E148A52
SafeArrayPutElement.OLEAUT32 ref: 00007FFE0E148AAD

Strings

VariantConversionError, xrefs: 00007FFE0E148B77
toVariant, xrefs: 00007FFE0E148C04
com.nim, xrefs: 00007FFE0E148BEE

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: c9a4d359ccf372bf526eaa78d5230b43e9c201022d9012c80fc7dd3dc61b5e02
Instruction ID: 77c4aba7d489da3a5bcb68e766c46eb7d55baee26957496e03fcf80fb2983331
Opcode Fuzzy Hash: c9a4d359ccf372bf526eaa78d5230b43e9c201022d9012c80fc7dd3dc61b5e02
Instruction Fuzzy Hash: 1B81ADA2B0AB4295EA54AB15E8587BE67A1FF40B80F944437EACD073B1DF7CE446C340

Function 00007FFE0E149600 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E149622
SafeArrayCreate.OLEAUT32 ref: 00007FFE0E149692
SafeArrayPutElement.OLEAUT32 ref: 00007FFE0E1496ED

Strings

VariantConversionError, xrefs: 00007FFE0E1497B7
toVariant, xrefs: 00007FFE0E149844
com.nim, xrefs: 00007FFE0E14982E

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: e59546261d6e30790542a23a76ed5ab6d73a75fa9f730ccaf14fb43211ccd0fd
Instruction ID: cf9360ad58d506b4d4411ee2f788713b9d940a7b0920e67bde18c9f8771412e8
Opcode Fuzzy Hash: e59546261d6e30790542a23a76ed5ab6d73a75fa9f730ccaf14fb43211ccd0fd
Instruction Fuzzy Hash: 128157A2B0AB4791EB109B15E9586BE63A1FF84B84F844537DA9D073B5DF3CE845C380

Function 00007FFE0E148270 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E148292
SafeArrayCreate.OLEAUT32 ref: 00007FFE0E148302
SafeArrayPutElement.OLEAUT32 ref: 00007FFE0E148358

Strings

VariantConversionError, xrefs: 00007FFE0E1483FF
toVariant, xrefs: 00007FFE0E14848C
com.nim, xrefs: 00007FFE0E148476

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: 697b9fa782d9ff8b20fb0e63cbcfd5e65f50ec7fbf6534a61681d9b41f57343c
Instruction ID: 3b37c313002a21b2ad2d699b6e3e66c0c83775dd160362aac333aefe52bf781d
Opcode Fuzzy Hash: 697b9fa782d9ff8b20fb0e63cbcfd5e65f50ec7fbf6534a61681d9b41f57343c
Instruction Fuzzy Hash: 75718CA2B0AB0695EA55AB05E9587BE63A1FF44B84F844537EACD073B0DF3CE441C380

Function 00007FFE0E13A680 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FFE0E13A6A9
fflush.MSVCRT ref: 00007FFE0E13A6B1
exit.MSVCRT ref: 00007FFE0E13A6BB
signal.MSVCRT ref: 00007FFE0E13A76E
signal.MSVCRT ref: 00007FFE0E13A77B
signal.MSVCRT ref: 00007FFE0E13A788
signal.MSVCRT ref: 00007FFE0E13A795
signal.MSVCRT ref: 00007FFE0E13A7A2

Strings

[GC] cannot register thread local variable; too many thread local variables, xrefs: 00007FFE0E13A69C

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: signal$exitfflushfwrite
String ID: [GC] cannot register thread local variable; too many thread local variables
API String ID: 3958355099-685140759
Opcode ID: fa8ccfdcd3ab8ba8d84ef958eb0a57ba01de52049acf6b168819aab5f8359f7c
Instruction ID: 389863c5b7d13818841a51b3535989dfd102dbcd312e5236424c1690ac05d406
Opcode Fuzzy Hash: fa8ccfdcd3ab8ba8d84ef958eb0a57ba01de52049acf6b168819aab5f8359f7c
Instruction Fuzzy Hash: B5215C66A09A0285FA146B65E8467BA7261FF86B80F845837E9DD173F2DF3CA211C304

Function 00007FFE0E13CA70 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 333COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E13CDFE

Strings

ValueError, xrefs: 00007FFE0E13CBEA
., xrefs: 00007FFE0E13CB98
parseStandardFormatSpecifier, xrefs: 00007FFE0E13CE59
invalid , xrefs: 00007FFE0E13CD9A
rse:, xrefs: 00007FFE0E13CDE0
format s, xrefs: 00007FFE0E13CDA4
annot pa, xrefs: 00007FFE0E13CDC3
strformat.nim, xrefs: 00007FFE0E13CE43
tring, c, xrefs: 00007FFE0E13CDB5

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID: .$ValueError$annot pa$format s$invalid $parseStandardFormatSpecifier$rse:$strformat.nim$tring, c
API String ID: 3510742995-876510697
Opcode ID: 06778b7551d1d1e2799e8a2043c97a13a64522767c93a9a919c662244adb7339
Instruction ID: 7776b066975a9f385217b065751afe5a250ae8ace22864d0174df733bc84a7c0
Opcode Fuzzy Hash: 06778b7551d1d1e2799e8a2043c97a13a64522767c93a9a919c662244adb7339
Instruction Fuzzy Hash: 50E1D2A2A0879596EB148B3495003E9BBA1FB157D4F488633DAAC277E9DB3CE145C390

Function 00007FFE0E1389D0 Relevance: 15.2, APIs: 6, Strings: 4, Instructions: 194stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E138A7A
strlen.MSVCRT ref: 00007FFE0E138AAE
strlen.MSVCRT ref: 00007FFE0E138AEF
strlen.MSVCRT ref: 00007FFE0E138C16
memcpy.MSVCRT ref: 00007FFE0E138C36
strlen.MSVCRT ref: 00007FFE0E138C3E

Strings

excepti, xrefs: 00007FFE0E138A39
nhandled, xrefs: 00007FFE0E138A2C
on: , xrefs: 00007FFE0E138A47
Error: u, xrefs: 00007FFE0E138A1B

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: strlen$memcpy
String ID: excepti$Error: u$nhandled$on:
API String ID: 3396830738-1220997370
Opcode ID: 620df2181a99c2d9f432fa450793f222c34056ad9a437eb17abca127aa62c4ed
Instruction ID: 0860cd6b5c6136fceca5f0858951ba55b5e27d08b3b4de618a5f36831518e937
Opcode Fuzzy Hash: 620df2181a99c2d9f432fa450793f222c34056ad9a437eb17abca127aa62c4ed
Instruction Fuzzy Hash: 0981C162B19A8686FB299B25D4113BA7361FF44B84F888537EB8D177E5EF2CE505C300

Function 00007FFE0E146830 Relevance: 15.2, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E1468E2
memcpy.MSVCRT ref: 00007FFE0E146A52
memcpy.MSVCRT ref: 00007FFE0E146A94

Part of subcall function 00007FFE0E137040: memcpy.MSVCRT ref: 00007FFE0E1370DC

Strings

VT_ARRAY, xrefs: 00007FFE0E14687D
VT_RESER, xrefs: 00007FFE0E146998
VED|, xrefs: 00007FFE0E1469B5
VT_ARRAY, xrefs: 00007FFE0E146B00
VT_VECTO, xrefs: 00007FFE0E14694C
VT_ARRAY, xrefs: 00007FFE0E146A28
VT_BYREF, xrefs: 00007FFE0E146908

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID: VED|$VT_ARRAY$VT_ARRAY$VT_ARRAY$VT_BYREF$VT_RESER$VT_VECTO
API String ID: 3510742995-291823325
Opcode ID: aec648f9a95a20fb432d11329cea1dfd7ef1e45c34c68d363635f803f7b74143
Instruction ID: aee1af98b61cc4981106b5ef7f74e08e1f7bbb9a1864352cea63abcd810622de
Opcode Fuzzy Hash: aec648f9a95a20fb432d11329cea1dfd7ef1e45c34c68d363635f803f7b74143
Instruction Fuzzy Hash: 4E7158B2708B4A85EB119F15E8443AA77A4FB95B88F598037DF8D0B3A1EE7CD544C300

Function 00007FFE0E144610 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E144620
GetProcAddress.KERNEL32 ref: 00007FFE0E144649
GetProcAddress.KERNEL32 ref: 00007FFE0E14466B

Strings

Thread32First, xrefs: 00007FFE0E144657
Thread32Next, xrefs: 00007FFE0E144679
kernel32, xrefs: 00007FFE0E144619
CreateToolhelp32Snapshot, xrefs: 00007FFE0E144635

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateToolhelp32Snapshot$Thread32First$Thread32Next$kernel32
API String ID: 2238633743-3935561650
Opcode ID: 6c442825502bc7901ecd661716a16d1c8b49b900e669c40a7a4c98e00781447f
Instruction ID: e2279771b7ff47ad42abcbd4b35610a98292c3fefe455890bd81f046e47ab824
Opcode Fuzzy Hash: 6c442825502bc7901ecd661716a16d1c8b49b900e669c40a7a4c98e00781447f
Instruction Fuzzy Hash: B0113DA5B0EA0390FE159722BD1457A63A1BF49B84F980877CCED473B0EE7CA046D350

Function 00007FFE0E1314A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFE0E1314B9
LoadLibraryA.KERNEL32 ref: 00007FFE0E1314CA
GetProcAddress.KERNEL32 ref: 00007FFE0E1314E8
GetProcAddress.KERNEL32 ref: 00007FFE0E1314F8

Strings

__deregister_frame_info, xrefs: 00007FFE0E1314EB
__register_frame_info, xrefs: 00007FFE0E1314D7
libgcc_s_dw2-1.dll, xrefs: 00007FFE0E1314AF

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: 4b359fa39a413980578f20d51ef9706400725c07471b7bbc5a8fdffd70197d7b
Instruction ID: d19d629a3b53e0613472d1ea1b25a2e68c325c9ec19438d3f450bfa31d0aa70a
Opcode Fuzzy Hash: 4b359fa39a413980578f20d51ef9706400725c07471b7bbc5a8fdffd70197d7b
Instruction Fuzzy Hash: EF01C561A5AA07E0EA169B15BC505B933A5BF49788F840533DCDD43270EF3CE149D340

Function 00007FFE0E13B7F0 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E13B8DB

Strings

ValueError, xrefs: 00007FFE0E13B857, 00007FFE0E13B963
invalid , xrefs: 00007FFE0E13B8AA
integer:, xrefs: 00007FFE0E13B993
integer:, xrefs: 00007FFE0E13B899
strutils.nim, xrefs: 00007FFE0E13B923
invalid , xrefs: 00007FFE0E13B9A8
parseInt, xrefs: 00007FFE0E13B939

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID: ValueError$integer:$integer:$invalid $invalid $parseInt$strutils.nim
API String ID: 3510742995-2575869123
Opcode ID: 15bf003bdc77111694311591c6e8ce157c1d6e781086ecfc85e6e3deb4704f3f
Instruction ID: 5a9a41dc9289ddd13fb2f5b9cfcd51a7063a2017a68e2d04a786aa847ba646f9
Opcode Fuzzy Hash: 15bf003bdc77111694311591c6e8ce157c1d6e781086ecfc85e6e3deb4704f3f
Instruction Fuzzy Hash: A9413672A09B0AD1EA209F25E8547AA73A4FF48B84F848437DACD477A5EF7CE545C340

Function 00007FFE0E13CFC0 Relevance: 11.5, APIs: 9, Instructions: 220COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FFE0E13D06B
memcpy.MSVCRT ref: 00007FFE0E13D0B1
memcpy.MSVCRT ref: 00007FFE0E13D0CD

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 9a95c766a421aee8bda3d61193bee614ed9ff932fcd03d974b4030aef223b19b
Instruction ID: 41aeaf78b52ac6210492a8ff25d33e0c52ba71c80a6da48fe58a854cd26ec7ec
Opcode Fuzzy Hash: 9a95c766a421aee8bda3d61193bee614ed9ff932fcd03d974b4030aef223b19b
Instruction Fuzzy Hash: D381C062B09A5681EE05EB25E8052BE77A1BF84F84F468533EE5D173A6EF3CE545C300

Function 00007FFE0E14BF00 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E14BF52
SafeArrayCreate.OLEAUT32 ref: 00007FFE0E14BFC0
SafeArrayPutElement.OLEAUT32 ref: 00007FFE0E14BFFD

Strings

VariantConversionError, xrefs: 00007FFE0E14C05F
toVariant, xrefs: 00007FFE0E14C0F2
com.nim, xrefs: 00007FFE0E14C0DC

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: 9eae0cf97d50d8a67c4e201ceeba8e2c2a17758a0522804396163c04e92e8b07
Instruction ID: 94c0ce4550d521aa69181214f9235ea93ed49713d9e6e50d5c96af1dc0b70f1f
Opcode Fuzzy Hash: 9eae0cf97d50d8a67c4e201ceeba8e2c2a17758a0522804396163c04e92e8b07
Instruction Fuzzy Hash: 876136A2B0AB0291FA159B15A8187BE63A1FF85B84F544537DADD073B1EF3DE445C380

Function 00007FFE0E144CB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E144D49
memcpy.MSVCRT ref: 00007FFE0E144D89

Strings

convert , xrefs: 00007FFE0E144DD7
convert , xrefs: 00007FFE0E144E2C
from, xrefs: 00007FFE0E144E55
convert , xrefs: 00007FFE0E144D15
to , xrefs: 00007FFE0E144E60

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID: to $convert $convert $convert $from
API String ID: 3510742995-220309676
Opcode ID: dc9e2aa1a007e4dd8d834762d87609655c69aa9ff4af3a690f529dd9e52cdbfa
Instruction ID: 46eab1de0f5cbbf42e484e6d0fad7764f6ac1a23ede92afb688f0b11b2e74fd2
Opcode Fuzzy Hash: dc9e2aa1a007e4dd8d834762d87609655c69aa9ff4af3a690f529dd9e52cdbfa
Instruction Fuzzy Hash: 9E4159B2A09B4681EB05DF15D5483987BA1FB94B80F4A8037DB9C5B3A5EFB8D510C780

Function 00007FFE0E13C940 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13C950
GetProcAddress.KERNEL32 ref: 00007FFE0E13C979
GetProcAddress.KERNEL32 ref: 00007FFE0E13C99B

Strings

GetForegroundWindow, xrefs: 00007FFE0E13C965
GetWindowThreadProcessId, xrefs: 00007FFE0E13C987
user32, xrefs: 00007FFE0E13C949

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetForegroundWindow$GetWindowThreadProcessId$user32
API String ID: 2238633743-4060728576
Opcode ID: 099e45388bdc18e5a7f021420b8990e432f484574424dfb494841c910785b762
Instruction ID: 630a981e584bdba30fab39d1ae15849b5d385d5a2824ec11c675f526db689beb
Opcode Fuzzy Hash: 099e45388bdc18e5a7f021420b8990e432f484574424dfb494841c910785b762
Instruction Fuzzy Hash: 97011A65A5AB03D0EE459B22BC5457AB3A2BF49B84F88457BDCCD873B0EE3CA044C355

Function 00007FFE0E148FA0 Relevance: 9.3, APIs: 6, Instructions: 285stringCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00007FFE0E14908D
_setjmp.MSVCRT ref: 00007FFE0E149227
VariantCopy.OLEAUT32 ref: 00007FFE0E1492CD
strlen.MSVCRT ref: 00007FFE0E149347
memcpy.MSVCRT ref: 00007FFE0E14938A

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: CopyFreeStringVariant_setjmpmemcpystrlen
String ID:
API String ID: 649350220-0
Opcode ID: 1c8747582f73588acd678ea3ed29cea2ab5c6abdbe1ab605578c608991d5d4c0
Instruction ID: 83f494b72e32496d6c2e9bf6150034332e80dd3b47d8dc8f56378582060d80d6
Opcode Fuzzy Hash: 1c8747582f73588acd678ea3ed29cea2ab5c6abdbe1ab605578c608991d5d4c0
Instruction Fuzzy Hash: 73D138B6A19B8681EA55CB16E4403AE73A1FBC8B94F448133EE9D077A9DF3CE441C340

Function 00007FFE0E13101D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_amsg_exit.MSVCRT ref: 00007FFE0E131102
_initterm.MSVCRT ref: 00007FFE0E131137
_initterm.MSVCRT ref: 00007FFE0E13115E
_amsg_exit.MSVCRT ref: 00007FFE0E131240

Strings

0, xrefs: 00007FFE0E131070

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: _amsg_exit_initterm
String ID: 0
API String ID: 194249164-4108050209
Opcode ID: efee7c7564053665e09315d1a3c1bf29b97e43912d1bab046c58282f71b617ec
Instruction ID: cf483ee752bba1ee092aa0b48df9fb5434bd270b85cf89d27e2af28b6a70408b
Opcode Fuzzy Hash: efee7c7564053665e09315d1a3c1bf29b97e43912d1bab046c58282f71b617ec
Instruction Fuzzy Hash: 3D719236B09B068AEB508B65E8903AC37B1BB49B88F504436DE8D977A9CF7DE540C740

Function 00007FFE0E1486A0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E1486B9
VariantCopy.OLEAUT32 ref: 00007FFE0E14870A

Strings

VariantConversionError, xrefs: 00007FFE0E14872F
toVariant, xrefs: 00007FFE0E1487B4
com.nim, xrefs: 00007FFE0E14879E

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: CopyInitializeVariant
String ID: VariantConversionError$com.nim$toVariant
API String ID: 633353902-3035603046
Opcode ID: d53b74f056ed678ce3979812d694a4fd568094c6bbedb9c3d2a401089230e449
Instruction ID: 461681aa21f6c7ccf9b375c3dad53e9ae85f69ce65ac773a99064d7fd5f7dd60
Opcode Fuzzy Hash: d53b74f056ed678ce3979812d694a4fd568094c6bbedb9c3d2a401089230e449
Instruction Fuzzy Hash: F24169A2B0A70790EA55AB19A91877E6394FF44B84F844937D9DC073B1DF3CE1468390

Function 00007FFE0E148080 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E148099
VariantCopy.OLEAUT32 ref: 00007FFE0E1480EA

Strings

VariantConversionError, xrefs: 00007FFE0E14810F
newVariant, xrefs: 00007FFE0E148194
com.nim, xrefs: 00007FFE0E14817E

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: CopyInitializeVariant
String ID: VariantConversionError$com.nim$newVariant
API String ID: 633353902-805458017
Opcode ID: 37dc1bba5de7eb6d8a84ede9a51d855650d8d586e6755152db3d4b614f213599
Instruction ID: ecc9d3259361cb518f91bb8b3c38e6b09ea3a35ff29167eee4a4fd90462cc2d7
Opcode Fuzzy Hash: 37dc1bba5de7eb6d8a84ede9a51d855650d8d586e6755152db3d4b614f213599
Instruction Fuzzy Hash: 0D414EA2B0AB4794EA55AB19A91877E6394FF44B84F844537D9DC073B1DF3CE046C390

Function 00007FFE0E145220 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 263COMMON

Download Yara Rule

Strings

T], xrefs: 00007FFE0E145530
T], xrefs: 00007FFE0E145570
.~&, xrefs: 00007FFE0E145379

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID:
String ID: .~&$T]$T]
API String ID: 0-361263744
Opcode ID: 1c310ccbf74c847df73c694cb3f318e6f7db29470bae7075e5a2e3ab811cc63c
Instruction ID: 737f3dd802abeea36cf84ed44e215d04f3f96e6f9b70bfb8c9c50e33c4859dab
Opcode Fuzzy Hash: 1c310ccbf74c847df73c694cb3f318e6f7db29470bae7075e5a2e3ab811cc63c
Instruction Fuzzy Hash: C8C1A0A2E1874292EA50DF54E8412BA7762FF80754F944433EA8E5B7B6EF3CE905C700

Function 00007FFE0E157F88 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 00007FFE0E157FAE
_unlock.MSVCRT ref: 00007FFE0E157FE9

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: _lock_unlock
String ID:
API String ID: 2848772494-0
Opcode ID: 839b6c95f21c298f95560e90b5800166fcecef062897bb39a6bf96ebd563a10a
Instruction ID: a91daa40c4a94aa909ffea281c5bd156041a777517c0243bf2c3d72c1b0da163
Opcode Fuzzy Hash: 839b6c95f21c298f95560e90b5800166fcecef062897bb39a6bf96ebd563a10a
Instruction Fuzzy Hash: F54198A7704B49C9EB048F6AD8813AC73A1F748BD8F448936EE6C477A8DF38D5508350

Function 00007FFE0E131748 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

_fileno.MSVCRT ref: 00007FFE0E13176C
_setmode.MSVCRT ref: 00007FFE0E13177C
_fileno.MSVCRT ref: 00007FFE0E131788
_setmode.MSVCRT ref: 00007FFE0E131791
_fileno.MSVCRT ref: 00007FFE0E13179D

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: _fileno$_setmode
String ID:
API String ID: 2194614063-0
Opcode ID: b8499c141844f940aab8dce16dfdacb536d3285c549e13282d0a74ac03962638
Instruction ID: ef0d0c46a369d3c3b4741644165682ea344c24e22cd3aecf5669e34ba1b111e4
Opcode Fuzzy Hash: b8499c141844f940aab8dce16dfdacb536d3285c549e13282d0a74ac03962638
Instruction Fuzzy Hash: FAF01C11B1455542EF08A7B2BA6437E5A96AFD9BD0F18807B8D4E473D4ED3CD8424340

Function 00007FFE0E13A9B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13ABE6
GetProcAddress.KERNEL32 ref: 00007FFE0E13AC08

Strings

ole32, xrefs: 00007FFE0E13AB9C
IsEqualGUID, xrefs: 00007FFE0E13ABFB

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: IsEqualGUID$ole32
API String ID: 2574300362-2239048069
Opcode ID: 7ff10b3fd0906f5e01960bbf5f10ae61445133da43785ccd3f84570ed7f384fa
Instruction ID: 196fcbb036f43c9fc6d75697a3f333a8677996702306e6ec7d5d33c57413b403
Opcode Fuzzy Hash: 7ff10b3fd0906f5e01960bbf5f10ae61445133da43785ccd3f84570ed7f384fa
Instruction Fuzzy Hash: 3661AE2191DB8296F6528B58F8857B573B4BF4CB44F80223BC9DD872B0EF3DA6858340

Function 00007FFE0E139450 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E1315B0: strlen.MSVCRT ref: 00007FFE0E1315C9
Part of subcall function 00007FFE0E1315B0: fwrite.MSVCRT ref: 00007FFE0E1315DC

GetLastError.KERNEL32 ref: 00007FFE0E1394A2
exit.MSVCRT ref: 00007FFE0E1394CA

Strings

(bad format; library may be wrong architecture), xrefs: 00007FFE0E1394D6
could not load: , xrefs: 00007FFE0E139470

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: ErrorLastexitfwritestrlen
String ID: (bad format; library may be wrong architecture)$could not load:
API String ID: 671075621-2754783905
Opcode ID: 89563ff696690d38515c8b2b3e1467e36067791bf54df73593b659afd1aa64d8
Instruction ID: 912da432add6e74778a2bdec200ba20ded235543e9cefd23af3096e229ffcebb
Opcode Fuzzy Hash: 89563ff696690d38515c8b2b3e1467e36067791bf54df73593b659afd1aa64d8
Instruction Fuzzy Hash: FD016252B1965791FE04B771E8553B86265AF85780F44413BDE8E473F6EE6CE400C301

Function 00007FFE0E13A920 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FFE0E13A949
fflush.MSVCRT ref: 00007FFE0E13A951
exit.MSVCRT ref: 00007FFE0E13A95B

Strings

[GC] cannot register global variable; too many global variables, xrefs: 00007FFE0E13A93C

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: exitfflushfwrite
String ID: [GC] cannot register global variable; too many global variables
API String ID: 3476253079-2146260042
Opcode ID: a171ecbd8870034556625941e9756daf10bdc1cbc3b2acaf7614254cba44feb3
Instruction ID: 08ebba02b5b36af7409eba46b3b81dc39efb3781fd1b9eb5419a33466852c97d
Opcode Fuzzy Hash: a171ecbd8870034556625941e9756daf10bdc1cbc3b2acaf7614254cba44feb3
Instruction Fuzzy Hash: FCF03022E59B42D5F6046B61E8463B926B1FF8AB41F852537E9CE173F2DF2DA151C300

Function 00007FFE0E13C9F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13C9FF
GetProcAddress.KERNEL32 ref: 00007FFE0E13CA21

Strings

kernel32, xrefs: 00007FFE0E13C9F8
AttachConsole, xrefs: 00007FFE0E13CA14

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: AttachConsole$kernel32
API String ID: 2574300362-374305082
Opcode ID: 960aa4397a13f9497081fe059081674e85d4f086b5cc47264218468e45188bc1
Instruction ID: 665f73e8cd5fb583f99a231c4d618fb360f3bc216d38f9cdee39dd6ab87e9412
Opcode Fuzzy Hash: 960aa4397a13f9497081fe059081674e85d4f086b5cc47264218468e45188bc1
Instruction Fuzzy Hash: B9F09A61A4AA02C0E949DB22BC4407672E6BF88B94F84057BCCCD463B0EF3CA185C340

Function 00007FFE0E13EBF2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13EC0B
GetProcAddress.KERNEL32 ref: 00007FFE0E13EC27

Strings

Ws2_32.dll, xrefs: 00007FFE0E13EC04
inet_ntop, xrefs: 00007FFE0E13EC20

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Ws2_32.dll$inet_ntop
API String ID: 2574300362-2739477577
Opcode ID: 914704028e4e1037669f4e11dce6df8e21213c999ae66db6755afc4eb31b2321
Instruction ID: 024834d2069ac56fd1ab66b5b99b06d1bf048141c8cdea8aa71214ef869677c5
Opcode Fuzzy Hash: 914704028e4e1037669f4e11dce6df8e21213c999ae66db6755afc4eb31b2321
Instruction Fuzzy Hash: AFE0BD21A5AE42C0EA4A9B24ED442B863E1FF49700F9440BBC88D423B0EF3CA55AC350

Function 00007FFE0E1381D0 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 332COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E136B50: memset.MSVCRT ref: 00007FFE0E136BE2

memcpy.MSVCRT ref: 00007FFE0E138484

Strings

[[rerais, xrefs: 00007FFE0E138648
ed from:, xrefs: 00007FFE0E138652
]], xrefs: 00007FFE0E138628

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpymemset
String ID: [[rerais$]]$ed from:
API String ID: 1297977491-96586220
Opcode ID: 4de7edbcc6b12fb41e346efe08153019dc93f70cd32370dedc5e014a18505298
Instruction ID: f7c80199c0b70cb48b408c1629cdcee2bae7ae9cbfd1150b626d2d80fd41c999
Opcode Fuzzy Hash: 4de7edbcc6b12fb41e346efe08153019dc93f70cd32370dedc5e014a18505298
Instruction Fuzzy Hash: 27E18776A09B8681EA648F25E4003AE77A8FB49B98F544637EEAD077E0DF3DD545C300

Function 00007FFE0E149920 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 204COMMON

Download Yara Rule

Strings

clr.nim, xrefs: 00007FFE0E149B95
clrError, xrefs: 00007FFE0E149B9C
CLRError, xrefs: 00007FFE0E14997A

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: memcpymemset
String ID: CLRError$clr.nim$clrError
API String ID: 1297977491-2830349459
Opcode ID: 10f23ab442f7161de1a4e5cab30c6324a6b80ed03321f59bc245b0addc95e8d4
Instruction ID: 8a7f37976afbcc7d8265fd4e740e01cbcc64f7f71c5c44684600640f3594a22a
Opcode Fuzzy Hash: 10f23ab442f7161de1a4e5cab30c6324a6b80ed03321f59bc245b0addc95e8d4
Instruction Fuzzy Hash: 3D91D6A2A0CB8685E7118B15D8006BE3BA0FB557A4F554272DFEC0B7E2DE3CE550C350

Function 00007FFE0E135460 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

virtualFree failing!, xrefs: 00007FFE0E135730

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID:
String ID: virtualFree failing!
API String ID: 0-3108117800
Opcode ID: 1f137d6605ab7e2858848fd2a2c3146e9ccc07f199a0bb54434c994e38447113
Instruction ID: a6150c2ef07ea4b7b117c1b4b172c77d97d92af8be1a8ce848d3802047161daa
Opcode Fuzzy Hash: 1f137d6605ab7e2858848fd2a2c3146e9ccc07f199a0bb54434c994e38447113
Instruction Fuzzy Hash: CB81AEB2A05B4680EB18CB25E9457B933A2FF54B94F518236DEAD073A4EF7DE185C340

Function 00007FFE0E1351B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

virtualFree failing!, xrefs: 00007FFE0E135420

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID:
String ID: virtualFree failing!
API String ID: 0-3108117800
Opcode ID: 898de089e6a652b3b74e16420251f34d35e97e5bf78494b81a434b6a4fe685e7
Instruction ID: c20db5cccaff5d85b454a73eb6533fbe1eb464e1ca1d6cb2a88ac849398377a4
Opcode Fuzzy Hash: 898de089e6a652b3b74e16420251f34d35e97e5bf78494b81a434b6a4fe685e7
Instruction Fuzzy Hash: 5961CEB2A05B4680FA28CB25E8457B973A2FF54B94F558236DE9D033A4EF7DE185C340

Function 00007FFE0E1334F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00007FFE0E1335F6
exit.MSVCRT ref: 00007FFE0E133611

Strings

virtualFree failing!, xrefs: 00007FFE0E133600

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: FreeVirtualexit
String ID: virtualFree failing!
API String ID: 1212090140-3108117800
Opcode ID: 78c6a9389ec2a35e9909f5ee783a93cabf13e1c0a10bdb62cf2a036c13e9934b
Instruction ID: 3f980147961cdb566abdf14ee684a89b7d0b399b74ba98bcae9804b30cfabae2
Opcode Fuzzy Hash: 78c6a9389ec2a35e9909f5ee783a93cabf13e1c0a10bdb62cf2a036c13e9934b
Instruction Fuzzy Hash: 6351A0B2B15B4584EE19CB25C458BA833A6FB44790F62C23ADABD473A4EF79D5848340

Function 00007FFE0E133430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00007FFE0E1334C6
exit.MSVCRT ref: 00007FFE0E1334E6

Strings

virtualFree failing!, xrefs: 00007FFE0E1334D5

Memory Dump Source

Source File: 00000003.00000002.1912218581.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000003.00000002.1912185776.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912262619.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912294847.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912374228.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912413359.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912443775.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912488211.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912511890.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1912537555.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe0e130000_regsvr32.jbxd

Similarity

API ID: FreeVirtualexit
String ID: virtualFree failing!
API String ID: 1212090140-3108117800
Opcode ID: 85fe4ed7ebd342e25d4a31d68c50157dc6f40be3eecca2972c7da7329500421c
Instruction ID: 262d2b4795d11a36a548eea8ea02828c9e7e9667d7de8b72672e043d00c4397b
Opcode Fuzzy Hash: 85fe4ed7ebd342e25d4a31d68c50157dc6f40be3eecca2972c7da7329500421c
Instruction Fuzzy Hash: C011C4A2B15B4A81FE59DB26D8512B86791FF94BD0F58D13BC95D433A1DE6CE488C300

Analysis Process: rundll32.exePID: 6772, Parent PID: 6696COMMON

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1800
Total number of Limit Nodes:	11

Executed Functions

Function 00007FFE0E14F0D0 Relevance: 53.2, APIs: 4, Strings: 26, Instructions: 672
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlGetVersion.NTDLL ref: 00007FFE0E14F24A
memcpy.MSVCRT ref: 00007FFE0E14F326

Part of subcall function 00007FFE0E13C390: MultiByteToWideChar.KERNEL32 ref: 00007FFE0E13C3E7
Part of subcall function 00007FFE0E13C390: MultiByteToWideChar.KERNEL32 ref: 00007FFE0E13C44A

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

exit.MSVCRT ref: 00007FFE0E14F981
exit.MSVCRT ref: 00007FFE0E14F9B2

Strings

SetThreadContext, xrefs: 00007FFE0E14F739
Sleep, xrefs: 00007FFE0E14F838
GetComputerNameExA, xrefs: 00007FFE0E14FAC7
GlobalMemoryStatusEx, xrefs: 00007FFE0E14FAF0
RtlAllocateHeap, xrefs: 00007FFE0E14F8F0
RtlAddVectoredExceptionHandler, xrefs: 00007FFE0E14F6B5
GetFileSize, xrefs: 00007FFE0E14F8BC
T], xrefs: 00007FFE0E14FC0F
GetCurrentProcessId, xrefs: 00007FFE0E14F5D5
CreateFileA, xrefs: 00007FFE0E14F890
OpenThread, xrefs: 00007FFE0E14F791
MultiByteToWideChar, xrefs: 00007FFE0E14F80F
GetModuleHandleA, xrefs: 00007FFE0E14F6DE
GetCurrentThreadId, xrefs: 00007FFE0E14F7BD
CloseHandle, xrefs: 00007FFE0E14F765
ReadFile, xrefs: 00007FFE0E14F919
RtlInitUnicodeString, xrefs: 00007FFE0E14F552
GetProcessHeap, xrefs: 00007FFE0E14F656
GetDiskFreeSpaceExA, xrefs: 00007FFE0E14FB19
GetProcAddress, xrefs: 00007FFE0E14F682
GetThreadContext, xrefs: 00007FFE0E14F70D
OpenProcess, xrefs: 00007FFE0E14F62D
WaitForSingleObject, xrefs: 00007FFE0E14F7E6
GetTickCount, xrefs: 00007FFE0E14F864
VirtualProtect, xrefs: 00007FFE0E14F601
LdrLoadDll, xrefs: 00007FFE0E14F51E

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpy$ByteCharMultiWideexit$Version
String ID: CloseHandle$CreateFileA$GetComputerNameExA$GetCurrentProcessId$GetCurrentThreadId$GetDiskFreeSpaceExA$GetFileSize$GetModuleHandleA$GetProcAddress$GetProcessHeap$GetThreadContext$GetTickCount$GlobalMemoryStatusEx$LdrLoadDll$MultiByteToWideChar$OpenProcess$OpenThread$ReadFile$RtlAddVectoredExceptionHandler$RtlAllocateHeap$RtlInitUnicodeString$SetThreadContext$Sleep$VirtualProtect$WaitForSingleObject$T]
API String ID: 206777904-685478019
Opcode ID: b45f2f8461dc00cc225e3df3eeb2e6f5cb47b4b7ce774521207b75bae5f129ac
Instruction ID: 6c2b76d9e2dcf6567f574f206e0d4934e61591816cbdcff9d8d3bd1f98a7c4b3
Opcode Fuzzy Hash: b45f2f8461dc00cc225e3df3eeb2e6f5cb47b4b7ce774521207b75bae5f129ac
Instruction Fuzzy Hash: 726208B5F19B0781FA14ABA9E455AB923A1FF89B80F845437D98D1B7B6DE3CE011C340

Function 00007FFE0E14C870 Relevance: 12.4, APIs: 8, Instructions: 352
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

CreateFileA.KERNEL32 ref: 00007FFE0E14C948
GetFileSize.KERNEL32 ref: 00007FFE0E14C956
ReadFile.KERNEL32 ref: 00007FFE0E14C9A5

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpy$File$CreateReadSize
String ID:
API String ID: 3349561689-0
Opcode ID: a8202178b302e06c8707e63b6a2b76a7fa594dfccb05227361a63074442d66f1
Instruction ID: 9ea9f028ffebf61283f37a72def0b60319a3bec4377fd314401ede3a39822efd
Opcode Fuzzy Hash: a8202178b302e06c8707e63b6a2b76a7fa594dfccb05227361a63074442d66f1
Instruction Fuzzy Hash: 67F112A2A0E7C182EB20CB65E45477ABFA1FB85B80F098136DADE477A5DE3CD145C350

Function 00007FFE0E14D520 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 619
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE0E136B50: memset.MSVCRT ref: 00007FFE0E136BE2

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

HeapCreate.KERNELBASE ref: 00007FFE0E14D581
LoadLibraryA.KERNEL32 ref: 00007FFE0E14D8EF
GetProcAddress.KERNEL32 ref: 00007FFE0E14D92B
exit.MSVCRT ref: 00007FFE0E14DB71
VirtualProtect.KERNEL32 ref: 00007FFE0E14D781

Part of subcall function 00007FFE0E14EF30: fwrite.MSVCRT ref: 00007FFE0E14EF6F

Strings

Jo ., xrefs: 00007FFE0E14DBBE
VariantConversionError, xrefs: 00007FFE0E14DFFF
toVariant, xrefs: 00007FFE0E14E066
com.nim, xrefs: 00007FFE0E14E053

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpy$AddressCreateHeapLibraryLoadProcProtectVirtualexitfwritememset
String ID: Jo .$VariantConversionError$com.nim$toVariant
API String ID: 1711561947-479195221
Opcode ID: 267aad6122c0e13e02fc832062a4c5bc73dba4db2a22413d8cfe2e07d4621de0
Instruction ID: b180b70066d2219dc2e5d860d64a013653b37e144978ef48df02bc3f3d9c8809
Opcode Fuzzy Hash: 267aad6122c0e13e02fc832062a4c5bc73dba4db2a22413d8cfe2e07d4621de0
Instruction Fuzzy Hash: 066246A2B09B4691EB10DB60E8543BA23A1FF85B94F804137DA9E477B6DF3CE545C380

Function 00007FFE0E150950 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 218
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fileno.MSVCRT ref: 00007FFE0E15096D
_setmode.MSVCRT ref: 00007FFE0E15097E
_fileno.MSVCRT ref: 00007FFE0E15098A
_setmode.MSVCRT ref: 00007FFE0E150994
_fileno.MSVCRT ref: 00007FFE0E1509A0
_setmode.MSVCRT ref: 00007FFE0E1509AA
LoadLibraryA.KERNEL32 ref: 00007FFE0E1509B7
GetProcAddress.KERNEL32 ref: 00007FFE0E1509D6
CoInitializeEx.COMBASE ref: 00007FFE0E150BDD

Strings

inet_ntop, xrefs: 00007FFE0E1509CF

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: _fileno_setmode$AddressInitializeLibraryLoadProc
String ID: inet_ntop
API String ID: 2337794837-448242623
Opcode ID: 63bcff974b24ba70f64acc777d788e640980a957896653db4294a53ead9a9139
Instruction ID: 3d0441a3fd2b9ae56ad53d10fe99b28e43d44d038bf4b2224a30da2c72688827
Opcode Fuzzy Hash: 63bcff974b24ba70f64acc777d788e640980a957896653db4294a53ead9a9139
Instruction Fuzzy Hash: 81A14172A09B4A81EB119F99E8143A873A0FB89B80F948537DADC233A5DF3DE455C740

Function 00007FFE0E145CC0 Relevance: 10.6, APIs: 7, Instructions: 98
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00007FFE0E145CC7
Sleep.KERNEL32 ref: 00007FFE0E145CD4
SleepEx.KERNELBASE ref: 00007FFE0E145CDA
exit.MSVCRT ref: 00007FFE0E145CEB
memcpy.MSVCRT ref: 00007FFE0E145D6B
memcpy.MSVCRT ref: 00007FFE0E145D8B

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: Sleepmemcpy$CountTickexit
String ID:
API String ID: 3478675858-0
Opcode ID: 0bdc9acf1ffa6991366d1e7dbc8e9db2be78bbb090259d4902cde132a9111b43
Instruction ID: c2debfd109fb03b81b8e0001fd55044452663093610d125ae3361cfdf44075bc
Opcode Fuzzy Hash: 0bdc9acf1ffa6991366d1e7dbc8e9db2be78bbb090259d4902cde132a9111b43
Instruction Fuzzy Hash: 22413B72B09A5692EB11AF18E9943AC73A1FF44B84F448437CA8D177A5EF3CE952C340

Function 00007FFE0E13A9B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13ABE6
GetProcAddress.KERNEL32 ref: 00007FFE0E13AC08

Strings

IsEqualGUID, xrefs: 00007FFE0E13ABFB
ole32, xrefs: 00007FFE0E13AB9C

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: IsEqualGUID$ole32
API String ID: 2574300362-2239048069
Opcode ID: 7ff10b3fd0906f5e01960bbf5f10ae61445133da43785ccd3f84570ed7f384fa
Instruction ID: 196fcbb036f43c9fc6d75697a3f333a8677996702306e6ec7d5d33c57413b403
Opcode Fuzzy Hash: 7ff10b3fd0906f5e01960bbf5f10ae61445133da43785ccd3f84570ed7f384fa
Instruction Fuzzy Hash: 3661AE2191DB8296F6528B58F8857B573B4BF4CB44F80223BC9DD872B0EF3DA6858340

Function 00007FFE0E1317F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

exit.MSVCRT(?,?,?,?,00007FFE0E1318E5,?,?,?,?,00007FFE0E17E968,?,3F000000,00000196F0F8C260,00007FFE0E13244D,0000040F), ref: 00007FFE0E131821
memset.MSVCRT ref: 00007FFE0E131871

Strings

out of memory, xrefs: 00007FFE0E13180D

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: exitmemset
String ID: out of memory
API String ID: 2099101326-49810860
Opcode ID: a22d6bbd68ecaa542f404404ab495eed28682d22c7e6bab6dcadafd07e105a1a
Instruction ID: 6de8e848fd82886408c6efd7dea4b4eb269f35c18a616f8305ae4af0bc787711
Opcode Fuzzy Hash: a22d6bbd68ecaa542f404404ab495eed28682d22c7e6bab6dcadafd07e105a1a
Instruction Fuzzy Hash: 0B218132F0AB8580FB185F66E4483A963A0EB48FD4F088076DE8C0B7A5DE3CE481C340

Function 00007FFE0E144E70 Relevance: 5.2, APIs: 4, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

memcpy.MSVCRT ref: 00007FFE0E144F09
memcpy.MSVCRT ref: 00007FFE0E144FB9
memcpy.MSVCRT ref: 00007FFE0E144FDA

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cdbec6f9a2dd2351946039720b62acdf348dc7ef4a10d577622d7a41df4bf1b5
Instruction ID: a01483521fc8d50d56d325ca0927091d0fb8182adbaa78c166a4981e769a3133
Opcode Fuzzy Hash: cdbec6f9a2dd2351946039720b62acdf348dc7ef4a10d577622d7a41df4bf1b5
Instruction Fuzzy Hash: E9614872609B8592EA21DF05E8503ED77A0FB88B84F868533DA9D4B7A5EF3CD509C340

Function 00007FFE0E131A00 Relevance: 3.9, APIs: 3, Instructions: 159
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00007FFE0E131A5D

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1790b6db0320995f7436345c45903ecaa4b7fcd4b84692f55c2bdba6814a56ae
Instruction ID: 06a006730b62e0267ec61fb51f24ffb8a6b85390ebef0bf4687352f3647e94a6
Opcode Fuzzy Hash: 1790b6db0320995f7436345c45903ecaa4b7fcd4b84692f55c2bdba6814a56ae
Instruction Fuzzy Hash: 26514BB2706B9590EF159B2AD8483B936A5FB54FC4F588536DE8D0B7A8EE3DE441C300

Function 00007FFE0E146C30 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE0E13FC60: memcpy.MSVCRT ref: 00007FFE0E13FD00

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

GetFileAttributesW.KERNEL32 ref: 00007FFE0E146C78
GetFileAttributesW.KERNEL32 ref: 00007FFE0E146CE4

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpy$AttributesFile
String ID:
API String ID: 3559115319-0
Opcode ID: 42e9d04e5c697c9ee4175a46a3db53c6dcec2e3e28c3b2640cf8511a3308ae26
Instruction ID: 5989012367a89036984a62e59ce8330c00f6a6eacdac5422eabe04bca07363be
Opcode Fuzzy Hash: 42e9d04e5c697c9ee4175a46a3db53c6dcec2e3e28c3b2640cf8511a3308ae26
Instruction Fuzzy Hash: 8021A752F4AA0781FE09EB25B9541B52392EF95794F988037DC8E0B3B5EE3CE8428340

Function 00007FFE0E131830 Relevance: 2.6, APIs: 2, Instructions: 88
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FFE0E131871
VirtualAlloc.KERNEL32 ref: 00007FFE0E131893

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: AllocVirtualmemset
String ID:
API String ID: 921305906-0
Opcode ID: 3ff3c6db38c44a7a331b5cd085444be021dc225577a1303040b3e8ac49655f0c
Instruction ID: c3b093a9a93828be7432a1894dc2ed9c6c9d17280894121fcd594aa5816508cd
Opcode Fuzzy Hash: 3ff3c6db38c44a7a331b5cd085444be021dc225577a1303040b3e8ac49655f0c
Instruction Fuzzy Hash: 4E318C32B06B8081EB158F66F8447AD76A4EB48FD4F198076DE8C0B7A5DE38D582C300

Function 00007FFE0E1327D0 Relevance: 1.4, APIs: 1, Instructions: 165
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00007FFE0E1328E1

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7a838eac63a25573b851f49d3af618f8f0d33cadf4e87795c7358daf39240612
Instruction ID: 275b8aa8fe5266c9a39243b75965f2374c643625345a15a870d3e7f12dd3053c
Opcode Fuzzy Hash: 7a838eac63a25573b851f49d3af618f8f0d33cadf4e87795c7358daf39240612
Instruction Fuzzy Hash: 6271CEB2A05B4191EA19AF29D4443A833E5FF04B84F58823ADA8D077B5EF38E5D1C300

Function 00007FFE0E136B50 Relevance: 1.3, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FFE0E136BE2

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: b532521561d45849a7f1e55b540afb33b99293abbe439fb3ef002cd9d2cb91db
Instruction ID: 245f4d5451fb1f29f08d8851f56c16b25a6ce852d24118106d61ca69cafec03f
Opcode Fuzzy Hash: b532521561d45849a7f1e55b540afb33b99293abbe439fb3ef002cd9d2cb91db
Instruction Fuzzy Hash: FA416CB7A09A46A0EA10CF25D4502BC73A4FB58BA0F844237CA9E077F4DF78D995C340

Non-executed Functions

Function 00007FFE0E14D040 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 219threadlibraryloaderCOMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 00007FFE0E14D07C
memset.MSVCRT ref: 00007FFE0E14D08D
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FFE0E14D0F5
Thread32First.KERNEL32 ref: 00007FFE0E14D153
GetCurrentProcessId.KERNEL32 ref: 00007FFE0E14D16F
CloseHandle.KERNEL32 ref: 00007FFE0E14D19A
OpenThread.KERNEL32 ref: 00007FFE0E14D1C8
GetThreadContext.KERNEL32 ref: 00007FFE0E14D1E0
SetThreadContext.KERNEL32 ref: 00007FFE0E14D234
CloseHandle.KERNEL32 ref: 00007FFE0E14D25D
GetModuleHandleA.KERNEL32 ref: 00007FFE0E14D2AC
GetProcAddress.KERNEL32 ref: 00007FFE0E14D304
RtlInitUnicodeString.NTDLL ref: 00007FFE0E14D3A3
LdrLoadDll.NTDLL ref: 00007FFE0E14D3B3

Strings

J*!=, xrefs: 00007FFE0E14D1FF
jt+9, xrefs: 00007FFE0E14D322

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: HandleThread$CloseContext$AddressCreateCurrentExceptionFirstHandlerInitLoadModuleOpenProcProcessSnapshotStringThread32Toolhelp32UnicodeVectoredmemset
String ID: J*!=$jt+9
API String ID: 3419048117-242937532
Opcode ID: a9628e8f766383207b41f0b76916dcf45cde8c8b4db2eb96fa1eba45f2c1ec0d
Instruction ID: d1f3e824dc2ef7e7fccb7f6ab6f49cfe4c63fe7e469a0700dea47e5572a20720
Opcode Fuzzy Hash: a9628e8f766383207b41f0b76916dcf45cde8c8b4db2eb96fa1eba45f2c1ec0d
Instruction Fuzzy Hash: ADA18FA2B09B4292EE10DB11F8443BA63A1FF84B94F844537DA8E077A8DF3CE546C340

Function 00007FFE0E13D310 Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 229COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E1395B0: memcpy.MSVCRT ref: 00007FFE0E13960B

memcpy.MSVCRT ref: 00007FFE0E13D527

Strings

type in , xrefs: 00007FFE0E13D5A7
formatValue, xrefs: 00007FFE0E13D67D
format s, xrefs: 00007FFE0E13D5B8
ValueError, xrefs: 00007FFE0E13D56F
ed 's', , xrefs: 00007FFE0E13D5F0
strformat.nim, xrefs: 00007FFE0E13D667
, expect, xrefs: 00007FFE0E13D5E2
but got , xrefs: 00007FFE0E13D5FE
invalid , xrefs: 00007FFE0E13D59D
tring fo, xrefs: 00007FFE0E13D5C6
r string, xrefs: 00007FFE0E13D5D4

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpy
String ID: , expect$ValueError$but got $ed 's', $format s$formatValue$invalid $r string$strformat.nim$tring fo$type in
API String ID: 3510742995-1773161451
Opcode ID: 3b737671fdecec1ccda9928ca60f407ce4e1cf31fb0526f2aeb49fa47f716a7c
Instruction ID: 2b1e73820ed8ecfebfca614a9b5ffa596e317c80d73e65a884f85d03059282aa
Opcode Fuzzy Hash: 3b737671fdecec1ccda9928ca60f407ce4e1cf31fb0526f2aeb49fa47f716a7c
Instruction Fuzzy Hash: 5A9101A2B08A4282EB15CB25F41477E36A0EB85B84F419133EE9D077E1DF7DE880C341

Function 00007FFE0E13C670 Relevance: 45.7, APIs: 12, Strings: 14, Instructions: 158libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13C680
GetProcAddress.KERNEL32 ref: 00007FFE0E13C6AD
GetProcAddress.KERNEL32 ref: 00007FFE0E13C6D3
GetProcAddress.KERNEL32 ref: 00007FFE0E13C6F9
GetProcAddress.KERNEL32 ref: 00007FFE0E13C71F
GetProcAddress.KERNEL32 ref: 00007FFE0E13C745
GetProcAddress.KERNEL32 ref: 00007FFE0E13C76B
GetProcAddress.KERNEL32 ref: 00007FFE0E13C791

Part of subcall function 00007FFE0E13A8E0: GetProcAddress.KERNEL32 ref: 00007FFE0E13A8EE

GetProcAddress.KERNEL32 ref: 00007FFE0E13C7D1
GetProcAddress.KERNEL32 ref: 00007FFE0E13C811
GetProcAddress.KERNEL32 ref: 00007FFE0E13C837
GetProcAddress.KERNEL32 ref: 00007FFE0E13C85D

Strings

GetCurrentProcess, xrefs: 00007FFE0E13C7F1
ResumeThread, xrefs: 00007FFE0E13C823
HeapAlloc, xrefs: 00007FFE0E13C70B
WaitForSingleObject, xrefs: 00007FFE0E13C849
kernel32, xrefs: 00007FFE0E13C679
LoadLibraryA, xrefs: 00007FFE0E13C757
GetProcessHeap, xrefs: 00007FFE0E13C731
GetCurrentThread, xrefs: 00007FFE0E13C699
HeapCreate, xrefs: 00007FFE0E13C6E5
GetProcAddress, xrefs: 00007FFE0E13C77D
InitializeProcThreadAttributeList, xrefs: 00007FFE0E13C7A3
GetThreadContext, xrefs: 00007FFE0E13C6BF
UpdateProcThreadAttribute, xrefs: 00007FFE0E13C7B1
CreateProcessW, xrefs: 00007FFE0E13C7E3

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessW$GetCurrentProcess$GetCurrentThread$GetProcAddress$GetProcessHeap$GetThreadContext$HeapAlloc$HeapCreate$InitializeProcThreadAttributeList$LoadLibraryA$ResumeThread$UpdateProcThreadAttribute$WaitForSingleObject$kernel32
API String ID: 2238633743-547029440
Opcode ID: c58de225f95c152ab6af1b470b37807868feafa623f41c2bcfb802640fa2ff2c
Instruction ID: c5433b138257bcf5935ced3e29fb4480aba456a09241f37610f58a11cc730beb
Opcode Fuzzy Hash: c58de225f95c152ab6af1b470b37807868feafa623f41c2bcfb802640fa2ff2c
Instruction Fuzzy Hash: 3761E765B0AA0390ED44A722B91447673A1BF48BC8F98547BCCCD5B3B1EF3CA545E3A4

Function 00007FFE0E14C1D0 Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 396COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FFE0E14C2DC
memcpy.MSVCRT ref: 00007FFE0E14C3F9
memcpy.MSVCRT ref: 00007FFE0E14C41B
memcpy.MSVCRT ref: 00007FFE0E14C440
memcpy.MSVCRT ref: 00007FFE0E14C465
memcpy.MSVCRT ref: 00007FFE0E14C48A

Strings

p, xrefs: 00007FFE0E14C2A1
*7;u, xrefs: 00007FFE0E14C496

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpy$FileModuleName
String ID: *7;u$p
API String ID: 1955653913-3490293476
Opcode ID: 645625445c2e909ecbe63e0be60bb5919e0017e978dff1b72ba1033b1c89a85e
Instruction ID: 347d2f54ae6f7b132ff34f6c40c5f5ae0114f50581e7bbe922afd297b2952dac
Opcode Fuzzy Hash: 645625445c2e909ecbe63e0be60bb5919e0017e978dff1b72ba1033b1c89a85e
Instruction Fuzzy Hash: 89022AB2B09B8692EB54DF15E4543AAB7A1FB84B84F458037DA9C0B7A9EF3CD505C340

Function 00007FFE0E139290 Relevance: 28.1, APIs: 6, Strings: 10, Instructions: 89stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FFE0E139393
exit.MSVCRT ref: 00007FFE0E1393A8
signal.MSVCRT ref: 00007FFE0E1393C5
signal.MSVCRT ref: 00007FFE0E1393D2
signal.MSVCRT ref: 00007FFE0E1393DF
signal.MSVCRT ref: 00007FFE0E1393EC

Strings

fatal.nim, xrefs: 00007FFE0E139318
5, xrefs: 00007FFE0E13930F
unknown signal, xrefs: 00007FFE0E139379, 00007FFE0E1393B0
SIGILL: Illegal operation., xrefs: 00007FFE0E139380
SIGABRT: Abnormal termination., xrefs: 00007FFE0E13935E
SIGSEGV: Illegal storage access. (Attempt to read from nil?), xrefs: 00007FFE0E139352
SIGFPE: Arithmetic error., xrefs: 00007FFE0E13936A
SIGINT: Interrupted by Ctrl-C., xrefs: 00007FFE0E139346
sysFatal, xrefs: 00007FFE0E139325
ReraiseDefect, xrefs: 00007FFE0E1392BA

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: signal$exitstrlen
String ID: 5$ReraiseDefect$SIGABRT: Abnormal termination.$SIGFPE: Arithmetic error.$SIGILL: Illegal operation.$SIGINT: Interrupted by Ctrl-C.$SIGSEGV: Illegal storage access. (Attempt to read from nil?)$fatal.nim$sysFatal$unknown signal
API String ID: 1414789275-2829261224
Opcode ID: db43e712b9be7a93631420e14b105a0930ecd6170e45012433f711954e299830
Instruction ID: a7053e46752a173a43a732335e2fd9168a531fd799413bc9e0b354a34205d696
Opcode Fuzzy Hash: db43e712b9be7a93631420e14b105a0930ecd6170e45012433f711954e299830
Instruction Fuzzy Hash: 5D315C66E18A02E0FA18AB25E8596BDB365BF45784F880437EE9D473F5DF3CA644C340

Function 00007FFE0E14E250 Relevance: 26.5, APIs: 3, Strings: 12, Instructions: 203libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144F09
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FB9
Part of subcall function 00007FFE0E144E70: memcpy.MSVCRT ref: 00007FFE0E144FDA

LoadLibraryA.KERNEL32 ref: 00007FFE0E14E5B3
GetProcAddress.KERNEL32 ref: 00007FFE0E14E5DC
LoadLibraryA.KERNEL32 ref: 00007FFE0E14E5F2

Strings

kernel32.dll, xrefs: 00007FFE0E14E5EB
remoteProcID2, xrefs: 00007FFE0E14E2E4
OpenProcess, xrefs: 00007FFE0E14E626
key5, xrefs: 00007FFE0E14E465
NtFlushInstructionCache4, xrefs: 00007FFE0E14E33F
:state, xrefs: 00007FFE0E14E2C0
cipher, xrefs: 00007FFE0E14E492
GetFileAttributesW, xrefs: 00007FFE0E14E603
tProcess1, xrefs: 00007FFE0E14E2D4
dctx6, xrefs: 00007FFE0E14E4F0
RtlGetVersion, xrefs: 00007FFE0E14E5C8
treadHandle3, xrefs: 00007FFE0E14E2FE

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpy$LibraryLoad$AddressProc
String ID: :state$GetFileAttributesW$NtFlushInstructionCache4$OpenProcess$RtlGetVersion$cipher$dctx6$kernel32.dll$key5$remoteProcID2$tProcess1$treadHandle3
API String ID: 3980900384-2224378161
Opcode ID: 5024ca8dcfbd9f7da15cbb3ce75fc2b1b4ac0722f133e5d66a90e89f756bd335
Instruction ID: 38a1b40b4bd4aa54716553016ded1f9e1eec2551bd6e2a1a233d381790414c33
Opcode Fuzzy Hash: 5024ca8dcfbd9f7da15cbb3ce75fc2b1b4ac0722f133e5d66a90e89f756bd335
Instruction Fuzzy Hash: 9CB10321A19B4385FB129B28A9403A573A2FF55744F84527BCDDC563B2EF7DB289C380

Function 00007FFE0E1464C0 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 202COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FFE0E1464E2

Strings

not in , xrefs: 00007FFE0E1467D7
IndexDefect, xrefs: 00007FFE0E146587
not in , xrefs: 00007FFE0E14676F
0 .., xrefs: 00007FFE0E146711
os.nim, xrefs: 00007FFE0E1465F4
0 .., xrefs: 00007FFE0E146818
inde, xrefs: 00007FFE0E146808
not in , xrefs: 00007FFE0E1466F7
paramStr, xrefs: 00007FFE0E14660A

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: CommandLine
String ID: not in $ not in $ not in $0 ..$0 ..$IndexDefect$inde$os.nim$paramStr
API String ID: 3253501508-369068400
Opcode ID: 176fa0095b720560e638bb860fa3f59553cefa47951e64ab9f53068569c9af63
Instruction ID: c75b100ea3c77a68e98ffa9a6a52b1f7038a7919dc14654df91ce1f41104dd78
Opcode Fuzzy Hash: 176fa0095b720560e638bb860fa3f59553cefa47951e64ab9f53068569c9af63
Instruction Fuzzy Hash: 719167B2A09B4281EB11DF15E9483A97BA4FF85B94F458037DA9D0B3A5EF3CE505C380

Function 00007FFE0E146140 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E136B50: memset.MSVCRT ref: 00007FFE0E136BE2

FormatMessageW.KERNEL32 ref: 00007FFE0E1461B5
memcpy.MSVCRT ref: 00007FFE0E146329
LocalFree.KERNEL32 ref: 00007FFE0E1463D2

Strings

unknown , xrefs: 00007FFE0E14636D
OSError, xrefs: 00007FFE0E146173
Addition, xrefs: 00007FFE0E14629A
OS error, xrefs: 00007FFE0E146453
al info:, xrefs: 00007FFE0E1462AD
OS error, xrefs: 00007FFE0E146363
unknown , xrefs: 00007FFE0E146449

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: FormatFreeLocalMessagememcpymemset
String ID: Addition$OS error$OS error$OSError$al info:$unknown $unknown
API String ID: 4084645559-3457963805
Opcode ID: e43746b6d3e31976e80ed3e78efbe06e3184e3a06d24456f847f49f2a0480dcd
Instruction ID: 1cccb3bbc91015aeeee5e269373db9da998e94715edf409a3f9cc118bffac880
Opcode Fuzzy Hash: e43746b6d3e31976e80ed3e78efbe06e3184e3a06d24456f847f49f2a0480dcd
Instruction Fuzzy Hash: C38189B6B09B5681EE519B19E45877E37A8FF85B88F14843BDA8C073A5EF38D544C380

Function 00007FFE0E149DA0 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 175memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E13C390: MultiByteToWideChar.KERNEL32 ref: 00007FFE0E13C3E7
Part of subcall function 00007FFE0E13C390: MultiByteToWideChar.KERNEL32 ref: 00007FFE0E13C44A

SysAllocString.OLEAUT32 ref: 00007FFE0E149DDE
_setjmp.MSVCRT ref: 00007FFE0E149E34
CoInitialize.OLE32 ref: 00007FFE0E149FF0

Part of subcall function 00007FFE0E136B50: memset.MSVCRT ref: 00007FFE0E136BE2

memcpy.MSVCRT ref: 00007FFE0E149FA2
SysFreeString.OLEAUT32 ref: 00007FFE0E14A071

Strings

ed membe, xrefs: 00007FFE0E149F5D
specifi, xrefs: 00007FFE0E149F4F
o invoke, xrefs: 00007FFE0E149F35
unable t, xrefs: 00007FFE0E149F2B
r: , xrefs: 00007FFE0E149F73

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: ByteCharMultiStringWide$AllocFreeInitialize_setjmpmemcpymemset
String ID: specifi$ed membe$o invoke$r: $unable t
API String ID: 909372610-4084315218
Opcode ID: e426f8c4deaaf8e3db560116b79f21edf749721eaba173ae76d85139aeb9888e
Instruction ID: 3608184739cf9a4ce5186de14096b6b2228846c6f17fbbf68c7013223949e7e0
Opcode Fuzzy Hash: e426f8c4deaaf8e3db560116b79f21edf749721eaba173ae76d85139aeb9888e
Instruction Fuzzy Hash: E0A1B376609F8681EB60CF15E8943AAB7A4FB88B80F448136DACD47B69DF7CD454CB40

Function 00007FFE0E141E50 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 90libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E141E60
GetProcAddress.KERNEL32 ref: 00007FFE0E141E8D
GetProcAddress.KERNEL32 ref: 00007FFE0E141EB3

Strings

GetModuleFileNameW, xrefs: 00007FFE0E141E9F
GetLastError, xrefs: 00007FFE0E141F37
GetCommandLineW, xrefs: 00007FFE0E141E79
FormatMessageW, xrefs: 00007FFE0E141EEB
LocalFree, xrefs: 00007FFE0E141F11
GetCurrentDirectoryW, xrefs: 00007FFE0E141EC5
kernel32, xrefs: 00007FFE0E141E59

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: FormatMessageW$GetCommandLineW$GetCurrentDirectoryW$GetLastError$GetModuleFileNameW$LocalFree$kernel32
API String ID: 2238633743-3391179580
Opcode ID: 1287cbde34c9a01a5778edf70d3b897d3a7a108950112f86db042cfb1d222104
Instruction ID: 1a3c7d1cdd112e4c16a35ba3fc7ffd52b4cc74f30727a0f6db4887a477b311ce
Opcode Fuzzy Hash: 1287cbde34c9a01a5778edf70d3b897d3a7a108950112f86db042cfb1d222104
Instruction Fuzzy Hash: 9E312FA5B0AA0390EE45D71279544B663A1BF49BC8B84047BDCCD4B3B5EE3CA449E394

Function 00007FFE0E1489C0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E1489E2
SafeArrayCreate.OLEAUT32 ref: 00007FFE0E148A52
SafeArrayPutElement.OLEAUT32 ref: 00007FFE0E148AAD

Strings

VariantConversionError, xrefs: 00007FFE0E148B77
toVariant, xrefs: 00007FFE0E148C04
com.nim, xrefs: 00007FFE0E148BEE

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: c9a4d359ccf372bf526eaa78d5230b43e9c201022d9012c80fc7dd3dc61b5e02
Instruction ID: 77c4aba7d489da3a5bcb68e766c46eb7d55baee26957496e03fcf80fb2983331
Opcode Fuzzy Hash: c9a4d359ccf372bf526eaa78d5230b43e9c201022d9012c80fc7dd3dc61b5e02
Instruction Fuzzy Hash: 1B81ADA2B0AB4295EA54AB15E8587BE67A1FF40B80F944437EACD073B1DF7CE446C340

Function 00007FFE0E149600 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E149622
SafeArrayCreate.OLEAUT32 ref: 00007FFE0E149692
SafeArrayPutElement.OLEAUT32 ref: 00007FFE0E1496ED

Strings

VariantConversionError, xrefs: 00007FFE0E1497B7
toVariant, xrefs: 00007FFE0E149844
com.nim, xrefs: 00007FFE0E14982E

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: e59546261d6e30790542a23a76ed5ab6d73a75fa9f730ccaf14fb43211ccd0fd
Instruction ID: cf9360ad58d506b4d4411ee2f788713b9d940a7b0920e67bde18c9f8771412e8
Opcode Fuzzy Hash: e59546261d6e30790542a23a76ed5ab6d73a75fa9f730ccaf14fb43211ccd0fd
Instruction Fuzzy Hash: 128157A2B0AB4791EB109B15E9586BE63A1FF84B84F844537DA9D073B5DF3CE845C380

Function 00007FFE0E148270 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E148292
SafeArrayCreate.OLEAUT32 ref: 00007FFE0E148302
SafeArrayPutElement.OLEAUT32 ref: 00007FFE0E148358

Strings

VariantConversionError, xrefs: 00007FFE0E1483FF
toVariant, xrefs: 00007FFE0E14848C
com.nim, xrefs: 00007FFE0E148476

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: 697b9fa782d9ff8b20fb0e63cbcfd5e65f50ec7fbf6534a61681d9b41f57343c
Instruction ID: 3b37c313002a21b2ad2d699b6e3e66c0c83775dd160362aac333aefe52bf781d
Opcode Fuzzy Hash: 697b9fa782d9ff8b20fb0e63cbcfd5e65f50ec7fbf6534a61681d9b41f57343c
Instruction Fuzzy Hash: 75718CA2B0AB0695EA55AB05E9587BE63A1FF44B84F844537EACD073B0DF3CE441C380

Function 00007FFE0E13C530 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13C548
GetProcAddress.KERNEL32 ref: 00007FFE0E13C571
LoadLibraryA.KERNEL32 ref: 00007FFE0E13C58A

Strings

MultiByteToWideChar, xrefs: 00007FFE0E13C5BE
kernel32, xrefs: 00007FFE0E13C541
lstrlenW, xrefs: 00007FFE0E13C5E0
SysStringLen, xrefs: 00007FFE0E13C59F
oleaut32, xrefs: 00007FFE0E13C583
WideCharToMultiByte, xrefs: 00007FFE0E13C55D

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: LibraryLoad$AddressProc
String ID: MultiByteToWideChar$SysStringLen$WideCharToMultiByte$kernel32$lstrlenW$oleaut32
API String ID: 1469910268-1955535950
Opcode ID: ee6e375a4fb4bccd2b28a38eab41fe4ff48691f0217c803988e2de915c1ce671
Instruction ID: 50fddb0466cb1475f479da3eb50a48eac9ff7740cd49e34045d11df1bbe58fc8
Opcode Fuzzy Hash: ee6e375a4fb4bccd2b28a38eab41fe4ff48691f0217c803988e2de915c1ce671
Instruction Fuzzy Hash: 2031F3A5B1AA03D0ED559B22B854476B3A1BF48B88B98153BDCDD473B1EE3CE405D3A0

Function 00007FFE0E13A680 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FFE0E13A6A9
fflush.MSVCRT ref: 00007FFE0E13A6B1
exit.MSVCRT ref: 00007FFE0E13A6BB
signal.MSVCRT ref: 00007FFE0E13A76E
signal.MSVCRT ref: 00007FFE0E13A77B
signal.MSVCRT ref: 00007FFE0E13A788
signal.MSVCRT ref: 00007FFE0E13A795
signal.MSVCRT ref: 00007FFE0E13A7A2

Strings

[GC] cannot register thread local variable; too many thread local variables, xrefs: 00007FFE0E13A69C

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: signal$exitfflushfwrite
String ID: [GC] cannot register thread local variable; too many thread local variables
API String ID: 3958355099-685140759
Opcode ID: fa8ccfdcd3ab8ba8d84ef958eb0a57ba01de52049acf6b168819aab5f8359f7c
Instruction ID: 389863c5b7d13818841a51b3535989dfd102dbcd312e5236424c1690ac05d406
Opcode Fuzzy Hash: fa8ccfdcd3ab8ba8d84ef958eb0a57ba01de52049acf6b168819aab5f8359f7c
Instruction Fuzzy Hash: B5215C66A09A0285FA146B65E8467BA7261FF86B80F845837E9DD173F2DF3CA211C304

Function 00007FFE0E13CA70 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 333COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E13CDFE

Strings

tring, c, xrefs: 00007FFE0E13CDB5
parseStandardFormatSpecifier, xrefs: 00007FFE0E13CE59
rse:, xrefs: 00007FFE0E13CDE0
., xrefs: 00007FFE0E13CB98
invalid , xrefs: 00007FFE0E13CD9A
ValueError, xrefs: 00007FFE0E13CBEA
format s, xrefs: 00007FFE0E13CDA4
strformat.nim, xrefs: 00007FFE0E13CE43
annot pa, xrefs: 00007FFE0E13CDC3

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpy
String ID: .$ValueError$annot pa$format s$invalid $parseStandardFormatSpecifier$rse:$strformat.nim$tring, c
API String ID: 3510742995-876510697
Opcode ID: 06778b7551d1d1e2799e8a2043c97a13a64522767c93a9a919c662244adb7339
Instruction ID: 7776b066975a9f385217b065751afe5a250ae8ace22864d0174df733bc84a7c0
Opcode Fuzzy Hash: 06778b7551d1d1e2799e8a2043c97a13a64522767c93a9a919c662244adb7339
Instruction Fuzzy Hash: 50E1D2A2A0879596EB148B3495003E9BBA1FB157D4F488633DAAC277E9DB3CE145C390

Function 00007FFE0E1389D0 Relevance: 15.2, APIs: 6, Strings: 4, Instructions: 194stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E138A7A
strlen.MSVCRT ref: 00007FFE0E138AAE
strlen.MSVCRT ref: 00007FFE0E138AEF
strlen.MSVCRT ref: 00007FFE0E138C16
memcpy.MSVCRT ref: 00007FFE0E138C36
strlen.MSVCRT ref: 00007FFE0E138C3E

Strings

nhandled, xrefs: 00007FFE0E138A2C
excepti, xrefs: 00007FFE0E138A39
on: , xrefs: 00007FFE0E138A47
Error: u, xrefs: 00007FFE0E138A1B

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: strlen$memcpy
String ID: excepti$Error: u$nhandled$on:
API String ID: 3396830738-1220997370
Opcode ID: 620df2181a99c2d9f432fa450793f222c34056ad9a437eb17abca127aa62c4ed
Instruction ID: 0860cd6b5c6136fceca5f0858951ba55b5e27d08b3b4de618a5f36831518e937
Opcode Fuzzy Hash: 620df2181a99c2d9f432fa450793f222c34056ad9a437eb17abca127aa62c4ed
Instruction Fuzzy Hash: 0981C162B19A8686FB299B25D4113BA7361FF44B84F888537EB8D177E5EF2CE505C300

Function 00007FFE0E146830 Relevance: 15.2, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E1468E2
memcpy.MSVCRT ref: 00007FFE0E146A52
memcpy.MSVCRT ref: 00007FFE0E146A94

Part of subcall function 00007FFE0E137040: memcpy.MSVCRT ref: 00007FFE0E1370DC

Strings

VT_BYREF, xrefs: 00007FFE0E146908
VED|, xrefs: 00007FFE0E1469B5
VT_ARRAY, xrefs: 00007FFE0E146B00
VT_VECTO, xrefs: 00007FFE0E14694C
VT_ARRAY, xrefs: 00007FFE0E146A28
VT_ARRAY, xrefs: 00007FFE0E14687D
VT_RESER, xrefs: 00007FFE0E146998

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpy
String ID: VED|$VT_ARRAY$VT_ARRAY$VT_ARRAY$VT_BYREF$VT_RESER$VT_VECTO
API String ID: 3510742995-291823325
Opcode ID: aec648f9a95a20fb432d11329cea1dfd7ef1e45c34c68d363635f803f7b74143
Instruction ID: aee1af98b61cc4981106b5ef7f74e08e1f7bbb9a1864352cea63abcd810622de
Opcode Fuzzy Hash: aec648f9a95a20fb432d11329cea1dfd7ef1e45c34c68d363635f803f7b74143
Instruction Fuzzy Hash: 4E7158B2708B4A85EB119F15E8443AA77A4FB95B88F598037DF8D0B3A1EE7CD544C300

Function 00007FFE0E144610 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E144620
GetProcAddress.KERNEL32 ref: 00007FFE0E144649
GetProcAddress.KERNEL32 ref: 00007FFE0E14466B

Strings

CreateToolhelp32Snapshot, xrefs: 00007FFE0E144635
Thread32First, xrefs: 00007FFE0E144657
Thread32Next, xrefs: 00007FFE0E144679
kernel32, xrefs: 00007FFE0E144619

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateToolhelp32Snapshot$Thread32First$Thread32Next$kernel32
API String ID: 2238633743-3935561650
Opcode ID: 6c442825502bc7901ecd661716a16d1c8b49b900e669c40a7a4c98e00781447f
Instruction ID: e2279771b7ff47ad42abcbd4b35610a98292c3fefe455890bd81f046e47ab824
Opcode Fuzzy Hash: 6c442825502bc7901ecd661716a16d1c8b49b900e669c40a7a4c98e00781447f
Instruction Fuzzy Hash: B0113DA5B0EA0390FE159722BD1457A63A1BF49B84F980877CCED473B0EE7CA046D350

Function 00007FFE0E1314A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFE0E1314B9
LoadLibraryA.KERNEL32 ref: 00007FFE0E1314CA
GetProcAddress.KERNEL32 ref: 00007FFE0E1314E8
GetProcAddress.KERNEL32 ref: 00007FFE0E1314F8

Strings

__deregister_frame_info, xrefs: 00007FFE0E1314EB
__register_frame_info, xrefs: 00007FFE0E1314D7
libgcc_s_dw2-1.dll, xrefs: 00007FFE0E1314AF

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: 4b359fa39a413980578f20d51ef9706400725c07471b7bbc5a8fdffd70197d7b
Instruction ID: d19d629a3b53e0613472d1ea1b25a2e68c325c9ec19438d3f450bfa31d0aa70a
Opcode Fuzzy Hash: 4b359fa39a413980578f20d51ef9706400725c07471b7bbc5a8fdffd70197d7b
Instruction Fuzzy Hash: EF01C561A5AA07E0EA169B15BC505B933A5BF49788F840533DCDD43270EF3CE149D340

Function 00007FFE0E13B7F0 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E13B8DB

Strings

strutils.nim, xrefs: 00007FFE0E13B923
ValueError, xrefs: 00007FFE0E13B857, 00007FFE0E13B963
invalid , xrefs: 00007FFE0E13B8AA
invalid , xrefs: 00007FFE0E13B9A8
parseInt, xrefs: 00007FFE0E13B939
integer:, xrefs: 00007FFE0E13B993
integer:, xrefs: 00007FFE0E13B899

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpy
String ID: ValueError$integer:$integer:$invalid $invalid $parseInt$strutils.nim
API String ID: 3510742995-2575869123
Opcode ID: 15bf003bdc77111694311591c6e8ce157c1d6e781086ecfc85e6e3deb4704f3f
Instruction ID: 5a9a41dc9289ddd13fb2f5b9cfcd51a7063a2017a68e2d04a786aa847ba646f9
Opcode Fuzzy Hash: 15bf003bdc77111694311591c6e8ce157c1d6e781086ecfc85e6e3deb4704f3f
Instruction Fuzzy Hash: A9413672A09B0AD1EA209F25E8547AA73A4FF48B84F848437DACD477A5EF7CE545C340

Function 00007FFE0E13CFC0 Relevance: 11.5, APIs: 9, Instructions: 220COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FFE0E13D06B
memcpy.MSVCRT ref: 00007FFE0E13D0B1
memcpy.MSVCRT ref: 00007FFE0E13D0CD

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 9a95c766a421aee8bda3d61193bee614ed9ff932fcd03d974b4030aef223b19b
Instruction ID: 41aeaf78b52ac6210492a8ff25d33e0c52ba71c80a6da48fe58a854cd26ec7ec
Opcode Fuzzy Hash: 9a95c766a421aee8bda3d61193bee614ed9ff932fcd03d974b4030aef223b19b
Instruction Fuzzy Hash: D381C062B09A5681EE05EB25E8052BE77A1BF84F84F468533EE5D173A6EF3CE545C300

Function 00007FFE0E14BF00 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E14BF52
SafeArrayCreate.OLEAUT32 ref: 00007FFE0E14BFC0
SafeArrayPutElement.OLEAUT32 ref: 00007FFE0E14BFFD

Strings

VariantConversionError, xrefs: 00007FFE0E14C05F
toVariant, xrefs: 00007FFE0E14C0F2
com.nim, xrefs: 00007FFE0E14C0DC

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: 9eae0cf97d50d8a67c4e201ceeba8e2c2a17758a0522804396163c04e92e8b07
Instruction ID: 94c0ce4550d521aa69181214f9235ea93ed49713d9e6e50d5c96af1dc0b70f1f
Opcode Fuzzy Hash: 9eae0cf97d50d8a67c4e201ceeba8e2c2a17758a0522804396163c04e92e8b07
Instruction Fuzzy Hash: 876136A2B0AB0291FA159B15A8187BE63A1FF85B84F544537DADD073B1EF3DE445C380

Function 00007FFE0E144CB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFE0E144D49
memcpy.MSVCRT ref: 00007FFE0E144D89

Strings

from, xrefs: 00007FFE0E144E55
convert , xrefs: 00007FFE0E144DD7
to , xrefs: 00007FFE0E144E60
convert , xrefs: 00007FFE0E144E2C
convert , xrefs: 00007FFE0E144D15

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpy
String ID: to $convert $convert $convert $from
API String ID: 3510742995-220309676
Opcode ID: dc9e2aa1a007e4dd8d834762d87609655c69aa9ff4af3a690f529dd9e52cdbfa
Instruction ID: 46eab1de0f5cbbf42e484e6d0fad7764f6ac1a23ede92afb688f0b11b2e74fd2
Opcode Fuzzy Hash: dc9e2aa1a007e4dd8d834762d87609655c69aa9ff4af3a690f529dd9e52cdbfa
Instruction Fuzzy Hash: 9E4159B2A09B4681EB05DF15D5483987BA1FB94B80F4A8037DB9C5B3A5EFB8D510C780

Function 00007FFE0E13C940 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13C950
GetProcAddress.KERNEL32 ref: 00007FFE0E13C979
GetProcAddress.KERNEL32 ref: 00007FFE0E13C99B

Strings

GetWindowThreadProcessId, xrefs: 00007FFE0E13C987
user32, xrefs: 00007FFE0E13C949
GetForegroundWindow, xrefs: 00007FFE0E13C965

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetForegroundWindow$GetWindowThreadProcessId$user32
API String ID: 2238633743-4060728576
Opcode ID: 099e45388bdc18e5a7f021420b8990e432f484574424dfb494841c910785b762
Instruction ID: 630a981e584bdba30fab39d1ae15849b5d385d5a2824ec11c675f526db689beb
Opcode Fuzzy Hash: 099e45388bdc18e5a7f021420b8990e432f484574424dfb494841c910785b762
Instruction Fuzzy Hash: 97011A65A5AB03D0EE459B22BC5457AB3A2BF49B84F88457BDCCD873B0EE3CA044C355

Function 00007FFE0E148FA0 Relevance: 9.3, APIs: 6, Instructions: 285stringCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00007FFE0E14908D
_setjmp.MSVCRT ref: 00007FFE0E149227
VariantCopy.OLEAUT32 ref: 00007FFE0E1492CD
strlen.MSVCRT ref: 00007FFE0E149347
memcpy.MSVCRT ref: 00007FFE0E14938A

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: CopyFreeStringVariant_setjmpmemcpystrlen
String ID:
API String ID: 649350220-0
Opcode ID: 1c8747582f73588acd678ea3ed29cea2ab5c6abdbe1ab605578c608991d5d4c0
Instruction ID: 83f494b72e32496d6c2e9bf6150034332e80dd3b47d8dc8f56378582060d80d6
Opcode Fuzzy Hash: 1c8747582f73588acd678ea3ed29cea2ab5c6abdbe1ab605578c608991d5d4c0
Instruction Fuzzy Hash: 73D138B6A19B8681EA55CB16E4403AE73A1FBC8B94F448133EE9D077A9DF3CE441C340

Function 00007FFE0E13101D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_amsg_exit.MSVCRT ref: 00007FFE0E131102
_initterm.MSVCRT ref: 00007FFE0E131137
_initterm.MSVCRT ref: 00007FFE0E13115E
_amsg_exit.MSVCRT ref: 00007FFE0E131240

Strings

0, xrefs: 00007FFE0E131070

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: _amsg_exit_initterm
String ID: 0
API String ID: 194249164-4108050209
Opcode ID: efee7c7564053665e09315d1a3c1bf29b97e43912d1bab046c58282f71b617ec
Instruction ID: cf483ee752bba1ee092aa0b48df9fb5434bd270b85cf89d27e2af28b6a70408b
Opcode Fuzzy Hash: efee7c7564053665e09315d1a3c1bf29b97e43912d1bab046c58282f71b617ec
Instruction Fuzzy Hash: 3D719236B09B068AEB508B65E8903AC37B1BB49B88F504436DE8D977A9CF7DE540C740

Function 00007FFE0E1486A0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E1486B9
VariantCopy.OLEAUT32 ref: 00007FFE0E14870A

Strings

VariantConversionError, xrefs: 00007FFE0E14872F
toVariant, xrefs: 00007FFE0E1487B4
com.nim, xrefs: 00007FFE0E14879E

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: CopyInitializeVariant
String ID: VariantConversionError$com.nim$toVariant
API String ID: 633353902-3035603046
Opcode ID: d53b74f056ed678ce3979812d694a4fd568094c6bbedb9c3d2a401089230e449
Instruction ID: 461681aa21f6c7ccf9b375c3dad53e9ae85f69ce65ac773a99064d7fd5f7dd60
Opcode Fuzzy Hash: d53b74f056ed678ce3979812d694a4fd568094c6bbedb9c3d2a401089230e449
Instruction Fuzzy Hash: F24169A2B0A70790EA55AB19A91877E6394FF44B84F844937D9DC073B1DF3CE1468390

Function 00007FFE0E148080 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFE0E148099
VariantCopy.OLEAUT32 ref: 00007FFE0E1480EA

Strings

newVariant, xrefs: 00007FFE0E148194
VariantConversionError, xrefs: 00007FFE0E14810F
com.nim, xrefs: 00007FFE0E14817E

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: CopyInitializeVariant
String ID: VariantConversionError$com.nim$newVariant
API String ID: 633353902-805458017
Opcode ID: 37dc1bba5de7eb6d8a84ede9a51d855650d8d586e6755152db3d4b614f213599
Instruction ID: ecc9d3259361cb518f91bb8b3c38e6b09ea3a35ff29167eee4a4fd90462cc2d7
Opcode Fuzzy Hash: 37dc1bba5de7eb6d8a84ede9a51d855650d8d586e6755152db3d4b614f213599
Instruction Fuzzy Hash: 0D414EA2B0AB4794EA55AB19A91877E6394FF44B84F844537D9DC073B1DF3CE046C390

Function 00007FFE0E145220 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 263COMMON

Download Yara Rule

Strings

.~&, xrefs: 00007FFE0E145379
T], xrefs: 00007FFE0E145570
T], xrefs: 00007FFE0E145530

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID:
String ID: .~&$T]$T]
API String ID: 0-361263744
Opcode ID: 1c310ccbf74c847df73c694cb3f318e6f7db29470bae7075e5a2e3ab811cc63c
Instruction ID: 737f3dd802abeea36cf84ed44e215d04f3f96e6f9b70bfb8c9c50e33c4859dab
Opcode Fuzzy Hash: 1c310ccbf74c847df73c694cb3f318e6f7db29470bae7075e5a2e3ab811cc63c
Instruction Fuzzy Hash: C8C1A0A2E1874292EA50DF54E8412BA7762FF80754F944433EA8E5B7B6EF3CE905C700

Function 00007FFE0E157F88 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 00007FFE0E157FAE
_unlock.MSVCRT ref: 00007FFE0E157FE9

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: _lock_unlock
String ID:
API String ID: 2848772494-0
Opcode ID: 839b6c95f21c298f95560e90b5800166fcecef062897bb39a6bf96ebd563a10a
Instruction ID: a91daa40c4a94aa909ffea281c5bd156041a777517c0243bf2c3d72c1b0da163
Opcode Fuzzy Hash: 839b6c95f21c298f95560e90b5800166fcecef062897bb39a6bf96ebd563a10a
Instruction Fuzzy Hash: F54198A7704B49C9EB048F6AD8813AC73A1F748BD8F448936EE6C477A8DF38D5508350

Function 00007FFE0E131748 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

_fileno.MSVCRT ref: 00007FFE0E13176C
_setmode.MSVCRT ref: 00007FFE0E13177C
_fileno.MSVCRT ref: 00007FFE0E131788
_setmode.MSVCRT ref: 00007FFE0E131791
_fileno.MSVCRT ref: 00007FFE0E13179D

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: _fileno$_setmode
String ID:
API String ID: 2194614063-0
Opcode ID: b8499c141844f940aab8dce16dfdacb536d3285c549e13282d0a74ac03962638
Instruction ID: ef0d0c46a369d3c3b4741644165682ea344c24e22cd3aecf5669e34ba1b111e4
Opcode Fuzzy Hash: b8499c141844f940aab8dce16dfdacb536d3285c549e13282d0a74ac03962638
Instruction Fuzzy Hash: FAF01C11B1455542EF08A7B2BA6437E5A96AFD9BD0F18807B8D4E473D4ED3CD8424340

Function 00007FFE0E139450 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E1315B0: strlen.MSVCRT ref: 00007FFE0E1315C9
Part of subcall function 00007FFE0E1315B0: fwrite.MSVCRT ref: 00007FFE0E1315DC

GetLastError.KERNEL32 ref: 00007FFE0E1394A2
exit.MSVCRT ref: 00007FFE0E1394CA

Strings

could not load: , xrefs: 00007FFE0E139470
(bad format; library may be wrong architecture), xrefs: 00007FFE0E1394D6

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: ErrorLastexitfwritestrlen
String ID: (bad format; library may be wrong architecture)$could not load:
API String ID: 671075621-2754783905
Opcode ID: 89563ff696690d38515c8b2b3e1467e36067791bf54df73593b659afd1aa64d8
Instruction ID: 912da432add6e74778a2bdec200ba20ded235543e9cefd23af3096e229ffcebb
Opcode Fuzzy Hash: 89563ff696690d38515c8b2b3e1467e36067791bf54df73593b659afd1aa64d8
Instruction Fuzzy Hash: FD016252B1965791FE04B771E8553B86265AF85780F44413BDE8E473F6EE6CE400C301

Function 00007FFE0E13A920 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FFE0E13A949
fflush.MSVCRT ref: 00007FFE0E13A951
exit.MSVCRT ref: 00007FFE0E13A95B

Strings

[GC] cannot register global variable; too many global variables, xrefs: 00007FFE0E13A93C

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: exitfflushfwrite
String ID: [GC] cannot register global variable; too many global variables
API String ID: 3476253079-2146260042
Opcode ID: a171ecbd8870034556625941e9756daf10bdc1cbc3b2acaf7614254cba44feb3
Instruction ID: 08ebba02b5b36af7409eba46b3b81dc39efb3781fd1b9eb5419a33466852c97d
Opcode Fuzzy Hash: a171ecbd8870034556625941e9756daf10bdc1cbc3b2acaf7614254cba44feb3
Instruction Fuzzy Hash: FCF03022E59B42D5F6046B61E8463B926B1FF8AB41F852537E9CE173F2DF2DA151C300

Function 00007FFE0E13C9F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13C9FF
GetProcAddress.KERNEL32 ref: 00007FFE0E13CA21

Strings

kernel32, xrefs: 00007FFE0E13C9F8
AttachConsole, xrefs: 00007FFE0E13CA14

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: AttachConsole$kernel32
API String ID: 2574300362-374305082
Opcode ID: 960aa4397a13f9497081fe059081674e85d4f086b5cc47264218468e45188bc1
Instruction ID: 665f73e8cd5fb583f99a231c4d618fb360f3bc216d38f9cdee39dd6ab87e9412
Opcode Fuzzy Hash: 960aa4397a13f9497081fe059081674e85d4f086b5cc47264218468e45188bc1
Instruction Fuzzy Hash: B9F09A61A4AA02C0E949DB22BC4407672E6BF88B94F84057BCCCD463B0EF3CA185C340

Function 00007FFE0E13EC00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFE0E13EC0B
GetProcAddress.KERNEL32 ref: 00007FFE0E13EC27

Strings

Ws2_32.dll, xrefs: 00007FFE0E13EC04
inet_ntop, xrefs: 00007FFE0E13EC20

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Ws2_32.dll$inet_ntop
API String ID: 2574300362-2739477577
Opcode ID: 5960f70dcc3cb8590bd01532b6b5409507b56dd736a63677e676c6170141e528
Instruction ID: 2770fbf9e73e83282f27653529ab8f7d835d26911a596c3faf8ff1d072e33a94
Opcode Fuzzy Hash: 5960f70dcc3cb8590bd01532b6b5409507b56dd736a63677e676c6170141e528
Instruction Fuzzy Hash: 08E04224A5AA53C1EA5A9B15AD500A463E1BF59700F90407BC88D423B0EF7CA559C750

Function 00007FFE0E1381D0 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 332COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0E136B50: memset.MSVCRT ref: 00007FFE0E136BE2

memcpy.MSVCRT ref: 00007FFE0E138484

Strings

ed from:, xrefs: 00007FFE0E138652
[[rerais, xrefs: 00007FFE0E138648
]], xrefs: 00007FFE0E138628

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpymemset
String ID: [[rerais$]]$ed from:
API String ID: 1297977491-96586220
Opcode ID: 4de7edbcc6b12fb41e346efe08153019dc93f70cd32370dedc5e014a18505298
Instruction ID: f7c80199c0b70cb48b408c1629cdcee2bae7ae9cbfd1150b626d2d80fd41c999
Opcode Fuzzy Hash: 4de7edbcc6b12fb41e346efe08153019dc93f70cd32370dedc5e014a18505298
Instruction Fuzzy Hash: 27E18776A09B8681EA648F25E4003AE77A8FB49B98F544637EEAD077E0DF3DD545C300

Function 00007FFE0E149920 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 204COMMON

Download Yara Rule

Strings

clr.nim, xrefs: 00007FFE0E149B95
CLRError, xrefs: 00007FFE0E14997A
clrError, xrefs: 00007FFE0E149B9C

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: memcpymemset
String ID: CLRError$clr.nim$clrError
API String ID: 1297977491-2830349459
Opcode ID: 10f23ab442f7161de1a4e5cab30c6324a6b80ed03321f59bc245b0addc95e8d4
Instruction ID: 8a7f37976afbcc7d8265fd4e740e01cbcc64f7f71c5c44684600640f3594a22a
Opcode Fuzzy Hash: 10f23ab442f7161de1a4e5cab30c6324a6b80ed03321f59bc245b0addc95e8d4
Instruction Fuzzy Hash: 3D91D6A2A0CB8685E7118B15D8006BE3BA0FB557A4F554272DFEC0B7E2DE3CE550C350

Function 00007FFE0E135460 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

virtualFree failing!, xrefs: 00007FFE0E135730

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID:
String ID: virtualFree failing!
API String ID: 0-3108117800
Opcode ID: 1f137d6605ab7e2858848fd2a2c3146e9ccc07f199a0bb54434c994e38447113
Instruction ID: a6150c2ef07ea4b7b117c1b4b172c77d97d92af8be1a8ce848d3802047161daa
Opcode Fuzzy Hash: 1f137d6605ab7e2858848fd2a2c3146e9ccc07f199a0bb54434c994e38447113
Instruction Fuzzy Hash: CB81AEB2A05B4680EB18CB25E9457B933A2FF54B94F518236DEAD073A4EF7DE185C340

Function 00007FFE0E1351B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

virtualFree failing!, xrefs: 00007FFE0E135420

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID:
String ID: virtualFree failing!
API String ID: 0-3108117800
Opcode ID: 898de089e6a652b3b74e16420251f34d35e97e5bf78494b81a434b6a4fe685e7
Instruction ID: c20db5cccaff5d85b454a73eb6533fbe1eb464e1ca1d6cb2a88ac849398377a4
Opcode Fuzzy Hash: 898de089e6a652b3b74e16420251f34d35e97e5bf78494b81a434b6a4fe685e7
Instruction Fuzzy Hash: 5961CEB2A05B4680FA28CB25E8457B973A2FF54B94F558236DE9D033A4EF7DE185C340

Function 00007FFE0E1334F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00007FFE0E1335F6
exit.MSVCRT ref: 00007FFE0E133611

Strings

virtualFree failing!, xrefs: 00007FFE0E133600

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: FreeVirtualexit
String ID: virtualFree failing!
API String ID: 1212090140-3108117800
Opcode ID: 78c6a9389ec2a35e9909f5ee783a93cabf13e1c0a10bdb62cf2a036c13e9934b
Instruction ID: 3f980147961cdb566abdf14ee684a89b7d0b399b74ba98bcae9804b30cfabae2
Opcode Fuzzy Hash: 78c6a9389ec2a35e9909f5ee783a93cabf13e1c0a10bdb62cf2a036c13e9934b
Instruction Fuzzy Hash: 6351A0B2B15B4584EE19CB25C458BA833A6FB44790F62C23ADABD473A4EF79D5848340

Function 00007FFE0E133430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00007FFE0E1334C6
exit.MSVCRT ref: 00007FFE0E1334E6

Strings

virtualFree failing!, xrefs: 00007FFE0E1334D5

Memory Dump Source

Source File: 00000004.00000002.1895707930.00007FFE0E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFE0E130000, based on PE: true

Associated: 00000004.00000002.1895683396.00007FFE0E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895739640.00007FFE0E159000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895760741.00007FFE0E15A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895786045.00007FFE0E16C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895807663.00007FFE0E170000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E17E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895828662.00007FFE0E181000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895868596.00007FFE0E186000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895886602.00007FFE0E187000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1895905423.00007FFE0E18A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe0e130000_rundll32.jbxd

Similarity

API ID: FreeVirtualexit
String ID: virtualFree failing!
API String ID: 1212090140-3108117800
Opcode ID: 85fe4ed7ebd342e25d4a31d68c50157dc6f40be3eecca2972c7da7329500421c
Instruction ID: 262d2b4795d11a36a548eea8ea02828c9e7e9667d7de8b72672e043d00c4397b
Opcode Fuzzy Hash: 85fe4ed7ebd342e25d4a31d68c50157dc6f40be3eecca2972c7da7329500421c
Instruction Fuzzy Hash: C011C4A2B15B4A81FE59DB26D8512B86791FF94BD0F58D13BC95D433A1DE6CE488C300

Analysis Process: rundll32.exePID: 6976, Parent PID: 6796COMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	27
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000027B70B51B10 Relevance: 3.1, APIs: 2, Instructions: 132
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 0000027B70B51BA2
NtCreateSection.NTDLL ref: 0000027B70B51C02

Memory Dump Source

Source File: 00000006.00000002.1785449236.0000027B70B50000.00000020.00000400.00020000.00000000.sdmp, Offset: 0000027B70B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_27b70b50000_rundll32.jbxd

Similarity

API ID: CreateMemoryProtectSectionVirtual
String ID:
API String ID: 1366966015-0
Opcode ID: f6b47d1aec46e1e957693d9d0c8cb924439d4d7cbf412633b4b44180241d7493
Instruction ID: 0fa1e7b2449cba7ec53b9145e8193c8251eb757b33425c14aaa9181192467cb0
Opcode Fuzzy Hash: f6b47d1aec46e1e957693d9d0c8cb924439d4d7cbf412633b4b44180241d7493
Instruction Fuzzy Hash: AF31063121CB0C4FE759AA6C984976AB2D4EBD8311F000B6FF58EC3391FAA199058686

Function 0000027B70B51BA8 Relevance: 1.6, APIs: 1, Instructions: 73
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL ref: 0000027B70B51C02

Memory Dump Source

Source File: 00000006.00000002.1785449236.0000027B70B50000.00000020.00000400.00020000.00000000.sdmp, Offset: 0000027B70B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_27b70b50000_rundll32.jbxd

Similarity

API ID: CreateSection
String ID:
API String ID: 2449625523-0
Opcode ID: 9e7362a58a991fd67ed60abdc4631b05ef3ffe28a9eadedd5685242ff6fa6018
Instruction ID: e60d42a6b0b2ea4f57c17d8831a1fb82fcbfb10645cc599f97702929a6e7d9a1
Opcode Fuzzy Hash: 9e7362a58a991fd67ed60abdc4631b05ef3ffe28a9eadedd5685242ff6fa6018
Instruction Fuzzy Hash: 0101DB7275CB080FE75D895CA849775B3C0D7C5321F400B6FE98DD77D2EA6298014686

Analysis Process: rundll32.exePID: 6220, Parent PID: 3912COMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	27
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000001E0BE701B10 Relevance: 3.1, APIs: 2, Instructions: 132
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 000001E0BE701BA2
NtCreateSection.NTDLL ref: 000001E0BE701C02

Memory Dump Source

Source File: 0000000D.00000002.1834654011.000001E0BE700000.00000020.00000400.00020000.00000000.sdmp, Offset: 000001E0BE700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1e0be700000_rundll32.jbxd

Similarity

API ID: CreateMemoryProtectSectionVirtual
String ID:
API String ID: 1366966015-0
Opcode ID: f6b47d1aec46e1e957693d9d0c8cb924439d4d7cbf412633b4b44180241d7493
Instruction ID: 3e7e88560b9756ce16f020fca5dfab66efe13358e263dff94910639c61a6311c
Opcode Fuzzy Hash: f6b47d1aec46e1e957693d9d0c8cb924439d4d7cbf412633b4b44180241d7493
Instruction Fuzzy Hash: 83310E3025CB4C4FE759A66CD8456AE72D4FB9C311F00072FF88AC3292EAB0DC454786

Function 000001E0BE701BA8 Relevance: 1.6, APIs: 1, Instructions: 73
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL ref: 000001E0BE701C02

Memory Dump Source

Source File: 0000000D.00000002.1834654011.000001E0BE700000.00000020.00000400.00020000.00000000.sdmp, Offset: 000001E0BE700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1e0be700000_rundll32.jbxd

Similarity

API ID: CreateSection
String ID:
API String ID: 2449625523-0
Opcode ID: 9e7362a58a991fd67ed60abdc4631b05ef3ffe28a9eadedd5685242ff6fa6018
Instruction ID: 18533c62089a27652af02935cba0f60aca65bd2c5d05c9f0bec7e768de6f7f35
Opcode Fuzzy Hash: 9e7362a58a991fd67ed60abdc4631b05ef3ffe28a9eadedd5685242ff6fa6018
Instruction Fuzzy Hash: 6301C87175CB580FE759895CE84577972C0EB89321F40072FE889C3693D9A19C464786

Analysis Process: rundll32.exePID: 6296, Parent PID: 4412COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00000224A1FE1B10 Relevance: 3.1, APIs: 2, Instructions: 132
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00000224A1FE1BA2
NtCreateSection.NTDLL ref: 00000224A1FE1C02

Memory Dump Source

Source File: 0000000F.00000002.1815725390.00000224A1FE0000.00000020.00000400.00020000.00000000.sdmp, Offset: 00000224A1FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_224a1fe0000_rundll32.jbxd

Similarity

API ID: CreateMemoryProtectSectionVirtual
String ID:
API String ID: 1366966015-0
Opcode ID: f6b47d1aec46e1e957693d9d0c8cb924439d4d7cbf412633b4b44180241d7493
Instruction ID: 29cd9993044d5d27be59441fab249b9e288b65ba33a41c89a9d2913ec5b73733
Opcode Fuzzy Hash: f6b47d1aec46e1e957693d9d0c8cb924439d4d7cbf412633b4b44180241d7493
Instruction Fuzzy Hash: 79314C3131CF4C5FE718BAAD989D66A72D4EBD8311F40072FF48FC32E1EAA498054686

Function 00000224A1FE1BA8 Relevance: 1.6, APIs: 1, Instructions: 73
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL ref: 00000224A1FE1C02

Memory Dump Source

Source File: 0000000F.00000002.1815725390.00000224A1FE0000.00000020.00000400.00020000.00000000.sdmp, Offset: 00000224A1FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_224a1fe0000_rundll32.jbxd

Similarity

API ID: CreateSection
String ID:
API String ID: 2449625523-0
Opcode ID: 9e7362a58a991fd67ed60abdc4631b05ef3ffe28a9eadedd5685242ff6fa6018
Instruction ID: 0f79af5b3b7398f8d1405f4cf21b57f199bb25d27c784f6186600b724b92709b
Opcode Fuzzy Hash: 9e7362a58a991fd67ed60abdc4631b05ef3ffe28a9eadedd5685242ff6fa6018
Instruction Fuzzy Hash: BA01FE7174CF480FE75899ADAC8977573C0D785321F40072FE88EC36D2D965AC164686

Analysis Process: loaddll64.exePID: 5804, Parent PID: 6556COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000026F88A31B10 Relevance: 3.1, APIs: 2, Instructions: 132
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 0000026F88A31BA2
NtCreateSection.NTDLL ref: 0000026F88A31C02

Memory Dump Source

Source File: 00000011.00000002.1791233415.0000026F88A30000.00000020.00000400.00020000.00000000.sdmp, Offset: 0000026F88A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26f88a30000_loaddll64.jbxd

Similarity

API ID: CreateMemoryProtectSectionVirtual
String ID:
API String ID: 1366966015-0
Opcode ID: f6b47d1aec46e1e957693d9d0c8cb924439d4d7cbf412633b4b44180241d7493
Instruction ID: c1c3bc44fc0835fbd4893b02d4361064ec00a66413538b0e68ad114423f40d5f
Opcode Fuzzy Hash: f6b47d1aec46e1e957693d9d0c8cb924439d4d7cbf412633b4b44180241d7493
Instruction Fuzzy Hash: 6E312C3021CB0C5FEB58AA6CA84D66A72D4EBD8311F40073FF59AC32D1EAA198054786

Function 0000026F88A31BA8 Relevance: 1.6, APIs: 1, Instructions: 73
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL ref: 0000026F88A31C02

Memory Dump Source

Source File: 00000011.00000002.1791233415.0000026F88A30000.00000020.00000400.00020000.00000000.sdmp, Offset: 0000026F88A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26f88a30000_loaddll64.jbxd

Similarity

API ID: CreateSection
String ID:
API String ID: 2449625523-0
Opcode ID: 9e7362a58a991fd67ed60abdc4631b05ef3ffe28a9eadedd5685242ff6fa6018
Instruction ID: 1cf1cc4dc258542ce8152ef43da51c612184e463573c2bbcafc052e7d94151dc
Opcode Fuzzy Hash: 9e7362a58a991fd67ed60abdc4631b05ef3ffe28a9eadedd5685242ff6fa6018
Instruction Fuzzy Hash: 4101F97170CB080FEBA88A6CBC4A77573D0D785321F40077FE999C36D2E966AC06478A

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZJGkxGuyIT.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_regsvr32.exe_535451c67ed13a7d61656632ce4c87290bfb9a_e29f7403_f08926e4-7646-4698-b05e-04c478fb93ab\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ZJG_21de29d3d03af62e3c347fc53eb90afbeb77c51_8423aa97_ca914613-ecdc-4770-9312-bb71d7b1943e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER460A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4658.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER46F6.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4725.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4783.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4801.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
ZJGkxGuyIT.dll

Function 00007FFE0E14F0D0 Relevance: 53.2, APIs: 4, Strings: 26, Instructions: 672
COMMON

Function 00007FFE0E14D520 Relevance: 26.9, APIs: 11, Strings: 4, Instructions: 619
memorylibraryloaderCOMMON

Function 00007FFE0E14C870 Relevance: 12.4, APIs: 8, Instructions: 352
fileCOMMON

Function 00007FFE0E146D40 Relevance: 4.9, APIs: 3, Instructions: 364
fileCOMMON

Function 00007FFE0E14C1D0 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 396
COMMON

Function 00007FFE0E150950 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 218
libraryloaderCOMMON

Function 00007FFE0E13C530 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 77
libraryloaderCOMMON

Function 00007FFE0E145CC0 Relevance: 10.6, APIs: 7, Instructions: 98
sleepCOMMON