Edit tour

Windows Analysis Report
n57kYr8YQW.dll

Overview

General Information

Sample name:	n57kYr8YQW.dll renamed because original name is a hash value
Original sample name:	4f564b754fe1a4a200d38c9a2d928d44bf93be1def0e9f4f855ffa6d73eba293.dll
Analysis ID:	1544804
MD5:	6588f55041b412cef3cab456de2032d8
SHA1:	702b4ab077d8a46217e241d5dc7f5a295552983d
SHA256:	4f564b754fe1a4a200d38c9a2d928d44bf93be1def0e9f4f855ffa6d73eba293
Tags:	2024bankerdllgolangloadermekotiouser-johnk3r
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6560 cmdline: loaddll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 1748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2832 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 5212 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 5588 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 648 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 2700 cmdline: rundll32.exe C:\Users\user\Desktop\n57kYr8YQW.dll,BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2300 cmdline: rundll32.exe C:\Users\user\Desktop\n57kYr8YQW.dll,BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4136 cmdline: rundll32.exe C:\Users\user\Desktop\n57kYr8YQW.dll,BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6736 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5924 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1888 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5904 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeSetFocus MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5624 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeSetDirty MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4620 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeResize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1496 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkePaint2 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6552 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeKillFocus MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5940 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeIsDirty MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1092 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeInitialize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5912 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeGetCaretRect MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2648 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireMouseWheelEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4568 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireMouseEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4068 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireKeyUpEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 568 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireKeyPressEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5480 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireKeyDownEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4472 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireContextMenuEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6036 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFinalize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7016 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeDestroyWebView MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7124 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeCreateWebView MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3488 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",dbkFCallWrapperAddr MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 636 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 640 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 4932 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",__dbk_fcall_wrapper MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 828 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",TMethodImplementationIntercept MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 3580 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 640 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 3848 cmdline: rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarRecognize MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: n57kYr8YQW.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: n57kYr8YQW.dll

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.0% probability

Source: n57kYr8YQW.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040D1C4 FindFirstFileW,FindClose,	4_2_0040D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	4_2_0040CBF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02B6D1C4 FindFirstFileW,FindClose,	32_2_02B6D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02B6CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	32_2_02B6CBF8

Source: Amcache.hve.8.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004EA1D8 GetClipboardData,CopyEnhMetaFileW,GetEnhMetaFileHeader,

4_2_004EA1D8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004EAA7C GetObjectW,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

4_2_004EAA7C

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004F6444	4_2_004F6444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004F6704	4_2_004F6704
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004E6918	4_2_004E6918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004B0F64	4_2_004B0F64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004B10A8	4_2_004B10A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0043B4C4	4_2_0043B4C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004FFD00	4_2_004FFD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004EFE80	4_2_004EFE80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004F1FC4	4_2_004F1FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004F5F80	4_2_004F5F80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02C56704	32_2_02C56704
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02C56444	32_2_02C56444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02C46918	32_2_02C46918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02C10F64	32_2_02C10F64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02C110A8	32_2_02C110A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02B9B4C4	32_2_02B9B4C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02C4FE80	32_2_02C4FE80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02C51FC4	32_2_02C51FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02C55F80	32_2_02C55F80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02C5FD00	32_2_02C5FD00

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 648

Source: n57kYr8YQW.dll	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: n57kYr8YQW.dll	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: n57kYr8YQW.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal60.winDLL@63/13@0/0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004E5AA0 GetLastError,FormatMessageW,

4_2_004E5AA0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004219D8 GetDiskFreeSpaceW,

4_2_004219D8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004AA910 FindResourceW,LoadResource,SizeofResource,LockResource,

4_2_004AA910

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5212
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1748:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3488
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess828

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\c897ea08-804a-4af1-b9ce-984e432d94cc

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\n57kYr8YQW.dll,BarCreate

Source: n57kYr8YQW.dll

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\n57kYr8YQW.dll,BarCreate
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 648
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\n57kYr8YQW.dll,BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\n57kYr8YQW.dll,BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarCreate
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeSetFocus
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeSetDirty
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeResize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkePaint2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeKillFocus
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeIsDirty
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeInitialize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeGetCaretRect
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireMouseWheelEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireMouseEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireKeyUpEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireKeyPressEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireKeyDownEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireContextMenuEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFinalize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeDestroyWebView
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeCreateWebView
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",dbkFCallWrapperAddr
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",__dbk_fcall_wrapper
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",TMethodImplementationIntercept
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarRecognize
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 640
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 640
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\n57kYr8YQW.dll,BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\n57kYr8YQW.dll,BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\n57kYr8YQW.dll,BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeSetFocus	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeSetDirty	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeResize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkePaint2	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeKillFocus	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeIsDirty	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeInitialize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeGetCaretRect	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireMouseWheelEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireMouseEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireKeyUpEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireKeyPressEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireKeyDownEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireContextMenuEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFinalize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeDestroyWebView	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeCreateWebView	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",dbkFCallWrapperAddr	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",__dbk_fcall_wrapper	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",TMethodImplementationIntercept	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarRecognize	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: n57kYr8YQW.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: n57kYr8YQW.dll

Static file information: File size 1270272 > 1048576

Source: n57kYr8YQW.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x10ca00

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00509F0C LoadLibraryW,GetProcAddress,GetProcAddress,IsBadReadPtr,

4_2_00509F0C

Source: n57kYr8YQW.dll

Static PE information: section name: .didata

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E000 push 0050E0DEh; ret	4_2_0050E0D6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E47C push 0050E519h; ret	4_2_0050E511
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00460068 push ecx; mov dword ptr [esp], edx	4_2_00460069
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00504014 push 0050403Ah; ret	4_2_00504032
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004380A4 push ecx; mov dword ptr [esp], eax	4_2_004380A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_005041A4 push 005041CAh; ret	4_2_005041C2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00466248 push ecx; mov dword ptr [esp], ecx	4_2_0046624C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00464264 push ecx; mov dword ptr [esp], ecx	4_2_00464268
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004BE2E4 push ecx; mov dword ptr [esp], edx	4_2_004BE2E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004BA2F8 push ecx; mov dword ptr [esp], edx	4_2_004BA2FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004C42F4 push ecx; mov dword ptr [esp], edx	4_2_004C42F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004682FC push ecx; mov dword ptr [esp], ecx	4_2_00468300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050A2A4 push 0050A2F0h; ret	4_2_0050A2E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004C0340 push ecx; mov dword ptr [esp], edx	4_2_004C0341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00502340 push 00502398h; ret	4_2_00502390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0043A3D0 push ecx; mov dword ptr [esp], eax	4_2_0043A3D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050239C push ecx; mov dword ptr [esp], ecx	4_2_005023A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00464450 push ecx; mov dword ptr [esp], ecx	4_2_00464454
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E540 push 0050E5F6h; ret	4_2_0050E5EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004C460C push ecx; mov dword ptr [esp], edx	4_2_004C460D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E610 push 0050E671h; ret	4_2_0050E669
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E740 push 0050E7DCh; ret	4_2_0050E7D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0046670C push ecx; mov dword ptr [esp], edx	4_2_0046670D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0046671C push ecx; mov dword ptr [esp], edx	4_2_0046671D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004827C4 push 00482826h; ret	4_2_0048281E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004648E4 push ecx; mov dword ptr [esp], eax	4_2_004648E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0042E970 push 0042EA60h; ret	4_2_0042EA58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004C2A30 push ecx; mov dword ptr [esp], edx	4_2_004C2A31
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00468B60 push ecx; mov dword ptr [esp], edx	4_2_00468B61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00508B14 push 00508B6Ah; ret	4_2_00508B62
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00462CE0 push ecx; mov dword ptr [esp], ecx	4_2_00462CE4

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.5 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.6 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040D1C4 FindFirstFileW,FindClose,	4_2_0040D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	4_2_0040CBF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02B6D1C4 FindFirstFileW,FindClose,	32_2_02B6D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_02B6CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	32_2_02B6CBF8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0040EE84 GetSystemInfo,

4_2_0040EE84

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node			graph_4-48314
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node			graph_32-47332

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004B8000 IsDebuggerPresent,RaiseException,

4_2_004B8000

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00509F0C LoadLibraryW,GetProcAddress,GetProcAddress,IsBadReadPtr,

4_2_00509F0C

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00508F54 FreeLibrary,VirtualFree,GetProcessHeap,HeapFree,VirtualFree,

4_2_00508F54

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004079E8 cpuid

4_2_004079E8

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	4_2_0040D2FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_0040C79C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_00428FD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_0042920C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_00425334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_00425380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	32_2_02B6D2FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	32_2_02B6C79C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	32_2_02B88FD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	32_2_02B8920C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	32_2_02B85380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	32_2_02B85334

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00423868 GetLocalTime,

4_2_00423868

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0040C520 InitializeCriticalSection,GetVersion,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,

4_2_0040C520

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
n57kYr8YQW.dll	47%	ReversingLabs	Win32.Trojan.Midie
n57kYr8YQW.dll	100%	Avira	TR/Redcap.rgkfk

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544804
Start date and time:	2024-10-29 19:09:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	n57kYr8YQW.dll renamed because original name is a hash value
Original Sample Name:	4f564b754fe1a4a200d38c9a2d928d44bf93be1def0e9f4f855ffa6d73eba293.dll
Detection:	MAL
Classification:	mal60.winDLL@63/13@0/0
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 91% Number of executed functions: 34 Number of non-executed functions: 144
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 828 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: n57kYr8YQW.dll

Simulations

Behavior and APIs

Time	Type	Description
14:11:01	API Interceptor	3x Sleep call for process: WerFault.exe modified
14:11:04	API Interceptor	1x Sleep call for process: loaddll32.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_179c87a774e29d2b1a37a03f881953e6c2ac927_7522e4b5_523f2ff1-0f9d-47c7-a7f5-50d8a8328fc2\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8644955942868999
Encrypted:	false
SSDEEP:	192:WvibXOXYAU0BU/wjeT+AzuiFuZ24IO8dci:+ib+XYAPBU/wjeaAzuiFuY4IO8dci
MD5:	45F720F055DD8E94F771207ACBA2A3E3
SHA1:	153F3954D3DB26E7E439C5F0B7AFB819BFA346CB
SHA-256:	B0A27A40F8C1C6E468606F9179EBA5152D3BC9358D5F53185404A03CEFBCCC33
SHA-512:	D78DE0CC1E5DACBDF7767B80628DB78F6A49D9411C87DBEA181A49140EF127399CB5B05605F8BD48A70318EA024176D6CD33FB853AFDB72DC1BCBED735DF42E2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.9.0.6.5.5.8.6.4.2.1.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.9.0.6.6.4.6.1.4.1.7.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.2.3.f.2.f.f.1.-.0.f.9.d.-.4.7.c.7.-.a.7.f.5.-.5.0.d.8.a.8.3.2.8.f.c.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.f.5.3.c.2.4.e.-.a.5.d.8.-.4.b.0.c.-.b.6.0.a.-.0.4.e.1.3.a.6.8.c.f.0.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.3.3.c.-.0.0.0.1.-.0.0.1.4.-.3.9.6.3.-.1.0.e.b.2.d.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_88e9c7714235511c882c5cf68cc356ed44bb976_7522e4b5_51f7a9c7-1823-4e38-9491-999216950cb2\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8699510467248083
Encrypted:	false
SSDEEP:	192:GNopi7OWYA70BU/wjeT+AzuiFuZ24IO84ci:KqiCWYAIBU/wjeaAzuiFuY4IO84ci
MD5:	C5E5E45F63A9113669859B27AA10A874
SHA1:	90F108890855AD01A489ACDBBF9144B166A84686
SHA-256:	D902FBB5B02C6D6A163E23DD2AE94C85E14BC140E4B9246EBB7ED5602E4CE1FF
SHA-512:	D43C666AF0480F7D612A4AA690714351AB5FB497557B9B7336E2D8548AD9AF37928E3AB30D31DDE63488EA7F05D895A5BDEDCC9A592C5BB4EF87C4E0B90F8677
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.9.0.6.5.1.8.6.8.8.3.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.9.0.6.6.4.0.5.6.2.8.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.1.f.7.a.9.c.7.-.1.8.2.3.-.4.e.3.8.-.9.4.9.1.-.9.9.9.2.1.6.9.5.0.c.b.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.4.8.4.5.0.a.e.-.d.a.2.f.-.4.6.4.b.-.b.b.3.4.-.a.e.1.2.5.2.e.e.1.6.f.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.a.0.-.0.0.0.1.-.0.0.1.4.-.d.2.0.6.-.0.0.e.b.2.d.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_88e9c7714235511c882c5cf68cc356ed44bb976_7522e4b5_9573f0f9-eb1a-4019-862f-b313d4edf902\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8700783746862466
Encrypted:	false
SSDEEP:	192:AGizOvYA70BU/wjeT+AzuiFuZ24IO84ci:di6vYAIBU/wjeaAzuiFuY4IO84ci
MD5:	794218579D122A4CD21694E726A38722
SHA1:	36FD4819E35D1E3302D78D83076221D6101F4354
SHA-256:	730A4F92404A2B2AF73749240EFED948382C0D299951667CE610538662251C65
SHA-512:	7C064A05942A7669BBBAEFD5A9017913A9449DDBA4DB2E414028CC25A4D2637942ABABAD5F139E8041AC78581ABC465CA11D63606DFCD6953D0B8C8946479A4C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.9.0.5.5.1.3.3.6.7.0.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.9.0.5.5.5.0.8.6.5.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.5.7.3.f.0.f.9.-.e.b.1.a.-.4.0.1.9.-.8.6.2.f.-.b.3.1.3.d.4.e.d.f.9.0.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.1.e.0.8.f.7.b.-.6.3.f.c.-.4.6.a.4.-.a.8.4.8.-.1.4.3.d.0.3.d.f.8.d.d.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.5.c.-.0.0.0.1.-.0.0.1.4.-.2.4.5.7.-.4.9.e.5.2.d.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.r.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7846.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 18:10:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43932
Entropy (8bit):	1.9337176889572314
Encrypted:	false
SSDEEP:	96:538G3DQOZQZJENfWMZutTgz8UXkiyRGe/oi75I4v4I/rellE8lll1tVs+LGLDWIr:qWianXwAO5H4IwJiosF31mttLvn
MD5:	CC945D90DBA8298EF8BBF3A648AFC345
SHA1:	DF74BCB7272E99DB0DD47FD9CB2830187F662560
SHA-256:	DAD43AC463F0F5FFB44A47DB8D9551A5CA5B91049B8B67EDDE1167955CA17395
SHA-512:	6CE81C4B1F2EE7DB40A64A3BCA8990DF45752FED69EB4BED42519A15F7ADFD302238FE496A7B4AC6ED0514551D24B28AE8CD9B9503DBBBD0B3574012681CF24B
Malicious:	false
Preview:	MDMP..a..... ......./%!g.........................................)..........T.......8...........T......................................................................................................................eJ......,.......GenuineIntel............T.......\....%!g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78C4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8318
Entropy (8bit):	3.691216739980636
Encrypted:	false
SSDEEP:	192:R6l7wVeJJS6IU49I6YoS6qgmf8i9HCCypr/89b0tsfy8m:R6lXJc6IUV6Y16qgmf8i9HCCX0mf4
MD5:	81910F1129FF6AB81EC602639FE8F2F6
SHA1:	35871BCC88EC63B8E83B354BC491D57466602CFF
SHA-256:	E157A1CCE6CA52B430F6A11B062B528389DB891AFECB3194C590A31FBABFF893
SHA-512:	72E1EE794CAB1A2F21C130F929CBE8C41C03B1D5A545FB56E21AD3DAAB82B773B9B60FDAB31BA3424FF162FD3CC7B36587A19C5BE76106929074E187C01F4412
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.2.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78F4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4751
Entropy (8bit):	4.457616218182642
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI95OWpW8VY8Ym8M4JCdPi9nFLI+q8vjPi9U3c/GScSMd:uIjfAI7vv7VMJrKKwFJ3Md
MD5:	89D419DC1FC02AC041220E3B35DEC72C
SHA1:	40B0863B999F2F81F84FC3FFB275F84756103313
SHA-256:	A9768B94580CD654435B0F58C91AA58462D2AFBACC94681A404B212D141988FF
SHA-512:	531C5EE2E3A6295D54882BB2663614DF949305DB94C8B5B0BABEE20D351B57B1FD9C69A99E1798883DE8E5C17B548A54FA8E6B63D12C7B0242F26B9FE413CFFC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565033" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F85.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 18:11:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42852
Entropy (8bit):	1.9578920720877546
Encrypted:	false
SSDEEP:	192:I1itPX/O5H4ILlKsBuHjBjKKoufAog4Vmm:JM5HVLYqstjKKosBm
MD5:	1B5E931DA57C8A5FD49D90A4B944E6B1
SHA1:	06DAB15DEE73874B019CD1B335C1EDE0579C7703
SHA-256:	EDDAD3B5D71698E361BB4A4CC6034C8D7DA24A0E7F361B55B62BA98EC9F6D93E
SHA-512:	29DEF64FCEA252740BC20BE0CAE49F83370508CA797867B7E04638B0431125BE8162A205746553B25AE5120B539AFB9EE66266D0DA87BB7B7B5E90E2A625B39E
Malicious:	false
Preview:	MDMP..a..... .......9%!g.........................................)..........T.......8...........T......................................................................................................................eJ......,.......GenuineIntel............T...........8%!g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA070.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8344
Entropy (8bit):	3.693425366097748
Encrypted:	false
SSDEEP:	192:R6l7wVeJ6l6IUDj6YPDE6Kgmf8i9HCCyprr89bwEsfEtQm:R6lXJo6IUn6Y7E6Kgmf8i9HCCLw3fEP
MD5:	4B83DD383B579E4F8F346615E73A98B9
SHA1:	F10EC94EBAB2F9BFB0E70C1F03C5DA9440EA441F
SHA-256:	8E597645D4CC6FCFDA0FB91B6618D12C5706D697C1EBE41647CAAB12859269FD
SHA-512:	9E08A5B0431AF06D979A05B13AF33EF89321EC6745E2C31AA86B120DF39EE979F41731CC59F147EC4030F427EB6ABB463210A72994D0058536E4F8EFB9C0E52A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA10E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4751
Entropy (8bit):	4.453397294302514
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI95OWpW8VYKYm8M4JCdPi9nFi+q8vjPi9NfGScSQd:uIjfAI7vv7VuJr4KwNfJ3Qd
MD5:	BBA8AD90EF50E4E9EB32FB40B9BC5FBB
SHA1:	053FE939B92CCD857B391EC24F44D8C9C33D28FC
SHA-256:	5AEB31E25DC6329D867CB9E1A4DB82FFB9A90CEAF619D41CD1DA57A36D56CA58
SHA-512:	44A9919658CC6A3DBE3B41879AE345F56B4D8ED11B98CFCCE9D32288BA2F624D36D70C66AAB73C529E773E27B04EC820B8CC2683644A90A9864FA4FAC9D7E90E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565033" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA11B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 18:11:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42448
Entropy (8bit):	2.0246217217068994
Encrypted:	false
SSDEEP:	192:vLiqJnXWO5H4I1xhTHtp+UquuTut/ZgZY0KvN7:uqr5HVfhLttCut/v
MD5:	6CE2CFB81B5D886351A2D3B75A0C744C
SHA1:	C3196C19BA340B2F6E6DF075E7CAC74D9669F559
SHA-256:	1001B9DD86D4CFDCDF4B17C5DAF4468AAA77DEA37B5DCCD42F72354D7FC536A2
SHA-512:	5AB3518880B36E67E263286E91E75A33CB0406080E715740E6CC51E0717CDEF84C0CB37AC34CEF58FEAF7650A159C80E02E2FC2CAAFBE0F5681F1C3E3F2DC0E2
Malicious:	false
Preview:	MDMP..a..... .......:%!g.........................................)..........T.......8...........T...............H.......................................................................................................eJ......,.......GenuineIntel............T.......<...8%!g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA36E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8278
Entropy (8bit):	3.694821928508156
Encrypted:	false
SSDEEP:	192:R6l7wVeJX96Idb6YPK64XgmfTipHCCypr389brvsfd5m:R6lXJt6Idb6YC6QgmfTipHCCvrUfK
MD5:	7F730F0F09D44993F4FA16B8BE77F279
SHA1:	5C0AF0DA87D7CCDC710AA250B88810D91FA9D359
SHA-256:	A704E02F4656674B0F685FC50B52EB9E5F8A60630C1910E9750FF75E32657E73
SHA-512:	9471BBA00877D3F4BF5EF0C6958CDB8341AF399DD15441F71792E51BB1EBDC228BCF3962F70DB4F600E818F7DD4F7AA8AC5B95424B9DB0D3FC6F61442B3E64AF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.2.8.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3BD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4650
Entropy (8bit):	4.469865211295629
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI95OWpW8VYoYm8M4JCdPimFY+q8/oSLGScSSd:uIjfAI7vv7V8JtQJ3Sd
MD5:	29366811C2498BF9AAE6DDBC682904F0
SHA1:	001C36D83C211943E7DFA5A7A80A5781F25EA01B
SHA-256:	7B057A696E2EB5F000790B6DE75D329D3457855F593A6DB40F61693B9AE49014
SHA-512:	93D69A13A711017AD58E0AF021B0570091F79CBAA9B6B44D14FB4D94A06D184C654B29CCFFBA7B91051D4B00E95FA20A5C8FC61FA9948D84255D8C87169A214D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565033" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372878769680913
Encrypted:	false
SSDEEP:	6144:rFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNEiL:RV1QyWWI/glMM6kF7Kq
MD5:	647CA0E40982722588FE11C977C83C2D
SHA1:	90844771D5913EB20572F70187CB59DD39AC7429
SHA-256:	B10A46049090EAAF58B460C85AB4C9511CBC2B953D9C9BF91B231BDF84A55B83
SHA-512:	B896FCE272F872504EEE19EAEE575B2F43AE19D2CD739B8866DAA979018018393AC455FC53290BCC6234726ECC254A634383A43123AC579CEFF1AF7C764E75C4
Malicious:	false
Preview:	regfD...D....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...-*..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.649618898289129
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 95.46% Win32 EXE PECompact compressed (generic) (41571/9) 3.96% Win16/32 Executable Delphi generic (2074/23) 0.20% Generic Win/DOS Executable (2004/3) 0.19% DOS Executable Generic (2002/1) 0.19%
File name:	n57kYr8YQW.dll
File size:	1'270'272 bytes
MD5:	6588f55041b412cef3cab456de2032d8
SHA1:	702b4ab077d8a46217e241d5dc7f5a295552983d
SHA256:	4f564b754fe1a4a200d38c9a2d928d44bf93be1def0e9f4f855ffa6d73eba293
SHA512:	187f2c6ace7a92ef7bc78074bac581dcec1fb47cda3f59c075fb77c19c1b3cde3d110d103942c3f21339256670ab7bc0297d1d32456bf045ae966a271739c57e
SSDEEP:	24576:rG6z8NUN+VGUAaY1zG+0VwpDzPYTFVKhb:rUrVYxR00DzwTFVKV
TLSH:	52455C62F245643EC4AA0A364977AD50583FB7A2755AEC1E57F4088CCE3A5802F3E74F
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x50eee8
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x66F43F6A [Wed Sep 25 16:50:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6327992c879b906e750778c69d550fed

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC0h
mov eax, 0050A350h
call 00007F31B8A10025h
call 00007F31B8A09440h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x122000	0x2a7	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11f000	0x1c46	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13d000	0x4600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x124000	0x18520	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11f5a4	0x464	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x121000	0x366	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10c96c	0x10ca00	bab5883e57c2665048c12ed24d617172	False	0.3668584952303397	data	6.493236324591389	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x10e000	0xf00	0x1000	b5a729ba5800754ca9d74239ee07b46e	False	0.535400390625	data	6.096583269221522	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x10f000	0x8f74	0x9000	5a16079859930cf800d885ee61f97600	False	0.6360677083333334	data	6.623184293813076	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x118000	0x62fc	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x11f000	0x1c46	0x1e00	bd166391d3b2991897d3f90ec0b419cb	False	0.32083333333333336	data	4.974350011480841	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x121000	0x366	0x400	9c7b1e6fd492c18332b403fa3ad29c2e	False	0.3544921875	data	3.0967012674854977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x122000	0x2a7	0x400	f736b3a419381b0edad1fce1e31db573	False	0.4072265625	data	4.002875385807582	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rdata	0x123000	0x44	0x200	c9f8bfa36b2dc5163b75d3196d251b45	False	0.15625	data	1.1660636886017055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x124000	0x18520	0x18600	4b8f89f109ae05974f7618da9030cbae	False	0.5803485576923076	data	6.710755177482659	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x13d000	0x4600	0x4600	f9acd086a22d3118c471c96fb2f59f28	False	0.2746651785714286	data	3.6929859121760287	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_STRING	0x13d460	0x31c	DOS executable (COM, 0x8C-variant)			0.4258793969849246
RT_STRING	0x13d77c	0xb5c	data			0.2548143053645117
RT_STRING	0x13e2d8	0x428	data			0.37406015037593987
RT_STRING	0x13e700	0x3c4	data			0.37655601659751037
RT_STRING	0x13eac4	0x3cc	data			0.2757201646090535
RT_STRING	0x13ee90	0x394	data			0.4334061135371179
RT_STRING	0x13f224	0x4e4	data			0.35303514376996803
RT_STRING	0x13f708	0x374	data			0.3563348416289593
RT_STRING	0x13fa7c	0x454	data			0.38898916967509023
RT_STRING	0x13fed0	0x1ec	data			0.3983739837398374
RT_STRING	0x1400bc	0xc4	data			0.6428571428571429
RT_STRING	0x140180	0x170	data			0.5597826086956522
RT_STRING	0x1402f0	0x334	data			0.41585365853658535
RT_STRING	0x140624	0x408	data			0.3168604651162791
RT_STRING	0x140a2c	0x36c	data			0.4018264840182648
RT_STRING	0x140d98	0x2b8	data			0.4367816091954023
RT_RCDATA	0x141050	0x10	data			1.5
RT_RCDATA	0x141060	0x398	data			0.6043478260869565
RT_RCDATA	0x1413f8	0x2	data	English	United States	5.0
RT_VERSION	0x1413fc	0x200	Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970	English	United States	0.4765625

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, TlsFree, TlsAlloc, LocalFree, LocalAlloc, FreeLibrary
user32.dll	ReleaseDC, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, LoadImageW, LoadIconW, GetSystemMetrics, GetSysColor, GetIconInfo, GetDC, GetClipboardData, FrameRect, FillRect, DrawTextExW, DrawIconEx, DrawFocusRect, DestroyIcon, CreateIcon, CopyIcon, CharUpperBuffW, CharUpperW, CharLowerBuffW
gdi32.dll	UnrealizeObject, StretchDIBits, StretchBlt, SetWinMetaFileBits, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, RoundRect, ResizePalette, Rectangle, RealizePalette, Polyline, Polygon, PolyBezierTo, PolyBezier, PlayEnhMetaFile, Pie, PatBlt, MoveToEx, MaskBlt, LineTo, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsW, GetTextExtentPoint32W, GetSystemPaletteEntries, GetStretchBltMode, GetStockObject, GetPixel, GetPaletteEntries, GetObjectW, GetNearestPaletteIndex, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionW, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExtTextOutW, ExtFloodFill, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectW, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileW, Chord, BitBlt, ArcTo, Arc, AngleArc
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, VerSetConditionMask, VerifyVersionInfoW, SwitchToThread, SuspendThread, Sleep, SizeofResource, SetThreadPriority, SetFilePointer, SetEvent, SetEndOfFile, ResumeThread, ResetEvent, ReadFile, RaiseException, IsDebuggerPresent, MulDiv, LockResource, LocalFree, LoadResource, LoadLibraryW, LeaveCriticalSection, IsValidLocale, IsBadReadPtr, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GetVersionExW, GetTickCount, GetThreadPriority, GetThreadLocale, GetStdHandle, GetProcessHeap, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetExitCodeThread, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcess, GetCPInfoExW, GetCPInfo, GetACP, FreeResource, FreeLibrary, FormatMessageW, FindResourceW, EnumSystemLocalesW, EnumCalendarInfoW, EnterCriticalSection, DeleteCriticalSection, CreateFileW, CreateEventW, CompareStringW, CloseHandle
advapi32.dll	RegUnLoadKeyW, RegSetValueExW, RegSaveKeyW, RegRestoreKeyW, RegReplaceKeyW, RegQueryValueExW, RegQueryInfoKeyW, RegOpenKeyExW, RegLoadKeyW, RegFlushKey, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegConnectRegistryW, RegCloseKey
kernel32.dll	Sleep
netapi32.dll	NetApiBufferFree, NetWkstaGetInfo
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
ole32.dll	CoCreateInstance, IsEqualGUID
msvcrt.dll	memset, memcpy

Exports

Name	Ordinal	Address
BarCreate	4	0x50a344
BarDestroy	5	0x50a340
BarFreeRec	6	0x50a33c
BarRecognize	7	0x50a338
TMethodImplementationIntercept	3	0x45f330
__dbk_fcall_wrapper	2	0x41041c
dbkFCallWrapperAddr	1	0x51b630
wkeCreateWebView	13	0x50a320
wkeDestroyWebView	8	0x50a334
wkeFinalize	9	0x50a330
wkeFireContextMenuEvent	16	0x50a314
wkeFireKeyDownEvent	12	0x50a324
wkeFireKeyPressEvent	14	0x50a31c
wkeFireKeyUpEvent	23	0x50a2f8
wkeFireMouseEvent	15	0x50a318
wkeFireMouseWheelEvent	17	0x50a310
wkeGetCaretRect	20	0x50a304
wkeInitialize	22	0x50a2fc
wkeIsDirty	21	0x50a300
wkeKillFocus	19	0x50a308
wkePaint2	24	0x50a2f4
wkeResize	11	0x50a328
wkeSetDirty	10	0x50a32c
wkeSetFocus	18	0x50a30c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	14:10:54
Start date:	29/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll"
Imagebase:	0x110000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:10:54
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:10:54
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",#1
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:10:54
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\n57kYr8YQW.dll,BarCreate
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:10:54
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",#1
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:10:54
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 648
Imagebase:	0x350000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:10:57
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\n57kYr8YQW.dll,BarDestroy
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:11:00
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\n57kYr8YQW.dll,BarFreeRec
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:11:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarCreate
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:11:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarDestroy
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:11:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarFreeRec
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:11:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeSetFocus
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:11:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeSetDirty
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:11:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeResize
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:11:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkePaint2
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:11:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeKillFocus
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:11:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeIsDirty
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:11:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeInitialize
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:11:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeGetCaretRect
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:11:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireMouseWheelEvent
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:11:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireMouseEvent
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:11:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireKeyUpEvent
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:11:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireKeyPressEvent
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:11:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireKeyDownEvent
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	14:11:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFireContextMenuEvent
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	14:11:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeFinalize
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	14:11:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeDestroyWebView
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:11:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",wkeCreateWebView
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	14:11:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",dbkFCallWrapperAddr
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:11:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",__dbk_fcall_wrapper
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	14:11:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",TMethodImplementationIntercept
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:11:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\n57kYr8YQW.dll",BarRecognize
Imagebase:	0xf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	14:11:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 640
Imagebase:	0x350000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	14:11:05
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 640
Imagebase:	0x350000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	331
Total number of Limit Nodes:	24

Executed Functions

Function 0040D2FC Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040D3BC,?,?), ref: 0040D32E
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040D3BC,?,?), ref: 0040D337

Part of subcall function 0040D1C4: FindFirstFileW.KERNEL32(00000000,?,00000000,0040D222,?,00000001), ref: 0040D1F7
Part of subcall function 0040D1C4: FindClose.KERNEL32(00000000,00000000,?,00000000,0040D222,?,00000001), ref: 0040D207

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: bb5aebafb1050cca1833a86485a25d2ce173cc466728c947d737821306c0bec7
Instruction ID: 31cc6c2f53d714b9faa06a3b986118d36ba9187928ad3646f11bb52bdd509fcd
Opcode Fuzzy Hash: bb5aebafb1050cca1833a86485a25d2ce173cc466728c947d737821306c0bec7
Instruction Fuzzy Hash: DD113670E042099BDF00EFA5D952AAEB3B4EF45304F50447EB904B73C2D7785E098669

Function 0040D1C4 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040D222,?,00000001), ref: 0040D1F7
FindClose.KERNEL32(00000000,00000000,?,00000000,0040D222,?,00000001), ref: 0040D207

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: fd6b56c6bec8101a1a2edd49b896a968750317b75b60eb436ea3e7407fe2b467
Instruction ID: f2706f95e4b90df003fff4208de2c5c05cd5cdeba3f5e8022b992bb7b9acb03d
Opcode Fuzzy Hash: fd6b56c6bec8101a1a2edd49b896a968750317b75b60eb436ea3e7407fe2b467
Instruction Fuzzy Hash: 80F08271944608BEDB20FBB5DC5299EB7FCEB48314BA005BAB404F31D2EB389E14995D

Function 0040EE84 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0040EE88

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction ID: 4e8efc271a9064b51e8e7fb51594f2112b3c6a5914667696f4d1ddbf71e3eb2d
Opcode Fuzzy Hash: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction Fuzzy Hash: 72A012208088000EC408A7194C4350F31805941118FC40624785CA92C2E619896546EF

Function 0040CDE8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D00D,?,?), ref: 0040CE21
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D,?,?), ref: 0040CE6A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D,?,?), ref: 0040CE8C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040CEAA
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040CEC8
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040CEE6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040CF04
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D), ref: 0040CF44
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001), ref: 0040CF6F
RegCloseKey.ADVAPI32(?,0040CFF7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001,Software\Embarcadero\Locales), ref: 0040CFEA

Strings

Software\Embarcadero\Locales, xrefs: 0040CE60, 0040CE82
Software\CodeGear\Locales, xrefs: 0040CEA0, 0040CEBE
Software\Borland\Delphi\Locales, xrefs: 0040CEFA
Software\Borland\Locales, xrefs: 0040CEDC

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: f7c917e479dc5b8b684dcf2a59e43bffe3130ab6fea02e13758483d346620e00
Instruction ID: 80583e44c54d8f6c8431ac525ce0e8cce3f8a82ce7c118a8e5b64ed8406c3328
Opcode Fuzzy Hash: f7c917e479dc5b8b684dcf2a59e43bffe3130ab6fea02e13758483d346620e00
Instruction Fuzzy Hash: DC512675A40609BEEB20DBA5CC82FAFB7BCDB08704F504077BA04F61C1D6789D059A5D

Function 0040CAB4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000,00000000), ref: 0040CAD2
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000), ref: 0040CAF6
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000), ref: 0040CB05
IsValidLocale.KERNEL32(00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB17
EnterCriticalSection.KERNEL32(0051AC10,00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB74
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB9D

Strings

en-GB,en,en-US,, xrefs: 0040CAE2, 0040CB89

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 16983b795ea3f6d15511b6f3b7a2fd081026003eab2b4e0bc2c7165cd39925dc
Instruction ID: dbd07ac227d82710da470fa0a9828874cbe6fbb8e5c29b4c0eb771d3e90eaa4c
Opcode Fuzzy Hash: 16983b795ea3f6d15511b6f3b7a2fd081026003eab2b4e0bc2c7165cd39925dc
Instruction Fuzzy Hash: 59214220740744D7EA12B77AA85376E36A4EB45718F50853BB000B72C2D9BD9D418ADF

Function 004EEE14 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 004EEE3A

Part of subcall function 004EEDD0: GetDC.USER32(00000000), ref: 004EEDD9
Part of subcall function 004EEDD0: SelectObject.GDI32(00000000,058A00B4), ref: 004EEDEB
Part of subcall function 004EEDD0: GetTextMetricsW.GDI32(00000000), ref: 004EEDF6
Part of subcall function 004EEDD0: ReleaseDC.USER32(00000000,00000000), ref: 004EEE07

Strings

Tahoma, xrefs: 004EEE5C
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 004EEE90
MS Shell Dlg 2, xrefs: 004EEEA4

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma
API String ID: 2013942131-1011973972
Opcode ID: 097e2b04109c535b1ff6f7b8f22f0f4b945d927974ab36b84c2c83510e6f8af6
Instruction ID: e778abe1add94e60aef3389f339230e1650141aaed61f0d7e84fdd46377505a2
Opcode Fuzzy Hash: 097e2b04109c535b1ff6f7b8f22f0f4b945d927974ab36b84c2c83510e6f8af6
Instruction Fuzzy Hash: 7E11D030600149AFC711EF6BCC12A9E7BB5EB45705F90847BF400A7791DB39AD01CB18

Function 0040961C Relevance: 6.2, APIs: 4, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00409653

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 5a2d98b2b9303db085ca7903a3e8743554e309b17d8937ec0eab1567879db523
Instruction ID: 57d564f7514a768ac0d6b140dc1e0ae383663f7c9c7dd69698fd604fdf563357
Opcode Fuzzy Hash: 5a2d98b2b9303db085ca7903a3e8743554e309b17d8937ec0eab1567879db523
Instruction Fuzzy Hash: FF516B706002449BDB25EF6AC88479B7BE1AF59314F14843FE809AA3D3D779DC88CB59

Function 0050E000 Relevance: 6.0, APIs: 4, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadLocale.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E02D

Part of subcall function 0040C520: InitializeCriticalSection.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C525
Part of subcall function 0040C520: GetVersion.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C533
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C55A
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C560
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C574
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C57A
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C58E
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C594

Part of subcall function 0040EE84: GetSystemInfo.KERNEL32 ref: 0040EE88

GetCommandLineW.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E092

Part of subcall function 00405244: GetStartupInfoW.KERNEL32 ref: 00405255

GetACP.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E0A6
GetCurrentThreadId.KERNEL32 ref: 0050E0BA

Part of subcall function 0040EE98: GetVersion.KERNEL32(0050E0C9,00000400,00000000,0050E0D7), ref: 0040EE98

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$InfoThreadVersion$CommandCriticalCurrentInitializeLineLocaleSectionStartupSystem
String ID:
API String ID: 2740004594-0
Opcode ID: da96efc90d0f3f823da1e0c30568e20cb602c22b5ccd4f7319bb0d9d278b2238
Instruction ID: b63630b870325ab19e945f9b7a74bc4420f07e9680e2ed97b13d29786ef075bf
Opcode Fuzzy Hash: da96efc90d0f3f823da1e0c30568e20cb602c22b5ccd4f7319bb0d9d278b2238
Instruction Fuzzy Hash: 3411217040478889D720FF72AC1A2693AA4FB19308710C87ED1006A2E2DFBD540CEF6E

Function 004D915C Relevance: 4.6, APIs: 3, Instructions: 150
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,004D931F), ref: 004D91D5
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,004D931F), ref: 004D924B
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 004D92BC

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 297e97f5790f3bfbe46446021c8049ae68c7a4fb6bdd877cd8b5aad7bbb95b8b
Instruction ID: ad3af0877aad2f918cc60e01b05eab59aa261d8504b712c7e441bbb361f6d9d3
Opcode Fuzzy Hash: 297e97f5790f3bfbe46446021c8049ae68c7a4fb6bdd877cd8b5aad7bbb95b8b
Instruction Fuzzy Hash: 87515431B00208BFDB11EBA5C852B9EB7FAAB48304F15446FB444E3382DA7D9F069759

Function 00427884 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,00427984), ref: 004278C9
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,00427967,?,00000000,?,00000000,00427984), ref: 00427902
VerQueryValueW.VERSION(?,00427998,?,?,00000000,?,00000000,?,00000000,00427967,?,00000000,?,00000000,00427984), ref: 0042791C

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: d254ea856f19eca79d65d9f3d227b80f169b0e93736270e157245cabf41f0a7c
Instruction ID: c637f2b1f86e41ba3c57f6c02bd3706f471a10e856d15e50b91235f572eefc7d
Opcode Fuzzy Hash: d254ea856f19eca79d65d9f3d227b80f169b0e93736270e157245cabf41f0a7c
Instruction Fuzzy Hash: BC3141B5A04319AFEB00DFA9D881DAEB7F8EB48704B9144BAF544E3241D778DE40CB65

Function 004D9EDC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,004D9BB9), ref: 004D9F07

Strings

8DA, xrefs: 004D9F26

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID: 8DA
API String ID: 3660427363-1089967677
Opcode ID: fb23700e1ae61f67946166d4bf62f27f5b8893b9de390ec045e8b9287b1db4f3
Instruction ID: e25cda230c208e90296d212b571606f5724dbad4f61f31a9ad7a87890f2af682
Opcode Fuzzy Hash: fb23700e1ae61f67946166d4bf62f27f5b8893b9de390ec045e8b9287b1db4f3
Instruction Fuzzy Hash: D5015E71A00208AFDB00EFA9DC81ADAB7E89B59314F0081ABF914DB342DA759E0587A5

Function 0040D3C8 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040D566,00000000,?,00000105), ref: 0040D473
GetSystemDefaultUILanguage.KERNEL32(00000000,0040D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040D566,00000000,?,00000105), ref: 0040D49B

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: e5fbb9e0fc620f56b36578c07845851fe2fed8148833940ec20a2950b4b279a8
Instruction ID: 914cf1b0947d833fcc03ff50d5076885400eec8b7426a2207ce03941fa5f7576
Opcode Fuzzy Hash: e5fbb9e0fc620f56b36578c07845851fe2fed8148833940ec20a2950b4b279a8
Instruction Fuzzy Hash: DB31EB30E142099BDB10EFA9C891BAEB7B5EF44304F50457BE400B72D2D778AD498A59

Function 0040D4EC Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D528
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D579

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 783f705d58062fb5f8e85dc88ba71afedba3f43c8334a4a5c8ebaaa4e4aa5bf8
Instruction ID: 258510d9c4dee0299c5f3f79c4fbca46c564eaaadbdb9c5c4e3057b0bb4fa4ad
Opcode Fuzzy Hash: 783f705d58062fb5f8e85dc88ba71afedba3f43c8334a4a5c8ebaaa4e4aa5bf8
Instruction Fuzzy Hash: 3F114F70E4461CABDB10EB94CC86BDE73B8DB04304F5144BAB508B72D1EA785F858A99

Function 00405600 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,00405C17), ref: 00405617

Strings

@., xrefs: 00405652, 00405670

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: @.
API String ID: 4275171209-4201455939
Opcode ID: e9bd031fac14de1d523f3f0fd1d0bc821c44dc6a8c79c950d7b754ab0e602f81
Instruction ID: 7dac567e4a07de2f06f580edb35680116b9bdba5c2a0860377bbd693bdd19f0d
Opcode Fuzzy Hash: e9bd031fac14de1d523f3f0fd1d0bc821c44dc6a8c79c950d7b754ab0e602f81
Instruction Fuzzy Hash: 49F0AFF2B003004FD7248F789D407A67AD4FB08324F10827FE908EB798DBB488048B84

Function 004D8EA0 Relevance: 3.0, APIs: 2, Instructions: 18
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegFlushKey.ADVAPI32(00000000,?,004D8F0C,?,?,00000000,004D9123,00000000,00000000,00000000,?,?,00000000,004D9139), ref: 004D8EB1
RegCloseKey.ADVAPI32(00000000,?,004D8F0C,?,?,00000000,004D9123,00000000,00000000,00000000,?,?,00000000,004D9139), ref: 004D8EBA

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction ID: 6f4c2654893a1a96a1da4be1dd0c350b83e18a7e628d6434c516513760379d46
Opcode Fuzzy Hash: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction Fuzzy Hash: 40D067B1E042049ADF60EF7AC9C5A577BDC6F44315B08C4ABB808DF247DA3CD9409B28

Function 004D98DC Relevance: 1.5, APIs: 1, Instructions: 36
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,?,?,?,004D9AE0,00000000,004D9C1C), ref: 004D990D

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ad67be82557188437bc6127552a9993e0998d0cde0f580ab283647e522f4a4dc
Instruction ID: bf80709a24f295cc4fff76cdf4c79f612c8773d4563c6b2b62db8eae0a0485ee
Opcode Fuzzy Hash: ad67be82557188437bc6127552a9993e0998d0cde0f580ab283647e522f4a4dc
Instruction Fuzzy Hash: 3CF01C623052046FD344FA6E9C81F6B66DC9B88754F10843FB248C7342D964DC058375

Function 0040C278 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00400000,?,0000020A), ref: 0040C296

Part of subcall function 0040D4EC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D528
Part of subcall function 0040D4EC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D579

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction ID: dd2aa8039920255b97d322d6193c29fca073ce87a4a4145dda77fc50cf625817
Opcode Fuzzy Hash: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction Fuzzy Hash: 07E0ED71E003109BCB10DF98C9C5A4737D8AB08754F0446A6AD14DF387D775DD148BD5

Non-executed Functions

Function 004EAA7C Relevance: 48.5, APIs: 32, Instructions: 501windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 004EAAFC
GetDC.USER32(00000000), ref: 004EAB0D
CreateCompatibleDC.GDI32(00000000), ref: 004EAB1E
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004EAB6A
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004EAB8E
SelectObject.GDI32(?,?), ref: 004EADE6
SelectPalette.GDI32(?,00000000,00000000), ref: 004EAE26
RealizePalette.GDI32(?), ref: 004EAE32
SetTextColor.GDI32(?,00000000), ref: 004EAE9B
SetBkColor.GDI32(?,00000000), ref: 004EAEB6
SetDIBColorTable.GDI32(?,00000000,00000002,?,?,00000000,?,00000000,00000000,004EB046,?,00000000,004EB068,?,00000000,004EB079), ref: 004EAEFF
FillRect.USER32(?,00000000,00000000), ref: 004EAE83

Part of subcall function 004E32AC: GetSysColor.USER32(?), ref: 004E32B6

PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 004EAF21
CreateCompatibleDC.GDI32(00000000), ref: 004EAF34
SelectObject.GDI32(004EB33B,00000000), ref: 004EAF57
SelectPalette.GDI32(004EB33B,00000000,00000000), ref: 004EAF73
RealizePalette.GDI32(004EB33B), ref: 004EAF7E
SetTextColor.GDI32(004EB33B,00000000), ref: 004EAF9C
SetBkColor.GDI32(004EB33B,00000000), ref: 004EAFB7
BitBlt.GDI32(?,00000000,00000000,?,?,004EB33B,00000000,00000000,00CC0020), ref: 004EAFDF
SelectPalette.GDI32(004EB33B,00000000,000000FF), ref: 004EAFF1
SelectObject.GDI32(004EB33B,00000000), ref: 004EAFFB
DeleteDC.GDI32(004EB33B), ref: 004EB016

Part of subcall function 004E45BC: EnterCriticalSection.KERNEL32(-00000008), ref: 004E45E4
Part of subcall function 004E45BC: CreateBrushIndirect.GDI32(?), ref: 004E4671
Part of subcall function 004E45BC: LeaveCriticalSection.KERNEL32(?,004E46A5,-00000008), ref: 004E4698

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ColorSelect$CreatePalette$Object$Compatible$BitmapCriticalRealizeSectionText$BrushDeleteEnterFillIndirectLeaveRectTable
String ID:
API String ID: 3271313764-0
Opcode ID: fe2f7d032ca60ba23a25b8aee0731278cea1c8a05eae85922534dd69cbd64bb5
Instruction ID: 35a244f6f23a8f79e02010a3497fee76c02ec5d27261e314751b2550eb949676
Opcode Fuzzy Hash: fe2f7d032ca60ba23a25b8aee0731278cea1c8a05eae85922534dd69cbd64bb5
Instruction Fuzzy Hash: 47121975A00248AFDB10DFAAC885F9EB7B9EF08315F118456F914EB291C778EE80CB55

Function 0040C520 Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C525
GetVersion.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C533
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C55A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C560
GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C574
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C57A
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C58E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C594

Strings

kernel32.dll, xrefs: 0040C555, 0040C56F, 0040C589
SetThreadPreferredUILanguages, xrefs: 0040C56A
GetThreadPreferredUILanguages, xrefs: 0040C550
GetThreadUILanguage, xrefs: 0040C584

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$CriticalInitializeSectionVersion
String ID: GetThreadPreferredUILanguages$GetThreadUILanguage$SetThreadPreferredUILanguages$kernel32.dll
API String ID: 74573329-1403180336
Opcode ID: 3eb0d1b683875d0a4e7ed686173063676bd5968c29d9e357da0c930b2f0c2479
Instruction ID: 8edfc10a46b7400df28ad4f2c85025a5e0675a444164cbed82ad90a550fe5e83
Opcode Fuzzy Hash: 3eb0d1b683875d0a4e7ed686173063676bd5968c29d9e357da0c930b2f0c2479
Instruction Fuzzy Hash: 15F05EB8951B10BADA023772AD8375F3680DA1070CB20853BB100790D2DEBC19549E9E

Function 004FFD00 Relevance: 20.0, APIs: 10, Strings: 1, Instructions: 742windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004FFE79
CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 004FFEC0
DeleteObject.GDI32(00000000), ref: 004FFEDE
DeleteDC.GDI32(00000000), ref: 004FFEE7
SelectObject.GDI32(00000000,00000000), ref: 004FFF18
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 004FFF47
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 00500607
SelectObject.GDI32(00000000,?), ref: 00500614
DeleteObject.GDI32(00000000), ref: 0050061D
DeleteDC.GDI32(00000000), ref: 00500626

Strings

4iQ, xrefs: 004FFE65

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DeleteObject$CreateSelect$CompatibleSection
String ID: 4iQ
API String ID: 1283611041-1953506770
Opcode ID: 7130bac8e803064e932ef57a6e6566469b9ff46b5490c7ef49ca98dc624ce1be
Instruction ID: 489c7739ec4370bc5bfdebaf3771013a00e6f61c8886369afeb8e820d07e5809
Opcode Fuzzy Hash: 7130bac8e803064e932ef57a6e6566469b9ff46b5490c7ef49ca98dc624ce1be
Instruction Fuzzy Hash: 62528D71E042598FCB15CFA9C881BEDBBF2FF45300F1481AAE458EB2D2C638A945DB14

Function 0040CBF8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0041A5A8,?,?), ref: 0040CC15
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040CC26
FindFirstFileW.KERNEL32(?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD26
FindClose.KERNEL32(?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD38
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD44
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD89

Strings

GetLongPathNameW, xrefs: 0040CC20
kernel32.dll, xrefs: 0040CC10
\, xrefs: 0040CD56

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 047ad798f282a4f53d2bfa85006bf39dd452bc892cd983c7192c00f70524a19f
Instruction ID: 182d901b7ba620ca83dfe24b28ff924219823170be1df94bbfac5eeb8ceb1ef4
Opcode Fuzzy Hash: 047ad798f282a4f53d2bfa85006bf39dd452bc892cd983c7192c00f70524a19f
Instruction Fuzzy Hash: 73417F71A00618DBDB20EBA4CCC5ADEB3B5AF84314F1846BA9504F72C1E77CAE45CB49

Function 00509F0C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,0050A171,?,00000000,?,00000000), ref: 00509F8E
IsBadReadPtr.KERNEL32(?,00000014), ref: 0050A142

Strings

BuildImportTable: GetProcAddress failed, xrefs: 0050A115
BuildImportTable: ReallocMemory failed, xrefs: 0050A020
BuildImportTable: can't load library: , xrefs: 00509FD5
Q, xrefs: 00509FD0, 0050A01B, 0050A110

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: LibraryLoadRead
String ID: BuildImportTable: GetProcAddress failed$BuildImportTable: ReallocMemory failed$BuildImportTable: can't load library: $Q
API String ID: 1452896035-1248965296
Opcode ID: 624b6a481da2d4e0e2557361c6a3e5f3bb81faf17dfaa577d8091a5bd25c36fc
Instruction ID: 79c6ccc65db54bbd0ac28440b6136ff53135dc4e1d04f2ea193c697df5b6055c
Opcode Fuzzy Hash: 624b6a481da2d4e0e2557361c6a3e5f3bb81faf17dfaa577d8091a5bd25c36fc
Instruction Fuzzy Hash: 8C714C70A00209AFDB10DB69CC86BAEBBF9FF89310F4484A9F155EB291D774AD45CB11

Function 00508F54 Relevance: 7.6, APIs: 5, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,00508E55,?,?,?,?,?,00000000,00000000), ref: 00508FC4
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00000000,00508E55,?,?,?,?,?,00000000,00000000), ref: 00508FF3
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00000000,00508E55,?,?,?,?,?,00000000,00000000), ref: 00508FFE
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,00508E55,?,?,?,?,?,00000000,00000000), ref: 00509004
VirtualFree.KERNEL32(?,?,00008000,?,?,?,?,00000000,00508E55,?,?,?,?,?,00000000,00000000), ref: 00509044

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Free$HeapVirtual$LibraryProcess
String ID:
API String ID: 565514093-0
Opcode ID: ec53eb67f07e112ebaad708714b759570eedab89a0434c605d510451f714df12
Instruction ID: 586cf716fabd9d070d37681a3ed92f7946a2b61a65b0c95988127996bec1744a
Opcode Fuzzy Hash: ec53eb67f07e112ebaad708714b759570eedab89a0434c605d510451f714df12
Instruction Fuzzy Hash: 613181B1204606AFD320EF69CC89F6ABBA9FF84710F144619F554CB292CB64FD45C7A0

Function 004AA910 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA927
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA941
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA95B
LockResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000), ref: 004AA965

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction ID: cb9b2a388fffd021e353bf4cf2117ea65373932cb549638ab777629fd56d0805
Opcode Fuzzy Hash: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction Fuzzy Hash: 96F062B26042047F5744EE5EA841D5B7BECDE5A264310011FF908D7207DA38ED51837D

Function 0040C79C Relevance: 4.6, APIs: 3, Instructions: 99COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,0040C901,?,0041A5A8,?,00000000), ref: 0040C846
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,0040C901,?,0041A5A8,?,00000000), ref: 0040C862
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,0040C901,?,0041A5A8,?,00000000), ref: 0040C873

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: d62bc5ecf4585d0b78f38a216359797881bb5583d195145a11d1f228b605bdfe
Instruction ID: 2a28b5b25d505860436f04a2e6c8396a795a98c7f85c76968f02c108a8d9c51a
Opcode Fuzzy Hash: d62bc5ecf4585d0b78f38a216359797881bb5583d195145a11d1f228b605bdfe
Instruction Fuzzy Hash: BB319C71A0061CEBDB20EB55DC81BDE77B9EB44705F6042BAA508B32D0D6395E80DE59

Function 004EA1D8 Relevance: 4.6, APIs: 3, Instructions: 51fileclipboardCOMMON

Download Yara Rule

APIs

GetClipboardData.USER32(0000000E), ref: 004EA1E5
CopyEnhMetaFileW.GDI32(00000000,00000000), ref: 004EA207
GetEnhMetaFileHeader.GDI32(?,0000006C,?,00000000,00000000), ref: 004EA219

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileMeta$ClipboardCopyDataHeader
String ID:
API String ID: 1752724394-0
Opcode ID: 66224f9e71742e994135c4ca1ded3115ca749d2bafb37c10849f9b0bb9981f8c
Instruction ID: a579deb15176a2d0a1dbf34907e0b0f9d8595ad382c3220d39a671540978c399
Opcode Fuzzy Hash: 66224f9e71742e994135c4ca1ded3115ca749d2bafb37c10849f9b0bb9981f8c
Instruction Fuzzy Hash: 0D117C726003448FC710DFAEC885A9AB7F8AF49314F10466EE509DB252DA74EC48CB94

Function 004EFE80 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 783COMMON

Download Yara Rule

Strings

jjj, xrefs: 004F0654

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: jjj
API String ID: 0-2289343631
Opcode ID: 379f3ad564931047c85a0e8324c1b925258155478eac1b2c346929ac29ebc0ac
Instruction ID: 0e6e8520d3be3831dee58035f3478674022d586b9291955b557444e96a04ac11
Opcode Fuzzy Hash: 379f3ad564931047c85a0e8324c1b925258155478eac1b2c346929ac29ebc0ac
Instruction Fuzzy Hash: CB723970600204CFDB29CF19D9C0B677BA2FB95315F14869AD9464F38BC738E856CB6A

Function 004F1FC4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 699COMMON

Download Yara Rule

Strings

9Q, xrefs: 004F22AF

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: 9Q
API String ID: 0-4141447236
Opcode ID: c85e39b14b60b4e960e998f2343e0d1547b2847ac62002dfaddbb849c39a277c
Instruction ID: 872c69647381f06e73c0189917d9e5469cc943f97499b4375cee1c22dc96545a
Opcode Fuzzy Hash: c85e39b14b60b4e960e998f2343e0d1547b2847ac62002dfaddbb849c39a277c
Instruction Fuzzy Hash: 40626D70900209DFDB19CF58C984BBEBBB1BF88304F15819ADD559B386C778D985CB89

Function 004B8000 Relevance: 3.1, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(00000000,004B80BB), ref: 004B8032
RaiseException.KERNEL32(406D1388,00000000,00000004,00001000,00000000,004B808D,?,00000000,004B80BB), ref: 004B807E

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DebuggerExceptionPresentRaise
String ID:
API String ID: 1899633966-0
Opcode ID: 918f654b1989dfd3ee398986ac0d4d5983e76a9e6b43d16da8286ca8f312fc4d
Instruction ID: aa851b4e1d0f37632037c728c599de388d05abd6bc809da2430ac8adde4c7f7f
Opcode Fuzzy Hash: 918f654b1989dfd3ee398986ac0d4d5983e76a9e6b43d16da8286ca8f312fc4d
Instruction Fuzzy Hash: 7A11D671A14208AFD710EF65DC52ADEBBFCEB48704F61447BE500E3651EB785E04CA68

Function 004E5AA0 Relevance: 3.0, APIs: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004E5B3C,?,00000000,?,004E5B54,00000000,004EB19B,00000000,004EB33B,?,00000000,00000054,?,00000000,?), ref: 004E5AC0
FormatMessageW.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,004E5B3C,?,00000000,?,004E5B54,00000000,004EB19B,00000000), ref: 004E5AE6

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 3d658324b1b03f1d33dfdd215c91ea1b99e4dd16f5471f85141302732c58e772
Instruction ID: c91c4b4c8320e0c1e530085dddd9d5d25a400c360d6da16a75b1d286b8cd0c3b
Opcode Fuzzy Hash: 3d658324b1b03f1d33dfdd215c91ea1b99e4dd16f5471f85141302732c58e772
Instruction Fuzzy Hash: 7401AC707147455FE721FB628D92F9977A8DB04709F5044BAF704E62C3EAB86D40891D

Function 004219D8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 004219F9

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 7055af4c37e798c4eedd1ab66a3f56a97fac90cff517f4e9d1e1818016eb5d1c
Instruction ID: 0ac6486f21f903cb75f282dfc890b26380fbcd4d5ccfbab9b17402b0b1878633
Opcode Fuzzy Hash: 7055af4c37e798c4eedd1ab66a3f56a97fac90cff517f4e9d1e1818016eb5d1c
Instruction Fuzzy Hash: 6011CCB5A00209AFDB04CF99C8819AFB7F9EFC8704B14C56AA509E7354E6319A41CBA4

Function 00425334 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ea3b3c1b5a1cf1a130d0f040b5935ae3e0cd2e837d4e3e09926aa746a21f6665
Instruction ID: 4ace5e9765896cc83d0c08b398fcb6cdb51b1f9deae2cd3a8e1490c56280457a
Opcode Fuzzy Hash: ea3b3c1b5a1cf1a130d0f040b5935ae3e0cd2e837d4e3e09926aa746a21f6665
Instruction Fuzzy Hash: DEE0D87171071817D714A9599C86DFBB25CAB88340F4045BFBE05D7383EDB49E4446ED

Function 0042920C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00428FB4,00000002,?,?,0042958D,004257FD,?,00000000,0042583E,?,?,?,00000000,00000000), ref: 00429239

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: cca9abc3a11610917688cb0633c448d3797570d25fd4a641b53c3c50ab693acf
Instruction ID: 63fa091e9d080db82cecbc2cc5fa61dc70d90b6f989caf0edc4abe69f196ef62
Opcode Fuzzy Hash: cca9abc3a11610917688cb0633c448d3797570d25fd4a641b53c3c50ab693acf
Instruction Fuzzy Hash: A0E02662B415319BC120B7BA1E43B9A7A024F81BA4F08857BF498DF3C3EA6D0C0541FE

Function 00425380 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,00425482,?,00000001,00000000,00425691), ref: 00425393

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e6b6a51cb939c12e8be8693ad0cf5385fb4deb90edb709e785ba876ef48dd5f6
Instruction ID: 9eed19484239e9ca95c0a1dfbed1db1bf7cda38a4e2fdab08b9ea4c2367ee6e5
Opcode Fuzzy Hash: e6b6a51cb939c12e8be8693ad0cf5385fb4deb90edb709e785ba876ef48dd5f6
Instruction Fuzzy Hash: 0BD05EA631922036E210915B7E45DBB5ADCDBC47B2F14483FBE48CA201D2A4CC059275

Function 00428FD0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000400,?,00429086,?,00000000,004291D3), ref: 00428FEB

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4b498ff0c44464bb9c319f2c4cdb7eba90f2cd8f1e1edfbafd7f3df4e5c9a38
Instruction ID: a303c1cb07ff97bfd8ef16a179b2a7490fc3f5062c6a27ca45c0f37d97ec2e54
Opcode Fuzzy Hash: e4b498ff0c44464bb9c319f2c4cdb7eba90f2cd8f1e1edfbafd7f3df4e5c9a38
Instruction Fuzzy Hash: F6D0A7E1B2420023E30426548C42B6722889B84704F10443C7784973C0EE7C591552BF

Function 00423868 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0042386C

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 4c927502ff6ca848d6d79f783507b1be3d95d0ac7cdb7b449a5a22e2f4b00210
Instruction ID: 8da0d5d7dce6a760fb6fb5968247694cf968f8d8edeffb1c78389c91dfcd4fca
Opcode Fuzzy Hash: 4c927502ff6ca848d6d79f783507b1be3d95d0ac7cdb7b449a5a22e2f4b00210
Instruction Fuzzy Hash: 25A0125044582011814037190C0317570405840621FC40789B8F8403D1E91E026040D7

Function 004F6704 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

xGQ, xrefs: 004F670A

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: xGQ
API String ID: 0-116873306
Opcode ID: e390bb8781cfb50e0bf67600d25b5dc8b096431c9f5b13ce083519ddae5a6ed1
Instruction ID: b43b3417401406a326c0658d495f7bfac22fcab4f87dfe3d4983a9788a7a34dd
Opcode Fuzzy Hash: e390bb8781cfb50e0bf67600d25b5dc8b096431c9f5b13ce083519ddae5a6ed1
Instruction Fuzzy Hash: 84814D77D105774BE7628E28C8043A17392AFDC39DF6B42B4ED04ABA42D536BD5386C0

Function 004F6444 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

xGQ, xrefs: 004F644A

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: xGQ
API String ID: 0-116873306
Opcode ID: 6bc0205b4ab2c64538ca0b113fa78fac9b85d5e4605181a21ca93e4cce34d19d
Instruction ID: 9cfbf6d39703a2f841c89ad7d8bc5bd644356b16f8883d5035a763e39ed3e34d
Opcode Fuzzy Hash: 6bc0205b4ab2c64538ca0b113fa78fac9b85d5e4605181a21ca93e4cce34d19d
Instruction Fuzzy Hash: DB711877D204775BEB609E68C8043617392EF8925CF6B46B4DE04BBA42C636BD539AC0

Function 0043B4C4 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96dbd05c6a5cda271e1d6996937e8b3347f306cca49e2da1ac7c058721fcefef
Instruction ID: 0e1373ad738d05412743fbfe0b30fd2dda4791c2bd02ca1af8785a3d2d390580
Opcode Fuzzy Hash: 96dbd05c6a5cda271e1d6996937e8b3347f306cca49e2da1ac7c058721fcefef
Instruction Fuzzy Hash: 8702BE32910235DFDB96CF6AC040109B7B6FF8A72472A82D6D854AB229D370BE51DFD1

Function 004F5F80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8e7f5fa08233c9cf6af3f4da3c8a8b0854dd8decd54ec8197df6d450736b3b
Instruction ID: 3b8a4b9bdbcbb050131b8f531c600d22b301e14a5b3c7c96b4b24d21a3266e97
Opcode Fuzzy Hash: 3c8e7f5fa08233c9cf6af3f4da3c8a8b0854dd8decd54ec8197df6d450736b3b
Instruction Fuzzy Hash: 2871A53238978207E7288E7D9CE02B7EAD35FC531872EC97D95DAC3F42D979A4164248

Function 004B0F64 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction ID: b7ad73d6065eefe40be1e3c61ddaa82719b5b59149f48ac65b38381fd691009e
Opcode Fuzzy Hash: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction Fuzzy Hash: F8418E31B002558BDB58EE2DC8D16A6B7A2AF94254B18C675DCA88F70BC938DD42C7A0

Function 004B10A8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction ID: 9a75494c871b48b3840d49ff1b59f6b632724ee8b9803b4084a2a4f9b95828cd
Opcode Fuzzy Hash: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction Fuzzy Hash: 40419336A002559BDB48DE5DC8D1696B7A3BFC8314B19C675DCA88F70BC938DE02C7A0

Function 004E6918 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc20041c257ff7d61a283088bfa9f2de2708563aa29e0e00101f28d62c41ba6
Instruction ID: 2dc40e0aa77415d55bc0616e35fc77692ce9a422371aba29c42deb2143eb0115
Opcode Fuzzy Hash: 2bc20041c257ff7d61a283088bfa9f2de2708563aa29e0e00101f28d62c41ba6
Instruction Fuzzy Hash: EEE0016420010A8ED348BF38C1098A2B3E3EFECA1038BC4D0D44A9F23EF622C481C300

Function 004079E8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction ID: c1f34be03cf0569538104f0038f02cfb84df381903d0011f2ebedd3a3241928c
Opcode Fuzzy Hash: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction Fuzzy Hash: 76C0E9B550D6066E975C8F1AB480815FBE5FAC8324364C22EA01C83644D73154518A64

Function 004FABB4 Relevance: 49.7, APIs: 33, Instructions: 249windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 004FABD2
CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 004FABE7
SelectObject.GDI32(00000000,00000000), ref: 004FABEE
CreateCompatibleDC.GDI32(?), ref: 004FAC22
CreateCompatibleDC.GDI32(?), ref: 004FAC2E
CreateCompatibleDC.GDI32(?), ref: 004FAC3A
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004FAC4D
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004FAC5D
CreateCompatibleBitmap.GDI32(?,?,?), ref: 004FAC6B
SelectObject.GDI32(?,?), ref: 004FAC7B
SelectObject.GDI32(?,?), ref: 004FAC8B
SelectObject.GDI32(?,?), ref: 004FAC9B
SetBkColor.GDI32(00000000,?), ref: 004FACA8
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 004FACCC
SetBkColor.GDI32(00000000,?), ref: 004FACD6
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00330008), ref: 004FACF2
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 004FAD12
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 004FAD2E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,008800C6), ref: 004FAD4F
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00EE0086), ref: 004FAD70
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 004FAD90
SelectObject.GDI32(?,?), ref: 004FAD9D
DeleteObject.GDI32(00000000), ref: 004FADA3
SelectObject.GDI32(?,?), ref: 004FADB0
DeleteObject.GDI32(00000000), ref: 004FADB6
SelectObject.GDI32(?,?), ref: 004FADC3
DeleteObject.GDI32(00000000), ref: 004FADC9
SelectObject.GDI32(00000000,?), ref: 004FADD3
DeleteObject.GDI32(00000000), ref: 004FADD9
DeleteDC.GDI32(?), ref: 004FADE2
DeleteDC.GDI32(?), ref: 004FADEB
DeleteDC.GDI32(?), ref: 004FADF4
DeleteDC.GDI32(00000000), ref: 004FADFA

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteSelect$Compatible$Bitmap$Stretch$Color
String ID:
API String ID: 881050057-0
Opcode ID: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction ID: 825b2a03bc1370e51723bfade82acbff92c39003225e20d7aaefe19e3380dd92
Opcode Fuzzy Hash: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction Fuzzy Hash: 82815BB2E40218BADB10DEE9CD85FDFBBBCAB09715F104459F604FB241D675AE408BA4

Function 0042EF9C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 0042EFA5

Part of subcall function 0042EF70: GetProcAddress.KERNEL32(00000000), ref: 0042EF89

Strings

VarBstrFromBool, xrefs: 0042F181
VarCmp, xrefs: 0042F0BB
VarAdd, xrefs: 0042EFF5
VarR8FromStr, xrefs: 0042F0FD
VarCyFromStr, xrefs: 0042F129
VarIdiv, xrefs: 0042F04D
VarBoolFromStr, xrefs: 0042F13F
VarSub, xrefs: 0042F00B
VarNeg, xrefs: 0042EFC9
VarMul, xrefs: 0042F021
VarI4FromStr, xrefs: 0042F0D1
VarNot, xrefs: 0042EFDF
oleaut32.dll, xrefs: 0042EFA0
VarDiv, xrefs: 0042F037
VarMod, xrefs: 0042F063
VarDateFromStr, xrefs: 0042F113
VarBstrFromDate, xrefs: 0042F16B
VarXor, xrefs: 0042F0A5
VarAnd, xrefs: 0042F079
VarR4FromStr, xrefs: 0042F0E7
VarOr, xrefs: 0042F08F
VariantChangeTypeEx, xrefs: 0042EFB3
VarBstrFromCy, xrefs: 0042F155

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 51ba0cccc0257aa61a896f7588f8220aaff411b585e609356873e0dfdd144972
Instruction ID: 4d8a8b603ccf47e63391c59ab7cad31be334c78caf3acb6b5dd0fd78b8a56fbb
Opcode Fuzzy Hash: 51ba0cccc0257aa61a896f7588f8220aaff411b585e609356873e0dfdd144972
Instruction Fuzzy Hash: 15412761708239AA53046B6FBE0146677F8EA567103E1C4BBB404CBA69DB3CBC89573D

Function 004E5CEC Relevance: 37.7, APIs: 25, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 004E5D2F
SelectObject.GDI32(?,?), ref: 004E5D44
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029,00000000,004E5DB4,?,?), ref: 004E5D88
SelectObject.GDI32(?,?), ref: 004E5DA2
DeleteObject.GDI32(?), ref: 004E5DAE
CreateCompatibleDC.GDI32(00000000), ref: 004E5DC2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 004E5DE3
SelectObject.GDI32(?,?), ref: 004E5DF8
SelectPalette.GDI32(?,03080DD1,00000000), ref: 004E5E0C
SelectPalette.GDI32(?,?,00000000), ref: 004E5E1E
SelectPalette.GDI32(?,00000000,000000FF), ref: 004E5E33
SelectPalette.GDI32(?,03080DD1,000000FF), ref: 004E5E49
RealizePalette.GDI32(?), ref: 004E5E55
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 004E5E77
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 004E5E99
SetTextColor.GDI32(?,00000000), ref: 004E5EA1
SetBkColor.GDI32(?,00FFFFFF), ref: 004E5EAF
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 004E5EDB
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 004E5F00
SetTextColor.GDI32(?,?), ref: 004E5F0A
SetBkColor.GDI32(?,?), ref: 004E5F14
SelectObject.GDI32(?,00000000), ref: 004E5F27
DeleteObject.GDI32(?), ref: 004E5F30
SelectPalette.GDI32(?,00000000,00000000), ref: 004E5F52
DeleteDC.GDI32(?), ref: 004E5F5B

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: d926cea88b54c98c5f8c33fd5aa36f3efbb0280da2e4b50b368c8efec4318bb5
Instruction ID: 9ef0841ecd8e06ff8f84fa962cf4055aa40bf1e693f84d78164795f68e0e85cf
Opcode Fuzzy Hash: d926cea88b54c98c5f8c33fd5aa36f3efbb0280da2e4b50b368c8efec4318bb5
Instruction Fuzzy Hash: 9B8193B2A00209AFDB50DEA9CC85EEF7BEDAB0D715F100559F618E7240C238AE408B65

Function 004EB140 Relevance: 31.7, APIs: 21, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 004EB163
GetDC.USER32(00000000), ref: 004EB191
CreateCompatibleDC.GDI32(?), ref: 004EB1A2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004EB1BD
SelectObject.GDI32(?,00000000), ref: 004EB1D7
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 004EB1F9
CreateCompatibleDC.GDI32(?), ref: 004EB207
SelectObject.GDI32(00000000,00000000), ref: 004EB24F
SelectPalette.GDI32(00000000,?,00000000), ref: 004EB262
RealizePalette.GDI32(00000000), ref: 004EB26B
SelectPalette.GDI32(?,?,00000000), ref: 004EB277
RealizePalette.GDI32(?), ref: 004EB280
SetBkColor.GDI32(00000000,00000000), ref: 004EB28A
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 004EB2AE
SetBkColor.GDI32(00000000,00000000), ref: 004EB2B8
SelectObject.GDI32(00000000,00000000), ref: 004EB2CB
DeleteObject.GDI32(00000000), ref: 004EB2D7
DeleteDC.GDI32(00000000), ref: 004EB2ED
SelectObject.GDI32(?,00000000), ref: 004EB308
DeleteDC.GDI32(00000000), ref: 004EB324
ReleaseDC.USER32(00000000,00000000), ref: 004EB335

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 12377b0042ab6e2186f72ca2209710d3867943cee396a54fa97a17432a339029
Instruction ID: a297371bd76699a261ad6334b1a26cfdb4486747052644e0b66a5fa1a439e62f
Opcode Fuzzy Hash: 12377b0042ab6e2186f72ca2209710d3867943cee396a54fa97a17432a339029
Instruction Fuzzy Hash: 1E51FF72E00355BBDB10DAEACC56FEFB7BCEF09705F10445AB614E7281D6789A408B94

Function 004EC71C Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 357windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EC9A4
CreateCompatibleDC.GDI32(00000001), ref: 004ECA09
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 004ECA1E
SelectObject.GDI32(?,00000000), ref: 004ECA28
SelectPalette.GDI32(?,?,00000000), ref: 004ECA58
RealizePalette.GDI32(?), ref: 004ECA64
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 004ECA88
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,004ECAE1,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 004ECA96
SelectPalette.GDI32(?,00000000,000000FF), ref: 004ECAC8
SelectObject.GDI32(?,?), ref: 004ECAD5
DeleteObject.GDI32(00000000), ref: 004ECADB

Strings

(, xrefs: 004EC8D2
BM, xrefs: 004EC83D

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: 58cff889bad4eb6068600e16470511e9d3c6de989ab61339c39165482e17afec
Instruction ID: c616a1a90de752524bbdd14157f5dcfa9445539bd7604b4aa4e24f76313b1463
Opcode Fuzzy Hash: 58cff889bad4eb6068600e16470511e9d3c6de989ab61339c39165482e17afec
Instruction Fuzzy Hash: A4E16E70A002589FDF04DFAAC885BAEBBF5FF49305F10856AF904A7391D7389941CB58

Function 004EB698 Relevance: 24.3, APIs: 16, Instructions: 265windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

SelectPalette.GDI32(?,?,000000FF), ref: 004EB6DB
RealizePalette.GDI32(?), ref: 004EB6EA
GetStretchBltMode.GDI32(00000000), ref: 004EB6FC
GetDeviceCaps.GDI32(?,0000000C), ref: 004EB70D
GetDeviceCaps.GDI32(?,0000000E), ref: 004EB71C
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C,00000000), ref: 004EB74F
SetStretchBltMode.GDI32(?,00000004), ref: 004EB75D
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C,00000000), ref: 004EB775
SetStretchBltMode.GDI32(00000000,00000003), ref: 004EB792
CreateCompatibleDC.GDI32(00000000), ref: 004EB7F3
SelectObject.GDI32(?,?), ref: 004EB808
SelectObject.GDI32(?,00000000), ref: 004EB867
DeleteDC.GDI32(00000000), ref: 004EB876

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$ModePaletteSelectStretch$BrushCreateObject$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 28117789-0
Opcode ID: 230a5d8b8307ea4118e7af7672871789c69a95fa8ce89b2824e3c90030dde8aa
Instruction ID: 489584e9c4cd725b990482e09af51c0bca80148c9d3d35cd6fb0d49a7a8e8351
Opcode Fuzzy Hash: 230a5d8b8307ea4118e7af7672871789c69a95fa8ce89b2824e3c90030dde8aa
Instruction Fuzzy Hash: 76A1D8B1600245AFDB40EFAAC985F9AB7E8EF08305F504559F605E7652D738ED40CBA4

Function 005094F4 Relevance: 22.7, APIs: 6, Strings: 9, Instructions: 217COMMON

Download Yara Rule

Strings

BTMemoryLoadLibary: dll dos header is not valid, xrefs: 0050953C
Q, xrefs: 00509537, 0050957C, 005095D3, 005096BB, 005096CA, 00509708, 00509733
BTMemoryLoadLibary: Get DLLEntyPoint failed, xrefs: 0050970D
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid, xrefs: 00509581
MZ, xrefs: 0050952F
PE, xrefs: 00509570
BTMemoryLoadLibary: VirtualAlloc failed, xrefs: 005095D8
BTMemoryLoadLibary: BuildImportTable failed, xrefs: 005096C0
BTMemoryLoadLibary: Can't attach library, xrefs: 00509738

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: BTMemoryLoadLibary: BuildImportTable failed$BTMemoryLoadLibary: Can't attach library$BTMemoryLoadLibary: Get DLLEntyPoint failed$BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid$BTMemoryLoadLibary: VirtualAlloc failed$BTMemoryLoadLibary: dll dos header is not valid$MZ$PE$Q
API String ID: 0-1835101375
Opcode ID: 026aab04b6424d41126d101af9ba600e8763032157b3ce281d2c5bc560554c5e
Instruction ID: 000319917d59fcf878daeedc43a51531e06e7e960508893f52dfaa3799957b49
Opcode Fuzzy Hash: 026aab04b6424d41126d101af9ba600e8763032157b3ce281d2c5bc560554c5e
Instruction Fuzzy Hash: 2B718A75B08205AFDB15DFA9DC81BAEBBE9EB89300F0084A9F504E7386DA74DD058B54

Function 004E5B58 Relevance: 21.1, APIs: 14, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004E5B6F
CreateCompatibleDC.GDI32(00000000), ref: 004E5B79
GetObjectW.GDI32(?,00000018,?), ref: 004E5B99
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004E5BB0
GetDC.USER32(00000000), ref: 004E5BBC
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004E5BE9
ReleaseDC.USER32(00000000,00000000), ref: 004E5C0F
SelectObject.GDI32(?,?), ref: 004E5C2A
SelectObject.GDI32(?,00000000), ref: 004E5C39
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 004E5C65
SelectObject.GDI32(?,00000000), ref: 004E5C73
SelectObject.GDI32(?,00000000), ref: 004E5C81
DeleteDC.GDI32(?), ref: 004E5C97
DeleteDC.GDI32(?), ref: 004E5CA0

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: aef1841c4e128ff32c9b36ede18983638337cbd9838766df907cc8eb69374be7
Instruction ID: 17c9c49937640a7ee63a15ab90711d013368aaab887e413720973401a1c3c297
Opcode Fuzzy Hash: aef1841c4e128ff32c9b36ede18983638337cbd9838766df907cc8eb69374be7
Instruction Fuzzy Hash: 3D410C72E40754BFDB10EAE9C952FAFB7BCAB09705F50045AB600E7281D6789A4087A4

Function 004EB964 Relevance: 19.8, APIs: 13, Instructions: 255windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

SelectPalette.GDI32(?,?,000000FF), ref: 004EB9A7
RealizePalette.GDI32(?), ref: 004EB9B6
GetDeviceCaps.GDI32(?,0000000C), ref: 004EB9C8
GetDeviceCaps.GDI32(?,0000000E), ref: 004EB9D7
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 004EBA0A
SetStretchBltMode.GDI32(?,00000004), ref: 004EBA18
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 004EBA30
SetStretchBltMode.GDI32(00000000,00000003), ref: 004EBA4D
CreateCompatibleDC.GDI32(00000000), ref: 004EBAAE
SelectObject.GDI32(?,?), ref: 004EBAC3
SelectObject.GDI32(?,00000000), ref: 004EBB22
DeleteDC.GDI32(00000000), ref: 004EBB31

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: cd1fa1e0ecb1de98fa74186667cffcb93663ecd76ac09dee35a8bf4f5781b3c6
Instruction ID: 7ad90294f0dfa4864f0bea30e35c96d4e1fa41525923fe95d334a894f78dac22
Opcode Fuzzy Hash: cd1fa1e0ecb1de98fa74186667cffcb93663ecd76ac09dee35a8bf4f5781b3c6
Instruction Fuzzy Hash: 54912971604245AFDB50DFAAC981F9FBBE8AB08305F10455AF505E7651D738ED40CBA4

Function 004EE9A8 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsEqualGUID.OLE32(?,?), ref: 004EE9B4
IsEqualGUID.OLE32(?,00512700), ref: 004EE9D5
IsEqualGUID.OLE32(?,00512710), ref: 004EE9EB

Strings

0'Q, xrefs: 004EEA10
@'Q, xrefs: 004EEA26
'Q, xrefs: 004EE9FA
P'Q, xrefs: 004EEA3C

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Equal
String ID: 'Q$0'Q$@'Q$P'Q
API String ID: 4016716531-2080303212
Opcode ID: 910d10efe8b6ce12eb182f7a0428389f332f0c3d9b0304f790f2e4746874814d
Instruction ID: 20151e35af89753a34490d08d14bce8ff8fff53931f03d45fc67b9aa9c7eeaed
Opcode Fuzzy Hash: 910d10efe8b6ce12eb182f7a0428389f332f0c3d9b0304f790f2e4746874814d
Instruction Fuzzy Hash: E71178710085849EDB61DB2BED80AB72B5D6F5A305F04509BFD844F243D39D484A876E

Function 00425DC8 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 199threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408850: GetTickCount.KERNEL32 ref: 00408887
Part of subcall function 00408850: GetTickCount.KERNEL32 ref: 0040889F

Part of subcall function 00425334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

GetThreadLocale.KERNEL32(00000000,00000004), ref: 00425E60
EnumCalendarInfoW.KERNEL32(00425C8C,00000000,00000000,00000004), ref: 00425E6B
GetThreadLocale.KERNEL32(00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425EA6
EnumCalendarInfoW.KERNEL32(00425D30,00000000,00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425EB1
GetThreadLocale.KERNEL32(00000000,00000004), ref: 00425F42
EnumCalendarInfoW.KERNEL32(00425C8C,00000000,00000000,00000004), ref: 00425F4D
GetThreadLocale.KERNEL32(00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425F8A
EnumCalendarInfoW.KERNEL32(00425D30,00000000,00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425F95

Strings

B.C., xrefs: 00425EF0
[B, xrefs: 00425E21, 00425EDD, 00426014

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.$[B
API String ID: 1601775584-1960173975
Opcode ID: e40e9ab9cf9b4c6e49e3745789ea4f322e936ade47d61e4d3ee6c26c34c542ee
Instruction ID: 696a8cbb88cbf135683503293481ae752516e7a6c47e6b4c93b3b9376ce1ac3d
Opcode Fuzzy Hash: e40e9ab9cf9b4c6e49e3745789ea4f322e936ade47d61e4d3ee6c26c34c542ee
Instruction Fuzzy Hash: 9761F570B006129FE710EF69E885AAA77E5EF44724B51857EF400EB3E1C738AD41DB98

Function 004ED7A0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 258windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004ED0C0: DeleteObject.GDI32(00000000), ref: 004ED206

DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004ED865
GetDIBits.GDI32(00000000,00000000,00000000,00000000,?,?), ref: 004ED8E3
GetIconInfo.USER32(00000000,?), ref: 004ED947
GetDIBits.GDI32(00000000,?,00000000,00000000,?,00000000,?), ref: 004ED980
SetDIBits.GDI32(00000000,00000000,?,00000000,?,00000000,004EDA2B), ref: 004ED9E9
DeleteObject.GDI32(?), ref: 004ED9FF
DeleteObject.GDI32(?), ref: 004EDA08

Strings

, xrefs: 004ED890
,, xrefs: 004ED86A

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: BitsDeleteObject$Icon$DrawInfo
String ID: $,
API String ID: 1810795657-71045815
Opcode ID: 0c5187b6c173e4ec8a62df78b25059c000a8f0dee15bd527dab433ee5dea9988
Instruction ID: 3b15df45811348dce314f71d9fb3896dfd83895a50164542f8512fd99f32aa23
Opcode Fuzzy Hash: 0c5187b6c173e4ec8a62df78b25059c000a8f0dee15bd527dab433ee5dea9988
Instruction Fuzzy Hash: F4913871B00145AFD700EFAAC885A9EBBF9FF48305F6041AAF505EB251DA34ED45CB94

Function 004253AC Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,00425691,?,?,?,?,00000000,00000000), ref: 004253D3
GetThreadLocale.KERNEL32(?,00000001,00000000,00425691,?,?,?,?,00000000,00000000), ref: 004253DC

Part of subcall function 00425380: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,00425482,?,00000001,00000000,00425691), ref: 00425393

Part of subcall function 00425334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

Strings

mmmm d, yyyy, xrefs: 00425502
:mm:ss, xrefs: 00425644
AMPM, xrefs: 0042560A
AMPM , xrefs: 00425619
m/d/yy, xrefs: 004254DD
:mm, xrefs: 00425629
2, xrefs: 0042566D

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: ecbc7d69b4f11c979955816f9b11cd38cc839c94d643873308f8a088d78fbf3d
Instruction ID: ae11f37f10c7c7cc2ece4aa2851bd9592c5e3db29736d4fa45ff2483457f4832
Opcode Fuzzy Hash: ecbc7d69b4f11c979955816f9b11cd38cc839c94d643873308f8a088d78fbf3d
Instruction Fuzzy Hash: 597122307005699BDB01EBA5E881ADE72A6DF84344FD0807BF904EB646DB3CDE16879D

Function 004266A0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004264A8: VirtualQuery.KERNEL32(?,?,0000001C,00000000,00426654), ref: 004264DB
Part of subcall function 004264A8: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004264FF
Part of subcall function 004264A8: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0042651A
Part of subcall function 004264A8: LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 004265B5

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,004267C5), ref: 00426701
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00426734
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00426746
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0042674C
GetStdHandle.KERNEL32(000000F4,004267E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 00426760
WriteFile.KERNEL32(00000000,000000F4,004267E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00426766
LoadStringW.USER32(00000000,0000FFEC,?,00000040), ref: 0042678A
MessageBoxW.USER32(00000000,?,?,00002010), ref: 004267A4

Strings

tfB, xrefs: 00426711, 004267B9

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: tfB
API String ID: 135118572-130872579
Opcode ID: 53370dbc22c51bc763ce5d6ae76ca78748e253c1498e84ef0533850a9c2449d9
Instruction ID: 2fee535d3888c4169f5bd1f234f159aa2942923c4c0afb6fb1cfc7f5ec0a3504
Opcode Fuzzy Hash: 53370dbc22c51bc763ce5d6ae76ca78748e253c1498e84ef0533850a9c2449d9
Instruction Fuzzy Hash: 6D3184B5744218BFEB10EB65DC83FDA73BCEB04704F9041A6B604E61D1DA78AE84876C

Function 004E4AC0 Relevance: 15.2, APIs: 10, Instructions: 228windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E4780
Part of subcall function 004E4778: LeaveCriticalSection.KERNEL32(0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E478D
Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(?,0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870), ref: 004E4796

CreateCompatibleDC.GDI32(00000000), ref: 004E4B64
SelectObject.GDI32(?,?), ref: 004E4B74
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00CC0020), ref: 004E4C70
SetTextColor.GDI32(?,00000000), ref: 004E4C7E
SetBkColor.GDI32(?,00FFFFFF), ref: 004E4C92
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00E20746), ref: 004E4CC5
SetTextColor.GDI32(?,?), ref: 004E4CD5
SetBkColor.GDI32(?,?), ref: 004E4CE5
SelectObject.GDI32(?,00000000), ref: 004E4D15
DeleteDC.GDI32(?), ref: 004E4D1E

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Color$CriticalSection$EnterObjectSelectStretchText$CompatibleCreateDeleteLeave
String ID:
API String ID: 675119849-0
Opcode ID: 17a9f5c396fd801cce45f3af1a2c03a7e908330b3a1013798d2b0e4747143bd7
Instruction ID: 71bf14b9f78042d93af0d274de238ac5bd12102c0260bb26fb2fcf8b95af7db9
Opcode Fuzzy Hash: 17a9f5c396fd801cce45f3af1a2c03a7e908330b3a1013798d2b0e4747143bd7
Instruction Fuzzy Hash: EE919375A00248AFCB40DFAAC981E9EBBF9EF4D315B10449AF505EB661C734EE41CB64

Function 004085C8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 004085DD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004085E3
GetLogicalProcessorInformation.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 004085F6
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 004085FF
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,00408676,?,00000000,?,GetLogicalProcessorInformation), ref: 0040862A

Strings

kernel32.dll, xrefs: 004085D8
@, xrefs: 0040867D
GetLogicalProcessorInformation, xrefs: 004085D3

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: 9b6de5aca907aff7f49779a1cb565253b723d78320fe21404139914b83ab067e
Instruction ID: 500c6e41f31b7fdb6d34238680861789b78f08bdeabe16a24c436e355b3d89bb
Opcode Fuzzy Hash: 9b6de5aca907aff7f49779a1cb565253b723d78320fe21404139914b83ab067e
Instruction Fuzzy Hash: E0116370D00208AADB10EBA5CA05B5EB7A4DF04304F1288BFE854B72C1DA7E8E508E59

Function 00410594 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0041064C

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 01433c88fba5b4f775e71df606895a677a3445a2bc368d898035e78ffffcbf29
Instruction ID: 0ce41ded5bccfca64fbac36b7d610e41f84856dd8e2a7bbc42b78d3b128abe8f
Opcode Fuzzy Hash: 01433c88fba5b4f775e71df606895a677a3445a2bc368d898035e78ffffcbf29
Instruction Fuzzy Hash: 0CA19075A013099FDB20DFA8D881BEEB7B5FF58310F14812AE915A7390DBB4A9C4CB54

Function 00430A54 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00430AED
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00430B09
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 00430B42
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00430BBF
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 00430BD8
VariantCopy.OLEAUT32(?), ref: 00430C0D

Strings

, xrefs: 00430A6E

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction ID: c5ac3e0bb315912875ce6d6a8b12eb4200af54bb65bf5f77a9b42e84e07fd96b
Opcode Fuzzy Hash: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction Fuzzy Hash: 2C51227590022D9BCB25DB59CC91BDAB3BCAF4C304F0052DAF548E7252D634AF848F65

Function 004E9A04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 004E9AA6
MulDiv.KERNEL32(?,000009EC,00000000), ref: 004E9AC3
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004E9AEF
GetEnhMetaFileHeader.GDI32(00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004E9B0F
DeleteEnhMetaFile.GDI32(00000016), ref: 004E9B30
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 004E9B43

Strings

`, xrefs: 004E9A8B

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: 1bc734305bfd0bdb724ca875092e956d4852018e6443de175511f346f92c27bf
Instruction ID: e4881d64baec76ee9eafe246b21c5bc9d5a9281d976d74d65e8b275913b0d6f5
Opcode Fuzzy Hash: 1bc734305bfd0bdb724ca875092e956d4852018e6443de175511f346f92c27bf
Instruction Fuzzy Hash: 8A412275D00248AFDB40DFA9C881AAEB7F9FF48711F50816AF904EB241E7389E40CB64

Function 004061E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 00406206
WriteFile.KERNEL32(00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 0040620C
GetStdHandle.KERNEL32(000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 0040622B
WriteFile.KERNEL32(00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 00406231
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?), ref: 00406248
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000), ref: 0040624E

Strings

TS@, xrefs: 00406218, 00406223

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: TS@
API String ID: 3320372497-1941835897
Opcode ID: 773f2b01c096205ed1640b90909cb80b96b374e64d656fdce13fcbbb072e403a
Instruction ID: 82cfcf8d63e4733cb96d407babe502fa205990dff362196b090b8b3cf9cfd937
Opcode Fuzzy Hash: 773f2b01c096205ed1640b90909cb80b96b374e64d656fdce13fcbbb072e403a
Instruction Fuzzy Hash: 9D0162A16486147DE110F2BA9C8AF6F368CDB18724F10077E7618F60D2C5785C449B7A

Function 0040591C Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 004059D3
Sleep.KERNEL32(0000000A,00000000), ref: 004059E9
Sleep.KERNEL32(00000000), ref: 00405A17
Sleep.KERNEL32(0000000A,00000000), ref: 00405A2D

Strings

@., xrefs: 00405AB4, 00405AD6, 00405BEC, 00405C02

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: @.
API String ID: 3472027048-4201455939
Opcode ID: ada7fe0ad1e969fa1615a2ce2c1f205a77d44d1215cb1e65cc2c198de2b16ae9
Instruction ID: a95b6186faaf28ee99436786a323c89c11953a43e3af36f3f78c15d8c677067a
Opcode Fuzzy Hash: ada7fe0ad1e969fa1615a2ce2c1f205a77d44d1215cb1e65cc2c198de2b16ae9
Instruction Fuzzy Hash: 0DC16972601B118FD725CF28D884367BBA1EB95320F1882BFD4059B3D5C778A849DF88

Function 00405CA0 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00405912), ref: 00405D36
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00405912), ref: 00405D50

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b3bac45a803a588073ab35a9efb47af0939235da5b92122c96ba95b50cef7661
Instruction ID: 4f935fbc936f4d5eb3d08406d1a455a3bc696dbd4939a17767f2164eefdcc051
Opcode Fuzzy Hash: b3bac45a803a588073ab35a9efb47af0939235da5b92122c96ba95b50cef7661
Instruction Fuzzy Hash: 1371D231604B008FE725DB28D888B67BBD4EF95314F14C2BFD844AB3D2D67888459F59

Function 004E6084 Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004E60B2
GetDeviceCaps.GDI32(?,00000068), ref: 004E60CE
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 004E60ED
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 004E6111
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 004E612F
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 004E6143
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 004E6163
ReleaseDC.USER32(00000000,?), ref: 004E617B

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 76daa9d26c080c564ad9041f13802c656f185a4c8ec9210214833560b50aa864
Instruction ID: 253042d8ae561a030da4b25cfcc59df415f83bc43ecdec077c49d488911ed581
Opcode Fuzzy Hash: 76daa9d26c080c564ad9041f13802c656f185a4c8ec9210214833560b50aa864
Instruction Fuzzy Hash: 8F2156B1A40218BADB50DFA5DD86F9EB3BCEB08705F510496F704E71C1D679AF408B28

Function 00405E98 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6090a39ba4113efe279c4ce94d3a27bfd3a3f347abc7f88e99f6aa2524520e12
Instruction ID: 14c4d9104ddc23c6b9370c21b65e9a421d4bec3d23930416dd05d6dcb6f7df23
Opcode Fuzzy Hash: 6090a39ba4113efe279c4ce94d3a27bfd3a3f347abc7f88e99f6aa2524520e12
Instruction Fuzzy Hash: 01C12262710A014BD714AA7D9C8836FB286DBC4325F68823FE645EB3C6DA7CCC458B58

Function 00501CB0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 00501CF9
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 00501D28
SelectObject.GDI32(?,?), ref: 00501D38
DeleteObject.GDI32(?), ref: 00501F51
DeleteDC.GDI32(?), ref: 00501F5D

Strings

|O, xrefs: 00501FB6

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CreateDeleteObject$CompatibleSectionSelect
String ID: |O
API String ID: 2986811175-2178481767
Opcode ID: 9817963ed5f4cc2f2364ac26bd9ac3b368ca35d8fe3561940ec2ced3533d1099
Instruction ID: ce8aac707b3dbeaa7a58b126956c68cb979dc772affd9570816d51a962cff8d2
Opcode Fuzzy Hash: 9817963ed5f4cc2f2364ac26bd9ac3b368ca35d8fe3561940ec2ced3533d1099
Instruction Fuzzy Hash: 11B1C5B5E0060A9FCB04DF99C985AAEBBF5FF48300F2181A5E914A73A1D734AD41CF55

Function 004FC798 Relevance: 10.7, APIs: 7, Instructions: 198windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004FC400: DeleteObject.GDI32(?), ref: 004FC40B
Part of subcall function 004FC400: DeleteDC.GDI32(?), ref: 004FC418
Part of subcall function 004FC400: DeleteObject.GDI32(?), ref: 004FC434

CreateCompatibleDC.GDI32(00000000), ref: 004FC903
CreateHalftonePalette.GDI32(?,00000000), ref: 004FC93E
ResizePalette.GDI32(?,00000001), ref: 004FC973
SelectPalette.GDI32(?,?,00000000), ref: 004FC998
RealizePalette.GDI32(?), ref: 004FC9A3
CreateDIBSection.GDI32(?,-00000474,00000000,-00000450,00000000,00000000), ref: 004FC9CE
SelectObject.GDI32(?,00000000), ref: 004FC9E1

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Palette$CreateDeleteObject$Select$CompatibleHalftoneRealizeResizeSection
String ID:
API String ID: 2525607832-0
Opcode ID: 3b39bf79a773d9044507b5f4a6ba50a4e1458e9f25aaa5a6f7355112836dca1f
Instruction ID: 4ba82757873bb3c143a4d1742f8b993ef62ffc4f5942cec004fa87537f0c0421
Opcode Fuzzy Hash: 3b39bf79a773d9044507b5f4a6ba50a4e1458e9f25aaa5a6f7355112836dca1f
Instruction Fuzzy Hash: E67137756005289FDB04EF19C4D5F6637E5EF0A305F0541E6F2048F3AAC678E84ACB9A

Function 00408850 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408CDC: GetCurrentThreadId.KERNEL32 ref: 00408CDF

GetTickCount.KERNEL32 ref: 00408887
GetTickCount.KERNEL32 ref: 0040889F
GetCurrentThreadId.KERNEL32 ref: 004088CE
GetTickCount.KERNEL32 ref: 004088F9
GetTickCount.KERNEL32 ref: 00408930
GetTickCount.KERNEL32 ref: 0040895A
GetCurrentThreadId.KERNEL32 ref: 004089CA

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 7d0f63ae373317c5f21e857476dc24018feec28cf215cb5a173da7a4db92fdee
Instruction ID: 59fdbd664e4c2a787114e1462c869c0698e504600effbf6fb817d1e717bb5ab3
Opcode Fuzzy Hash: 7d0f63ae373317c5f21e857476dc24018feec28cf215cb5a173da7a4db92fdee
Instruction Fuzzy Hash: BB415E716083419EDB21BE79CA4032BBAD1AB91354F14893FD4D8A73C2EE798881D75B

Function 004EA090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 004EA0E2
MulDiv.KERNEL32(?,?,000009EC), ref: 004EA0F9
GetDC.USER32(00000000), ref: 004EA110
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,004EA1CB,?,00000000,?,?,000009EC,?,?,000009EC), ref: 004EA134
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,004EA1AB,?,?,00000000,00000000,00000008,?,00000000,004EA1CB), ref: 004EA167

Strings

`, xrefs: 004EA0C8

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: b7f937434eb2587f847978740abbd8c81bb9dfc3e5197959b54ccdff63f1a7cc
Instruction ID: 560aeff5e142fb22fc32d70ae3aa060d7ef4d96bf65ee7c2df06f2301dcbdb9f
Opcode Fuzzy Hash: b7f937434eb2587f847978740abbd8c81bb9dfc3e5197959b54ccdff63f1a7cc
Instruction Fuzzy Hash: AD318775A00248ABDB00DFD5C882BEEF7B8EF0D705F514496F904EB281D678AE50D7A9

Function 004EA974 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 004E62F0: GetObjectW.GDI32(00000000,00000004), ref: 004E6307
Part of subcall function 004E62F0: GetPaletteEntries.GDI32(00000000,00000000,?,00000028), ref: 004E632A

GetDC.USER32(00000000), ref: 004EA9B2
CreateCompatibleDC.GDI32(?), ref: 004EA9BE
SelectObject.GDI32(?), ref: 004EA9CB
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,004EAA23,?,?,?,?,00000000), ref: 004EA9EF
SelectObject.GDI32(?,?), ref: 004EAA09
DeleteDC.GDI32(?), ref: 004EAA12
ReleaseDC.USER32(00000000,?), ref: 004EAA1D

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: ec8649657c05e97b9ba1c19bfcd01e8d0b09a6ae33e64875ffb60a9979b168a2
Instruction ID: a90b19bdd86dec3490e2a43e61abe2758ba6d863edaf7bda9a2135b5bf853f90
Opcode Fuzzy Hash: ec8649657c05e97b9ba1c19bfcd01e8d0b09a6ae33e64875ffb60a9979b168a2
Instruction Fuzzy Hash: 54115172E00359BFDB10EFE9C851AEEB7BCEB09705F4044AAF504E7241E6789E5087A4

Function 004098D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?,?,00409AA2,00406F13,00406F5A,?,?), ref: 00409909
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?,?,00409AA2,00406F13,00406F5A,?), ref: 0040990F
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?), ref: 0040992A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E), ref: 00409930

Strings

Runtime error at 00000000, xrefs: 00409902, 00409947
Error, xrefs: 00409942

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 1f536b54c0f7e54d54e2ef4696db32368710aa63d846f2239d9123bcbb9aa4c9
Instruction ID: 1cafd5f0b55deffaaa1a260c41e3c473f996b032a313f4f96ee96a2a81eb749b
Opcode Fuzzy Hash: 1f536b54c0f7e54d54e2ef4696db32368710aa63d846f2239d9123bcbb9aa4c9
Instruction Fuzzy Hash: FBF04491A4134479FA3077A55C56F6F2B589704B18F18893FB650782D3CAB84C889766

Function 004E65E0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 004E662E
GetSystemMetrics.USER32(0000000C), ref: 004E663A
GetDC.USER32(00000000), ref: 004E6656
GetDeviceCaps.GDI32(00000000,0000000E), ref: 004E667D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004E668A
ReleaseDC.USER32(00000000,00000000), ref: 004E66C3

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 514544e9451769a20b0d63ec12d45414229ecaa25948937d2ba282ff4bb2ffa2
Instruction ID: 4016dc568379c8c19e12672c107d27f7e339e6f7b848dc7462e147759cb92e24
Opcode Fuzzy Hash: 514544e9451769a20b0d63ec12d45414229ecaa25948937d2ba282ff4bb2ffa2
Instruction Fuzzy Hash: BA318474E00244EFEB00DFA6C841AAEBBB5FF49751F11856AF414AB384C6749D41CB65

Function 004E6234 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004E6252
SelectObject.GDI32(00000000,00000000), ref: 004E625B
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,?,00000000,?,?,004EC367), ref: 004E626F
SelectObject.GDI32(00000000,00000000), ref: 004E627B
DeleteDC.GDI32(00000000), ref: 004E6281
CreatePalette.GDI32 ref: 004E62DC

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: 7562e105f237616201ae257fa9036799e28e0c389752a133ae9929039913ccec
Instruction ID: 340cc0428f8d1b704eb02a17b4838aecf4abac5ba2e172b2ebb1ae9e933cb0ba
Opcode Fuzzy Hash: 7562e105f237616201ae257fa9036799e28e0c389752a133ae9929039913ccec
Instruction Fuzzy Hash: 2911063120434022E210BB679C43BAB72A8DFD575AF01C52FF649D7382E67C8D49439E

Function 004E6A9C Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E6950: GetObjectW.GDI32(?,00000054), ref: 004E6964

CreateCompatibleDC.GDI32(00000000), ref: 004E6ABE
SelectPalette.GDI32(?,?,00000000), ref: 004E6ADF
RealizePalette.GDI32(?), ref: 004E6AEB
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 004E6B02
SelectPalette.GDI32(?,00000000,00000000), ref: 004E6B2A
DeleteDC.GDI32(?), ref: 004E6B33

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: 9dbd0a09d7bff179ba26f2c840b696ab711f6e12a27d33c9ec649e9677f75141
Instruction ID: ce5ef7bc2b447eaaf5ad7ea58a7014afe3a29db5ee430c20c38cefb41b0ea7be
Opcode Fuzzy Hash: 9dbd0a09d7bff179ba26f2c840b696ab711f6e12a27d33c9ec649e9677f75141
Instruction Fuzzy Hash: EF114275E403047FDB10DFAA8C42F9EBBEDDB49701F51806AB514E7281D678AE408768

Function 004EEBA4 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

SetDIBits.GDI32(00000000,00000000), ref: 004EECF4

Strings

p'Q, xrefs: 004EEC33
,, xrefs: 004EEC6A
, xrefs: 004EEC8B
pN, xrefs: 004EEC15, 004EED49

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,$p'Q$pN
API String ID: 3573556081-239200797
Opcode ID: 3146448c29a5267273b5e1d6cef1f92d1d1f3eb03af883d51033a66525d253fe
Instruction ID: 1e54a06a1e95e94ba1a65037bf0ed17888ccc8f38b9ad7b73d83704f2355172f
Opcode Fuzzy Hash: 3146448c29a5267273b5e1d6cef1f92d1d1f3eb03af883d51033a66525d253fe
Instruction Fuzzy Hash: 8651C074A00208AFDB40DF9AD881E9EB7F9FB48314F5181A6F914EB362D735AE44CB54

Function 004EE3C8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

GetDIBits.GDI32(00000000,00000000,00000000,?,?,0000002C,00000000), ref: 004EE4B2

Strings

,, xrefs: 004EE468
p'Q, xrefs: 004EE3FB
`'Q, xrefs: 004EE40A
, xrefs: 004EE483

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,$`'Q$p'Q
API String ID: 3573556081-2603654308
Opcode ID: 42b49852a6c059686f70261b7c1b5614e6ac850c4d35c3e5e38e0dda175fe21e
Instruction ID: 7dffdbb38bb168055dc73683a78424d275a6f5c6279662ade84370ffcc63c4ed
Opcode Fuzzy Hash: 42b49852a6c059686f70261b7c1b5614e6ac850c4d35c3e5e38e0dda175fe21e
Instruction Fuzzy Hash: 9F4155B1A00104AFDB40DF6AC885A9A77F9FF09318B2141A6FC04EB356D775ED45CB94

Function 004264A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00426654), ref: 004264DB
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004264FF
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0042651A
LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 004265B5

Strings

MZP, xrefs: 00426519

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: 9d6add118e4e8414791f245c42018ec3a7e548b569db00738a6d801e4d88121c
Instruction ID: 6bd50542f63c29d3254cd85bcaf85244e765c7bfaa2bd12f09b9b5e59819b565
Opcode Fuzzy Hash: 9d6add118e4e8414791f245c42018ec3a7e548b569db00738a6d801e4d88121c
Instruction Fuzzy Hash: AF415170A002289FDB20DF65DC81BC9B7F9AB59304F8140EAE508E7241D7799E948F59

Function 004ED0C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004ED17C
CreateHalftonePalette.GDI32(00000000,00000000), ref: 004ED189
ReleaseDC.USER32(00000000,00000000), ref: 004ED198
DeleteObject.GDI32(00000000), ref: 004ED206

Strings

(, xrefs: 004ED133

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CreateDeleteHalftoneObjectPaletteRelease
String ID: (
API String ID: 577518360-3887548279
Opcode ID: 709b07984c9d5aa3bd38b67693ada89a75e7f84293946e09d557a8f39a1a4486
Instruction ID: 8cdd9680a7724fdad575afc561e1f2c7bb06fb3b539269e5054995d0d95929bc
Opcode Fuzzy Hash: 709b07984c9d5aa3bd38b67693ada89a75e7f84293946e09d557a8f39a1a4486
Instruction Fuzzy Hash: 1341BE70E04248AFCB10DFA6C885ADEFBB5EF49305F1480AAE404AB351D7789A45DB99

Function 004B7154 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004B722A,?,?,004B5444,00000001), ref: 004B71CC
GetCurrentThread.KERNEL32 ref: 004B7204
GetCurrentThreadId.KERNEL32 ref: 004B720C

Strings

BnK, xrefs: 004B7221, 004B71D1, 004B71DB
pDA, xrefs: 004B71EB

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CurrentThread$ErrorLast
String ID: BnK$pDA
API String ID: 4172138867-3175749474
Opcode ID: daa02272e5fee77470c674822105215f1e84114ca22350b49d75c226eb007105
Instruction ID: a3e0ae559b31ed47dc59385f5b02629c22696de2c4cef8aa035d475b9da624f8
Opcode Fuzzy Hash: daa02272e5fee77470c674822105215f1e84114ca22350b49d75c226eb007105
Instruction Fuzzy Hash: 0C212B709086456ED701DFB5CC817EABBE4BF89304F4485BBE42497782DB389815C7B9

Function 0043690C Relevance: 7.8, APIs: 5, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b1296c92a046bb743362478882edb4bed3443ecb9e909bca9af9b7118eca8f6
Instruction ID: 8d3459a469465bc4371695b4e367a65a38b978d34797e4c4e50731b7cb5a1aca
Opcode Fuzzy Hash: 9b1296c92a046bb743362478882edb4bed3443ecb9e909bca9af9b7118eca8f6
Instruction Fuzzy Hash: AFD1C235A00209AFCF00EF95C4918EEFBB9EF0D310F5590A6E840A7251D638AE46DB79

Function 004F0894 Relevance: 7.6, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000038), ref: 004F08C0
memcpy.MSVCRT(00000000,00000000,000016C4), ref: 004F08F3
memcpy.MSVCRT(00000000,?,?), ref: 004F0989
memcpy.MSVCRT(00000000,?,?), ref: 004F099F
memcpy.MSVCRT(00000000,?,?), ref: 004F09B5
memcpy.MSVCRT(00000000,?,?), ref: 004F09C9

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction ID: bcd7db05d191351e9405a97d2655ef30d3ed96d280d6279a09f2b3dd0a47b8f8
Opcode Fuzzy Hash: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction Fuzzy Hash: 965175B1600200AFDB14CF69CCC5E6677A8BF88314F08827AEE098F346E735E944CB94

Function 004EC31C Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EC372
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction ID: 76c421ad3c698b7ff88da0f61c3aa7df07cb2880bcd4f869b6d47c825d99da29
Opcode Fuzzy Hash: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction Fuzzy Hash: 3D11D3315012D9AEEB20AF27C481BEF3B94AF55357F04505BFC005A281D7BC8DA2C7A9

Function 004E619C Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004E61B4
GetDeviceCaps.GDI32(?,00000068), ref: 004E61D0
GetPaletteEntries.GDI32(03080DD1,00000000,00000008,?), ref: 004E61E8
GetPaletteEntries.GDI32(03080DD1,00000008,00000008,?), ref: 004E6200
ReleaseDC.USER32(00000000,?), ref: 004E621C

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: e2e0119970b46360f4dbaca9755fcc1ef81ad606db22181b8a12d53334abd375
Instruction ID: fb62e25858754de89261d63ddcf899fc845c4e56b322bcc1c3ebe9d0414cdd2c
Opcode Fuzzy Hash: e2e0119970b46360f4dbaca9755fcc1ef81ad606db22181b8a12d53334abd375
Instruction Fuzzy Hash: 191108716483447EEB00DFA6EC42FA97FACE719706F40849BF204DA1C1DABA5544C324

Function 0040904A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(?,00000000), ref: 0040911E

Strings

hsB, xrefs: 004090F7
,qB, xrefs: 0040906B

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: ,qB$hsB
API String ID: 3192549508-2187915683
Opcode ID: 1700f64120af452dff93675b6e54fdb508242944783359e32faae08426496f92
Instruction ID: 7df4318895a31e83b2a36aa030ba475ccd5b90e95bae95c0b52881597b1f7c6e
Opcode Fuzzy Hash: 1700f64120af452dff93675b6e54fdb508242944783359e32faae08426496f92
Instruction Fuzzy Hash: 834196717042029FE720DF14C888B6BB7E5EB85314F15857AE448AB393C739EC45CB59

Function 00508BB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 00508BFD
VirtualProtect.KERNEL32(?,?,?,?,?), ref: 00508C82

Strings

Q, xrefs: 00508C8B
FinalizeSections: VirtualProtect failed, xrefs: 00508C90

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID: FinalizeSections: VirtualProtect failed$Q
API String ID: 2581862158-2157760199
Opcode ID: 5b9ce3603e1f06b0cc2f71a78788117888607f07353cb78b5fee8d3d13493d47
Instruction ID: 9853b7ae0d98e4b03c66dd04b799e9e921a3f981399b1d975435f4a8c9b352d0
Opcode Fuzzy Hash: 5b9ce3603e1f06b0cc2f71a78788117888607f07353cb78b5fee8d3d13493d47
Instruction Fuzzy Hash: F73116746022059FE710DB58C989FA9BBF8BB48354F154584FAA4DF3E2CB30ED408BA0

Function 00423C28 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,00423D0B), ref: 00423CAE
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,00423D0B), ref: 00423CB4

Strings

, xrefs: 00423C7A
yyyy, xrefs: 00423C89

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 0809fa2659c157af8da77a48e90bfea0ac0ad0ed8c95e6ae3a57ad6ba9429efe
Instruction ID: 4198a1d351d31b9a86c79895a928489856ad1452b39a35c365c2990c697424f4
Opcode Fuzzy Hash: 0809fa2659c157af8da77a48e90bfea0ac0ad0ed8c95e6ae3a57ad6ba9429efe
Instruction Fuzzy Hash: F4217F35A046289BDB10EF95D842AAEB3F8EF08701F91406BF905F7281D63C9F00C76A

Function 0042D69C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(0041F85C,00000001), ref: 0042D6B8
GetCPInfo.KERNEL32(0042D79C,0042C1C5,0041F85C,00000001), ref: 0042D6D9

Strings

\A, xrefs: 0042D6EA
$CA, xrefs: 0042D6E2

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Info
String ID: $CA$\A
API String ID: 1807457897-218779800
Opcode ID: 5eeed4a1fe1997d1979fd9be693cba12f47eb0a3d5b140c4eb6e39407f1a236c
Instruction ID: 3f161ca63d9b70b18435ca805e2739cb9bbe25dfc1e96fa5ecbc0a11a2866f3f
Opcode Fuzzy Hash: 5eeed4a1fe1997d1979fd9be693cba12f47eb0a3d5b140c4eb6e39407f1a236c
Instruction Fuzzy Hash: EF01C471A00A158FC720EF69A981997B7E4AF05364700852FEC99C7351EA3999048BA9

Function 004E3964 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,004E3BCC), ref: 004E39AC
LeaveCriticalSection.KERNEL32(?,004E3BA3,?,00000000,004E3BCC), ref: 004E3B96

Strings

Default, xrefs: 004E3A5A
-Q, xrefs: 004E3A80

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Default$-Q
API String ID: 3168844106-3821686248
Opcode ID: 1a1d0b3d7fef57fbd369e5ba3f48b81e015b8509224f28914d8de7d590d176ed
Instruction ID: 19d7f923896caa44bc4d2895c7d959a39db7ed687c0c5984d3f2fc8e9670fb4e
Opcode Fuzzy Hash: 1a1d0b3d7fef57fbd369e5ba3f48b81e015b8509224f28914d8de7d590d176ed
Instruction Fuzzy Hash: BA519470A083589FDB02DFA9C845AEEBBF5FF48305F51446AE404A7352D778AE44CB14

Function 004E3ED0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000000,00000000), ref: 004E3EF7
GetObjectW.GDI32(?,00000010,?), ref: 004E3F0A
GetObjectW.GDI32(?,00000000,?), ref: 004E3F63

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object
String ID:
API String ID: 2936123098-0
Opcode ID: a40579d9f90c76d0c9fca4423f8c07d8447b4155338eb9add3561dc35ea178ad
Instruction ID: b9ca84249461113418995685c1b411e63f59ddf32e5f5f2b3ba05ad8a3118a75
Opcode Fuzzy Hash: a40579d9f90c76d0c9fca4423f8c07d8447b4155338eb9add3561dc35ea178ad
Instruction Fuzzy Hash: 09319471A047849FD711CF5AC885EAABBF9EF49311F14846EF854DB741D234E9008B64

Function 0040C998 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040C9A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040CA07
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040CA64
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040CA97

Part of subcall function 0040C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040CA15), ref: 0040C96B
Part of subcall function 0040C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040CA15), ref: 0040C988

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: ab0a3fc87b5d274f299d69668d3c9eef21079eaeea860c77a07499101e2d6c50
Instruction ID: 8d1cb3547ee4b9364daa38f1b6dc697d03ddbece5e120c74778344a30482e11a
Opcode Fuzzy Hash: ab0a3fc87b5d274f299d69668d3c9eef21079eaeea860c77a07499101e2d6c50
Instruction Fuzzy Hash: DF313D70A0021E9BDB10DBA9C8C57AFB7B5EF04304F00427AE555E7291DB789A04CB95

Function 004EA788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E4780
Part of subcall function 004E4778: LeaveCriticalSection.KERNEL32(0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E478D
Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(?,0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870), ref: 004E4796

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

CreateCompatibleDC.GDI32(00000000), ref: 004EA7DD
SelectObject.GDI32(00000000,?), ref: 004EA7F6
SelectPalette.GDI32(00000000,?,000000FF), ref: 004EA81F
RealizePalette.GDI32(00000000), ref: 004EA82B

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: e4708b13d4162338c8fa8d9abf0c706dab058b01908a5adb0ec73a38d2e26af5
Instruction ID: 70351cf6032dbd0939f732d494bf93bb1b6777d92977e90662745986a4f58f41
Opcode Fuzzy Hash: e4708b13d4162338c8fa8d9abf0c706dab058b01908a5adb0ec73a38d2e26af5
Instruction Fuzzy Hash: E8310634A00684EFD704EF5AD981D5EB7F5FF48315B6241A6E804AB322C738EE82DB54

Function 004EDF8C Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 004EDFAD
GetObjectW.GDI32(?,00000018,?), ref: 004EDFCE
DeleteObject.GDI32(?), ref: 004EDFFA
DeleteObject.GDI32(?), ref: 004EE003

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: 7a1785c32ae41643537aa2786bfbdbae53e7e625d4899cd26e3bbc34933ba4e6
Instruction ID: 1a97c13f3edbda2b3c1502a7d4827854aa80e6db8bf7018fb0a338cf34cd0894
Opcode Fuzzy Hash: 7a1785c32ae41643537aa2786bfbdbae53e7e625d4899cd26e3bbc34933ba4e6
Instruction Fuzzy Hash: 32119175A00208AFDB00DFABC982C9EB7F9EB48311B1085AAF904D7351DB75EE00DA94

Function 004EEDD0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EEDD9
SelectObject.GDI32(00000000,058A00B4), ref: 004EEDEB
GetTextMetricsW.GDI32(00000000), ref: 004EEDF6
ReleaseDC.USER32(00000000,00000000), ref: 004EEE07

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: 69fa914ca851ee74fc1149395581ca18b64c37d6fa6240ddf4510f1bbda6b75f
Instruction ID: a86a7c8164184303e7b2e3849245c9a5924fc7d8bd12fc902a680fb7c4b12911
Opcode Fuzzy Hash: 69fa914ca851ee74fc1149395581ca18b64c37d6fa6240ddf4510f1bbda6b75f
Instruction Fuzzy Hash: 94E04F626027B032D551666B5D86BDB2A4C4F026ABF480116FD44997D1DA0DCE5083FA

Function 00427150 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00427356), ref: 004271F0
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,0000001C,00000000,00427356), ref: 0042721C

Part of subcall function 0040EDD0: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 0040EE15

Strings

T@A, xrefs: 00427307

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: T@A
API String ID: 902310565-1700159869
Opcode ID: b1904c3b1e25de0c743b57fdaef9e03b7063e3f2f5df921ab3fb199db786710b
Instruction ID: 292cc49da6a1f77817d57b352a36c2b8d2767a536ed26fc9e9afb2df57e86b37
Opcode Fuzzy Hash: b1904c3b1e25de0c743b57fdaef9e03b7063e3f2f5df921ab3fb199db786710b
Instruction Fuzzy Hash: 72510834A08269DFDB10DF69DC88AD9B7F4AF48304F5045EAA808A7351D778AE84CF59

Function 00428748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,0042BB77,00000000,0042BCB7), ref: 00428707

Strings

A, xrefs: 0042875E
Z, xrefs: 00428763

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CharUpper
String ID: A$Z
API String ID: 9403516-4098844585
Opcode ID: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction ID: b9253ecd29e492176c38fe4a03f9f14fb6b287faa95297cdab911eb37b575cf8
Opcode Fuzzy Hash: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction Fuzzy Hash: 431136127466200BE720643FAC817FF958A87C63A4F99023FF505D73C1DC5C8C0142D9

Function 00408F1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00408F8A
UnhandledExceptionFilter.KERNEL32(?,?,?,Function_00008F20), ref: 00408FC7

Strings

hsB, xrefs: 00408F45

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: hsB
API String ID: 3192549508-625297667
Opcode ID: 71af4e390d5abfd6d2040d1b975c0e968029a7204a6687ef051946c3d04c1d81
Instruction ID: a3b05377a8d17e60e07457b386e13646049d2c6927d33ce14a72d1f6f32e6c37
Opcode Fuzzy Hash: 71af4e390d5abfd6d2040d1b975c0e968029a7204a6687ef051946c3d04c1d81
Instruction Fuzzy Hash: 1A3180B0604301AFD720DB24C984F2BB7EAEB88714F14857EF548972A2CB38EC45D719

Function 004D8F38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,004D9018), ref: 004D8FBC
RegCloseKey.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,004D9018), ref: 004D8FD4

Strings

0DA, xrefs: 004D8FEB

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CloseCreate
String ID: 0DA
API String ID: 2932200918-1323616133
Opcode ID: bb97c0676561c50b367f398c45e962b75bcf36dbd0bce4dbaefa2d6a69331ce0
Instruction ID: d53944c613411017ec76b3ffae7557840a5ef6c12a4d2874e33b6d03a67fcfae
Opcode Fuzzy Hash: bb97c0676561c50b367f398c45e962b75bcf36dbd0bce4dbaefa2d6a69331ce0
Instruction Fuzzy Hash: 48215171B04208ABDB11EFA5CC62BAE77F9EB48704F10407BF504E7381EA789E059659

Function 0040945E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006), ref: 0040947F

Strings

hsB, xrefs: 004094B8
ptB, xrefs: 004094DA

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: hsB$ptB
API String ID: 3192549508-579888589
Opcode ID: 6040466f00e2c8a053fbe7c5040ef9d1dac393dd0ce99f32a3ea5679555daf94
Instruction ID: 1c15842ca407df81533eab869cf356bb1e86fa8830085c109665a44f2841b22d
Opcode Fuzzy Hash: 6040466f00e2c8a053fbe7c5040ef9d1dac393dd0ce99f32a3ea5679555daf94
Instruction Fuzzy Hash: 722187742082059BDB24DF29D884B2B7391AB98710F14C53AA845973D7C73CEC46DB59

Function 004E9928 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetEnhMetaFileBits.GDI32(0000006C,?,00000000,004E99F3), ref: 004E99AB

Strings

l, xrefs: 004E9959
EMF, xrefs: 004E994B

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: EMF$l
API String ID: 858000408-2398670571
Opcode ID: c3248d0ab480d3108a0ba36822d6b66260935bb63d396376c0e867e9965ccc25
Instruction ID: d8b59ccd57732e94ff2d5b122cdf495c560b21a665579054683b94a632da62f7
Opcode Fuzzy Hash: c3248d0ab480d3108a0ba36822d6b66260935bb63d396376c0e867e9965ccc25
Instruction Fuzzy Hash: 84217F71A00244DFCB10EFAAC881A6EB7F5FF49714F55426EE405AB786DB38AD01CB58

Function 00433380 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0043338D

Strings

U8C, xrefs: 0043339E
U8C, xrefs: 004333D0

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: U8C$U8C
API String ID: 1927566239-2794899156
Opcode ID: db6a9f75b1a4584b7bc33f5e8f49c8cdb8db5e0e3866a7495bae4b43e4eaed12
Instruction ID: 3718f543713a639fbd9363f2c08326ab3eccad4979a804db5ac30ab2a6f2115c
Opcode Fuzzy Hash: db6a9f75b1a4584b7bc33f5e8f49c8cdb8db5e0e3866a7495bae4b43e4eaed12
Instruction Fuzzy Hash: 1FF0C975E0021DEBCB00DF99D881AEEBBF8FB08310F008156EA54E7350E774AA44CB95

Function 004339A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004339AD

Strings

>C, xrefs: 004339F0
>C, xrefs: 004339BE

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: >C$>C
API String ID: 1927566239-3959820462
Opcode ID: 9431cc45d2050322a4fe7e3993520c2e8b16b55c3dfe581ae8e886489c6d48fe
Instruction ID: f0b58e972ab66ce2c2c386f2ce8a0745796aa178129b7f8f94bba518b5364a4c
Opcode Fuzzy Hash: 9431cc45d2050322a4fe7e3993520c2e8b16b55c3dfe581ae8e886489c6d48fe
Instruction Fuzzy Hash: B9F0EC75E0021DABCB00DF99C881ADFB7F8FB08310F008156EA14E7340E775AA44CB95

Function 004289EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,0050E4DB,00000000,0050E512), ref: 004289F2

Part of subcall function 004139B0: GetProcAddress.KERNEL32(0043C998,?), ref: 004139DA

Strings

GetDiskFreeSpaceExW, xrefs: 004289FD
kernel32.dll, xrefs: 004289ED

Memory Dump Source

Source File: 00000004.00000002.1542029034.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1542012250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542105732.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542122335.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542136604.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542155303.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542171238.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542186936.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542217680.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542232013.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1542246219.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: c7edea2ffbbda9fdc0d07ee16b935c76c2adbbdc0e38b75f3dfa78325f9fbb0d
Instruction ID: 8ccd786351900723a36e45e0a3bb3a683afe0fdfe4abf5b7f5dbba0d790a7421
Opcode Fuzzy Hash: c7edea2ffbbda9fdc0d07ee16b935c76c2adbbdc0e38b75f3dfa78325f9fbb0d
Instruction Fuzzy Hash: 24D05EB07123624AD760ABA1B882B1E2288A320F06F80013FB20145B26CFFD8848534C

Analysis Process: rundll32.exePID: 3488, Parent PID: 6560COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	334
Total number of Limit Nodes:	36

Executed Functions

Function 02B6D2FC Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,02B6D3BC,?,?), ref: 02B6D32E
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,02B6D3BC,?,?), ref: 02B6D337

Part of subcall function 02B6D1C4: FindFirstFileW.KERNEL32(00000000,?,00000000,02B6D222,?,00000001), ref: 02B6D1F7
Part of subcall function 02B6D1C4: FindClose.KERNEL32(00000000,00000000,?,00000000,02B6D222,?,00000001), ref: 02B6D207

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 2b2eeca1165a028a54e0f60a90376487f18b7d7ef4db804bedb6965df259c088
Instruction ID: 0336676b6210bfe0330c6357a11d8d8101ab4d4e0ba7f47a8588e0a87c53ccfb
Opcode Fuzzy Hash: 2b2eeca1165a028a54e0f60a90376487f18b7d7ef4db804bedb6965df259c088
Instruction Fuzzy Hash: D0114F70B042099BDF00EFA4D895ABEB3BAEF48300F5044F5A904E7290DB786E05CE65

Function 02B6D1C4 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,02B6D222,?,00000001), ref: 02B6D1F7
FindClose.KERNEL32(00000000,00000000,?,00000000,02B6D222,?,00000001), ref: 02B6D207

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 7dfcf1251daa01666c1c8433808237b59341d0371ee7ecf14db511de3f8c2e1d
Instruction ID: 0c35f8391bf53b432c5cd52ddf5d05a9ac10d88ccdc7addd6d57f92704e932b6
Opcode Fuzzy Hash: 7dfcf1251daa01666c1c8433808237b59341d0371ee7ecf14db511de3f8c2e1d
Instruction Fuzzy Hash: 0CF08C71644609AEDB20FBB8DC59DBEB7FDEB48710BA005F1B454E3190EB38DE109A64

Function 02B6CDE8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,02B6D00D,?,?), ref: 02B6CE21
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,02B6D00D,?,?), ref: 02B6CE6A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,02B6D00D,?,?), ref: 02B6CE8C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 02B6CEAA
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 02B6CEC8
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 02B6CEE6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 02B6CF04
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,02B6CFF0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,02B6D00D), ref: 02B6CF44
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,02B6CFF0,?,80000001), ref: 02B6CF6F
RegCloseKey.ADVAPI32(?,02B6CFF7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,02B6CFF0,?,80000001,Software\Embarcadero\Locales), ref: 02B6CFEA

Strings

Software\CodeGear\Locales, xrefs: 02B6CEA0, 02B6CEBE
Software\Embarcadero\Locales, xrefs: 02B6CE60, 02B6CE82
Software\Borland\Delphi\Locales, xrefs: 02B6CEFA
Software\Borland\Locales, xrefs: 02B6CEDC

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: fc58ac1d850ab7bb3ec8fa2e472e815bc983a47bb6da3e6b601aad85f22b7be1
Instruction ID: 99ca3fd381ca620ca477b3933821ffcaf186cc51228e35960ae1e6d8f37695d2
Opcode Fuzzy Hash: fc58ac1d850ab7bb3ec8fa2e472e815bc983a47bb6da3e6b601aad85f22b7be1
Instruction Fuzzy Hash: 6D514375B40209BEEB20DAA5CC5DFBEB7BDEB08704F5044E2BA14E6181D7B899448B54

Function 02B6CAB4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(02C7AC10,00000000,02B6CBB8,?,?,?,00000000,?,02B6D480,00000000,02B6D4DF,?,?,00000000,00000000,00000000), ref: 02B6CAD2
LeaveCriticalSection.KERNEL32(02C7AC10,02C7AC10,00000000,02B6CBB8,?,?,?,00000000,?,02B6D480,00000000,02B6D4DF,?,?,00000000,00000000), ref: 02B6CAF6
LeaveCriticalSection.KERNEL32(02C7AC10,02C7AC10,00000000,02B6CBB8,?,?,?,00000000,?,02B6D480,00000000,02B6D4DF,?,?,00000000,00000000), ref: 02B6CB05
IsValidLocale.KERNEL32(00000000,00000002,02C7AC10,02C7AC10,00000000,02B6CBB8,?,?,?,00000000,?,02B6D480,00000000,02B6D4DF), ref: 02B6CB17
EnterCriticalSection.KERNEL32(02C7AC10,00000000,00000002,02C7AC10,02C7AC10,00000000,02B6CBB8,?,?,?,00000000,?,02B6D480,00000000,02B6D4DF), ref: 02B6CB74
LeaveCriticalSection.KERNEL32(02C7AC10,02C7AC10,00000000,00000002,02C7AC10,02C7AC10,00000000,02B6CBB8,?,?,?,00000000,?,02B6D480,00000000,02B6D4DF), ref: 02B6CB9D

Strings

en-GB,en,en-US,, xrefs: 02B6CAE2, 02B6CB89

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 863dc8c73c940f73aae507d9a8f7ad67f58fb8e076768070d2809b11c918a9c7
Instruction ID: 2fcd81916633427c0a42daa91ba06afd583aafed6d6aae351b65853ddb28f311
Opcode Fuzzy Hash: 863dc8c73c940f73aae507d9a8f7ad67f58fb8e076768070d2809b11c918a9c7
Instruction Fuzzy Hash: DA21A57034064967FB20B769C81D73E3B9ADB45B00FA448F3E18197281DE7E8C508F96

Function 02C4EE14 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 02C4EE3A

Part of subcall function 02C4EDD0: GetDC.USER32(00000000), ref: 02C4EDD9
Part of subcall function 02C4EDD0: SelectObject.GDI32(00000000,058A00B4), ref: 02C4EDEB
Part of subcall function 02C4EDD0: GetTextMetricsW.GDI32(00000000), ref: 02C4EDF6
Part of subcall function 02C4EDD0: ReleaseDC.USER32(00000000,00000000), ref: 02C4EE07

Strings

MS Shell Dlg 2, xrefs: 02C4EEA4
Tahoma, xrefs: 02C4EE5C
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 02C4EE90

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma
API String ID: 2013942131-1011973972
Opcode ID: cf68bfaad158f39c36d476ba0135035bf2a3909acdaee96fee222a5cba75bd6e
Instruction ID: 897c1f08f081f3230799c9fbf8812694094e52749d8d0cdacaa3a21f9b29eb13
Opcode Fuzzy Hash: cf68bfaad158f39c36d476ba0135035bf2a3909acdaee96fee222a5cba75bd6e
Instruction Fuzzy Hash: 28119170A40248EFE712EFA4DC51A5FBBEAFB46700F9249B0E400A7740DB72AE05DB50

Function 02B6961C Relevance: 6.2, APIs: 4, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 02B69653

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 61ce2f99f2ed71ef1b43c021610445c5ce65f95d5c397ee90e377a028c0cc444
Instruction ID: eaac251ef6108a4e911e03416e6ccda2ce5bec0a2764cd38ad5614ae40f12692
Opcode Fuzzy Hash: 61ce2f99f2ed71ef1b43c021610445c5ce65f95d5c397ee90e377a028c0cc444
Instruction Fuzzy Hash: 99517E74A00B44DFDB24DF68C48C77A77E1EF09314F148AAAD9198B281D779D894CF91

Function 02C6E000 Relevance: 6.0, APIs: 4, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadLocale.KERNEL32(00000400,00000000,02C6E0D7), ref: 02C6E02D

Part of subcall function 02B6C520: InitializeCriticalSection.KERNEL32(02C7AC10,02C6E037,00000400,00000000,02C6E0D7), ref: 02B6C525
Part of subcall function 02B6C520: GetVersion.KERNEL32(02C7AC10,02C6E037,00000400,00000000,02C6E0D7), ref: 02B6C533
Part of subcall function 02B6C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,02C7AC10,02C6E037,00000400,00000000,02C6E0D7), ref: 02B6C55A
Part of subcall function 02B6C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 02B6C560
Part of subcall function 02B6C520: GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,02C7AC10,02C6E037,00000400,00000000,02C6E0D7), ref: 02B6C574
Part of subcall function 02B6C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 02B6C57A
Part of subcall function 02B6C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,02C7AC10,02C6E037,00000400,00000000,02C6E0D7), ref: 02B6C58E
Part of subcall function 02B6C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 02B6C594

Part of subcall function 02B6EE84: GetSystemInfo.KERNEL32 ref: 02B6EE88

GetCommandLineW.KERNEL32(00000400,00000000,02C6E0D7), ref: 02C6E092

Part of subcall function 02B65244: GetStartupInfoW.KERNEL32 ref: 02B65255

GetACP.KERNEL32(00000400,00000000,02C6E0D7), ref: 02C6E0A6
GetCurrentThreadId.KERNEL32 ref: 02C6E0BA

Part of subcall function 02B6EE98: GetVersion.KERNEL32(02C6E0C9,00000400,00000000,02C6E0D7), ref: 02B6EE98

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$InfoThreadVersion$CommandCriticalCurrentInitializeLineLocaleSectionStartupSystem
String ID:
API String ID: 2740004594-0
Opcode ID: 24473849a90402805736f029173c8b7438e86567c21d1566c5de1acb4dfe3580
Instruction ID: ae0309619e5ae4cda03bad2b362c894d1578729950634ef6089784b5fdf9ed04
Opcode Fuzzy Hash: 24473849a90402805736f029173c8b7438e86567c21d1566c5de1acb4dfe3580
Instruction Fuzzy Hash: FF11097498538099E710FFB5A80D7397BA9FB05718B808FA9C7444A640EB7D4028EFA6

Function 02C3915C Relevance: 4.6, APIs: 3, Instructions: 150
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,02C3931F), ref: 02C391D5
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,02C3931F), ref: 02C3924B
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 02C392BC

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4d465a378bd5123c4c45a8c7bdc46580280ee86b727a503bfac7c12e0b699925
Instruction ID: da4fea615370d8e5a141631d8606d49d32e976e8a4d843d84928a3855ff1471c
Opcode Fuzzy Hash: 4d465a378bd5123c4c45a8c7bdc46580280ee86b727a503bfac7c12e0b699925
Instruction Fuzzy Hash: 7A51B471B00648AFEB12EBA4CC40B9EB7FBAB48304F1148A5E405E3240D779AF06EB41

Function 02B87884 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,02B87984), ref: 02B878C9
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,02B87967,?,00000000,?,00000000,02B87984), ref: 02B87902
VerQueryValueW.VERSION(?,02B87998,?,?,00000000,?,00000000,?,00000000,02B87967,?,00000000,?,00000000,02B87984), ref: 02B8791C

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: 2007be2bc39298d3b0c4578da680257007726a997b6c7c01cf854e0fb374c829
Instruction ID: dc4f52873f02c39c588dcc6e7c1b12c63d9e3d8afe35d913d619f942281c6281
Opcode Fuzzy Hash: 2007be2bc39298d3b0c4578da680257007726a997b6c7c01cf854e0fb374c829
Instruction Fuzzy Hash: 46312B75A04209AFEB00EFA9C9859AEB7F9EB48704B6144F5A544E3210DB74DD00DB60

Function 02B6D3C8 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,02B6D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,02B6D566,00000000,?,00000105), ref: 02B6D473
GetSystemDefaultUILanguage.KERNEL32(00000000,02B6D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,02B6D566,00000000,?,00000105), ref: 02B6D49B

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: e5498419b7e037eb7b360ff091b3a4a976b36194869959bd1e74ae0037333255
Instruction ID: e75ba5a3618ba9e4f58a0c05ebce3bc2e3b7874ae311519e10d092a44fd9270d
Opcode Fuzzy Hash: e5498419b7e037eb7b360ff091b3a4a976b36194869959bd1e74ae0037333255
Instruction Fuzzy Hash: D0312A30B0420A9BDF14EFA8C898BBEB7B6EF48700F5444E5D400A3650DBB8AD80CF51

Function 02B6D4EC Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,02B6D5A6,?,02B60000,02C6FC1C), ref: 02B6D528
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,02B6D5A6,?,02B60000,02C6FC1C), ref: 02B6D579

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 6b7768a3243404a6c57964c40f50336f13fcf00f20583d1fb2f6c492a024d39c
Instruction ID: 99cf1df4177ad008fb189f428b4276a6576d555d6619089b3a443b214161ce60
Opcode Fuzzy Hash: 6b7768a3243404a6c57964c40f50336f13fcf00f20583d1fb2f6c492a024d39c
Instruction Fuzzy Hash: 56117370A4461D9BDB20EF54CC99FED73BADB44304F5140F6E508A3290EA785F858E94

Function 02B65600 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,02B65C17,?,02B661BC), ref: 02B65617

Strings

@., xrefs: 02B65652, 02B65670

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: @.
API String ID: 4275171209-4201455939
Opcode ID: 8f1b6b6593b3808f306d9ba65987db70526a8d42dd6b4945784ea92d46fb36d0
Instruction ID: 42920e996f6ff4025b9b650c7217afad3a0b1008c16019e70b5ae8db7ed342dc
Opcode Fuzzy Hash: 8f1b6b6593b3808f306d9ba65987db70526a8d42dd6b4945784ea92d46fb36d0
Instruction Fuzzy Hash: 4AF0AFF2F803014FD7248F7899497127AD5E709324F50477EEA48DB788D77488149B90

Function 02C38EA0 Relevance: 3.0, APIs: 2, Instructions: 18
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegFlushKey.ADVAPI32(00000000,?,02C38F0C,?,?,00000000,02C39123,00000000,00000000,00000000,?,?,00000000,02C39139), ref: 02C38EB1
RegCloseKey.ADVAPI32(00000000,?,02C38F0C,?,?,00000000,02C39123,00000000,00000000,00000000,?,?,00000000,02C39139), ref: 02C38EBA

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction ID: 6350fe4f1de251edd43e196642c6c3630634a757a2c4766b04b63718a5335113
Opcode Fuzzy Hash: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction Fuzzy Hash: 0ED067A5A04244DADF51EE79C9C4B567BDD6F44610B08C9E6A818CF146D738D5409B21

Function 02C39EDC Relevance: 1.6, APIs: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,02C39BB9), ref: 02C39F07

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 85fc74020a955a39fb263c9e22b6792ec8f3cc81395999f13bd42818e6708c34
Instruction ID: 0c5589881fa8d7e2bab9553b79753d6e555fa4a6f78f54408d730a6560a56ed6
Opcode Fuzzy Hash: 85fc74020a955a39fb263c9e22b6792ec8f3cc81395999f13bd42818e6708c34
Instruction Fuzzy Hash: A3014476B01208AFDB00EEA8DCC0ADEB7EDDB49314F1085A6F918DB341D6759E059BA1

Function 02C398DC Relevance: 1.5, APIs: 1, Instructions: 36
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,?,?,?,02C39AE0,00000000,02C39C1C), ref: 02C3990D

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ad67be82557188437bc6127552a9993e0998d0cde0f580ab283647e522f4a4dc
Instruction ID: 9d68e512cf063b30b98029930ddc16ec457759b7983fd94d2a50013d97ca2669
Opcode Fuzzy Hash: ad67be82557188437bc6127552a9993e0998d0cde0f580ab283647e522f4a4dc
Instruction Fuzzy Hash: C9F039763052446FE744EAACAC84FABA6DEDB88710F10897AB24CC7241D964DC099BA1

Function 02B6C278 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(02B60000,?,0000020A), ref: 02B6C296

Part of subcall function 02B6D4EC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,02B6D5A6,?,02B60000,02C6FC1C), ref: 02B6D528
Part of subcall function 02B6D4EC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,02B6D5A6,?,02B60000,02C6FC1C), ref: 02B6D579

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction ID: e587540d3ae482795fdb2c27d3464cc4afc6ab4e7edc2a0a3cf63158911cbf79
Opcode Fuzzy Hash: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction Fuzzy Hash: 3CE0ED71A003109BCB24DE98C9C9B5637D8AB08754F0445A6AD54CF346D775D9208BD1

Function 02B6EE84 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 02B6EE88

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction ID: a715ccc2ed76aa76300a65d434332124a29defbed579c4c3ac8ff1f816fe8bc2
Opcode Fuzzy Hash: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction Fuzzy Hash: FDA012504094000EC408A7184C4240F31801A41214FC40750685C95281E60985B507DB

Non-executed Functions

Function 02B6CBF8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,02B7A5A8,?,?), ref: 02B6CC15
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 02B6CC26
FindFirstFileW.KERNEL32(?,?,kernel32.dll,02B7A5A8,?,?), ref: 02B6CD26
FindClose.KERNEL32(?,?,?,kernel32.dll,02B7A5A8,?,?), ref: 02B6CD38
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,02B7A5A8,?,?), ref: 02B6CD44
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,02B7A5A8,?,?), ref: 02B6CD89

Strings

\, xrefs: 02B6CD56
kernel32.dll, xrefs: 02B6CC10
GetLongPathNameW, xrefs: 02B6CC20

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: aa897aee1ca9f62cd5592d036444c1c0603ae48262d1edefd4a64f276a5d88bd
Instruction ID: 8a8e9a867e3b15032aab2de9c956e23817315f2f670f2bc2301a8042191b40eb
Opcode Fuzzy Hash: aa897aee1ca9f62cd5592d036444c1c0603ae48262d1edefd4a64f276a5d88bd
Instruction Fuzzy Hash: 91418271A006189BCB20EBA8CC8CAED7BB6EF44310F5445E68589E7250E77CAE54CF85

Function 02C5ABB4 Relevance: 49.7, APIs: 33, Instructions: 249windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 02C5ABD2
CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 02C5ABE7
SelectObject.GDI32(00000000,00000000), ref: 02C5ABEE
CreateCompatibleDC.GDI32(?), ref: 02C5AC22
CreateCompatibleDC.GDI32(?), ref: 02C5AC2E
CreateCompatibleDC.GDI32(?), ref: 02C5AC3A
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 02C5AC4D
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 02C5AC5D
CreateCompatibleBitmap.GDI32(?,?,?), ref: 02C5AC6B
SelectObject.GDI32(?,?), ref: 02C5AC7B
SelectObject.GDI32(?,?), ref: 02C5AC8B
SelectObject.GDI32(?,?), ref: 02C5AC9B
SetBkColor.GDI32(00000000,?), ref: 02C5ACA8
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 02C5ACCC
SetBkColor.GDI32(00000000,?), ref: 02C5ACD6
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00330008), ref: 02C5ACF2
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 02C5AD12
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 02C5AD2E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,008800C6), ref: 02C5AD4F
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00EE0086), ref: 02C5AD70
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 02C5AD90
SelectObject.GDI32(?,?), ref: 02C5AD9D
DeleteObject.GDI32(00000000), ref: 02C5ADA3
SelectObject.GDI32(?,?), ref: 02C5ADB0
DeleteObject.GDI32(00000000), ref: 02C5ADB6
SelectObject.GDI32(?,?), ref: 02C5ADC3
DeleteObject.GDI32(00000000), ref: 02C5ADC9
SelectObject.GDI32(00000000,?), ref: 02C5ADD3
DeleteObject.GDI32(00000000), ref: 02C5ADD9
DeleteDC.GDI32(?), ref: 02C5ADE2
DeleteDC.GDI32(?), ref: 02C5ADEB
DeleteDC.GDI32(?), ref: 02C5ADF4
DeleteDC.GDI32(00000000), ref: 02C5ADFA

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteSelect$Compatible$Bitmap$Stretch$Color
String ID:
API String ID: 881050057-0
Opcode ID: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction ID: d14019e95fc5f32faac4c706599da0be292d81f61ce5c974c1a671d0eaa88dc5
Opcode Fuzzy Hash: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction Fuzzy Hash: 338144B1E40218BADB50EAE8CD85FAFB7FDAB09710F104494F614FB280C675AD419B75

Function 02B8EF9C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 02B8EFA5

Part of subcall function 02B8EF70: GetProcAddress.KERNEL32(00000000), ref: 02B8EF89

Strings

VarCmp, xrefs: 02B8F0BB
VarBstrFromBool, xrefs: 02B8F181
oleaut32.dll, xrefs: 02B8EFA0
VarCyFromStr, xrefs: 02B8F129
VarNot, xrefs: 02B8EFDF
VarBoolFromStr, xrefs: 02B8F13F
VarBstrFromDate, xrefs: 02B8F16B
VarMul, xrefs: 02B8F021
VarBstrFromCy, xrefs: 02B8F155
VariantChangeTypeEx, xrefs: 02B8EFB3
VarXor, xrefs: 02B8F0A5
VarAnd, xrefs: 02B8F079
VarIdiv, xrefs: 02B8F04D
VarNeg, xrefs: 02B8EFC9
VarOr, xrefs: 02B8F08F
VarAdd, xrefs: 02B8EFF5
VarI4FromStr, xrefs: 02B8F0D1
VarDateFromStr, xrefs: 02B8F113
VarR4FromStr, xrefs: 02B8F0E7
VarMod, xrefs: 02B8F063
VarR8FromStr, xrefs: 02B8F0FD
VarDiv, xrefs: 02B8F037
VarSub, xrefs: 02B8F00B

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 8e6eb03018befe1e8aa7d5cf0595781ce82da00f039d77e6e4989306f0817b2c
Instruction ID: 5a702ecf7a2785a1c76380a0162bdbe3c3ceaba5aa9b844168b5c07fe009bc76
Opcode Fuzzy Hash: 8e6eb03018befe1e8aa7d5cf0595781ce82da00f039d77e6e4989306f0817b2c
Instruction Fuzzy Hash: 7D413C63A482459A63047B6D7C0043B73DAEF46B10BA049DAB41DDBB58DE30FC91CB6E

Function 02C45CEC Relevance: 37.7, APIs: 25, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 02C45D2F
SelectObject.GDI32(?,?), ref: 02C45D44
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029,00000000,02C45DB4,?,?), ref: 02C45D88
SelectObject.GDI32(?,?), ref: 02C45DA2
DeleteObject.GDI32(?), ref: 02C45DAE
CreateCompatibleDC.GDI32(00000000), ref: 02C45DC2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 02C45DE3
SelectObject.GDI32(?,?), ref: 02C45DF8
SelectPalette.GDI32(?,D6080894,00000000), ref: 02C45E0C
SelectPalette.GDI32(?,?,00000000), ref: 02C45E1E
SelectPalette.GDI32(?,00000000,000000FF), ref: 02C45E33
SelectPalette.GDI32(?,D6080894,000000FF), ref: 02C45E49
RealizePalette.GDI32(?), ref: 02C45E55
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 02C45E77
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 02C45E99
SetTextColor.GDI32(?,00000000), ref: 02C45EA1
SetBkColor.GDI32(?,00FFFFFF), ref: 02C45EAF
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 02C45EDB
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 02C45F00
SetTextColor.GDI32(?,?), ref: 02C45F0A
SetBkColor.GDI32(?,?), ref: 02C45F14
SelectObject.GDI32(?,00000000), ref: 02C45F27
DeleteObject.GDI32(?), ref: 02C45F30
SelectPalette.GDI32(?,00000000,00000000), ref: 02C45F52
DeleteDC.GDI32(?), ref: 02C45F5B

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: e34b26149824a80a6dd81bb53239c687f7517c20d167b32a3b4ff54836ddba9b
Instruction ID: 3c950b10f2cef717a6620bca67fe1452ceaf52f58f33f39c8ea2ca428e681cca
Opcode Fuzzy Hash: e34b26149824a80a6dd81bb53239c687f7517c20d167b32a3b4ff54836ddba9b
Instruction Fuzzy Hash: 17818FB2A00209BFEB50DEA8CD85EAF77EDAB0D750F550594F618E7280C635AD009B71

Function 02C4B140 Relevance: 31.7, APIs: 21, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 02C4B163
GetDC.USER32(00000000), ref: 02C4B191
CreateCompatibleDC.GDI32(?), ref: 02C4B1A2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 02C4B1BD
SelectObject.GDI32(?,00000000), ref: 02C4B1D7
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 02C4B1F9
CreateCompatibleDC.GDI32(?), ref: 02C4B207
SelectObject.GDI32(00000000,00000000), ref: 02C4B24F
SelectPalette.GDI32(00000000,?,00000000), ref: 02C4B262
RealizePalette.GDI32(00000000), ref: 02C4B26B
SelectPalette.GDI32(?,?,00000000), ref: 02C4B277
RealizePalette.GDI32(?), ref: 02C4B280
SetBkColor.GDI32(00000000,00000000), ref: 02C4B28A
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 02C4B2AE
SetBkColor.GDI32(00000000,00000000), ref: 02C4B2B8
SelectObject.GDI32(00000000,00000000), ref: 02C4B2CB
DeleteObject.GDI32(00000000), ref: 02C4B2D7
DeleteDC.GDI32(00000000), ref: 02C4B2ED
SelectObject.GDI32(?,00000000), ref: 02C4B308
DeleteDC.GDI32(00000000), ref: 02C4B324
ReleaseDC.USER32(00000000,00000000), ref: 02C4B335

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 79d28acd41d5244e93665d0842eb99c55f566a07bfde3610af1a15f32ab4e767
Instruction ID: 8d7928ad80f8c2579d7b5ed83404599193e1d6153341f98aede266b96e925d4b
Opcode Fuzzy Hash: 79d28acd41d5244e93665d0842eb99c55f566a07bfde3610af1a15f32ab4e767
Instruction Fuzzy Hash: BE51FB71E00309BBEB10DAE9CC95FAFB7FDAB49704F5044A5F624E7280DA749A409B60

Function 02C4C71C Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 357windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 02C4C9A4
CreateCompatibleDC.GDI32(00000001), ref: 02C4CA09
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 02C4CA1E
SelectObject.GDI32(?,00000000), ref: 02C4CA28
SelectPalette.GDI32(?,?,00000000), ref: 02C4CA58
RealizePalette.GDI32(?), ref: 02C4CA64
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 02C4CA88
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,02C4CAE1,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 02C4CA96
SelectPalette.GDI32(?,00000000,000000FF), ref: 02C4CAC8
SelectObject.GDI32(?,?), ref: 02C4CAD5
DeleteObject.GDI32(00000000), ref: 02C4CADB

Strings

BM, xrefs: 02C4C83D
(, xrefs: 02C4C8D2

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: 6a245c37e4a683394b2343f23a63f1688fa376c32745b8cc5fc07b14a31a9f1b
Instruction ID: 76cae6b63869b09fb4d5d59ac01d9c818c2601341a6250e50753333b972b3d10
Opcode Fuzzy Hash: 6a245c37e4a683394b2343f23a63f1688fa376c32745b8cc5fc07b14a31a9f1b
Instruction Fuzzy Hash: F5E12071A01218AFDF14DFA8C884BAEBBF6FF49304F148566E915E7294DB349A40CF61

Function 02C4B698 Relevance: 24.3, APIs: 16, Instructions: 265windowCOMMON

Download Yara Rule

APIs

Part of subcall function 02C4C31C: GetDC.USER32(00000000), ref: 02C4C372
Part of subcall function 02C4C31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 02C4C387
Part of subcall function 02C4C31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 02C4C391
Part of subcall function 02C4C31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,02C4A7DB,00000000,02C4A867), ref: 02C4C3B5
Part of subcall function 02C4C31C: ReleaseDC.USER32(00000000,00000000), ref: 02C4C3C0

SelectPalette.GDI32(?,?,000000FF), ref: 02C4B6DB
RealizePalette.GDI32(?), ref: 02C4B6EA
GetStretchBltMode.GDI32(00000000), ref: 02C4B6FC
GetDeviceCaps.GDI32(?,0000000C), ref: 02C4B70D
GetDeviceCaps.GDI32(?,0000000E), ref: 02C4B71C
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C,00000000), ref: 02C4B74F
SetStretchBltMode.GDI32(?,00000004), ref: 02C4B75D
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C,00000000), ref: 02C4B775
SetStretchBltMode.GDI32(00000000,00000003), ref: 02C4B792
CreateCompatibleDC.GDI32(00000000), ref: 02C4B7F3
SelectObject.GDI32(?,?), ref: 02C4B808
SelectObject.GDI32(?,00000000), ref: 02C4B867
DeleteDC.GDI32(00000000), ref: 02C4B876

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: CapsDevice$ModePaletteSelectStretch$BrushCreateObject$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 28117789-0
Opcode ID: 3df24bb8116ff9a23390d8d08a700750f68463431efa3ea4a536915e50b805c9
Instruction ID: 1ba0680fd581a7c2c8339bc98f40677fa1cea9fbb240776a9d833e0208856a00
Opcode Fuzzy Hash: 3df24bb8116ff9a23390d8d08a700750f68463431efa3ea4a536915e50b805c9
Instruction Fuzzy Hash: D5A1F2B1A00605AFDB50EBA9C984F9FBBF9AF08304F504594F519EB691DB34EE40DB60

Function 02C694F4 Relevance: 21.2, APIs: 6, Strings: 8, Instructions: 217COMMON

Download Yara Rule

Strings

BTMemoryLoadLibary: BuildImportTable failed, xrefs: 02C696C0
BTMemoryLoadLibary: VirtualAlloc failed, xrefs: 02C695D8
BTMemoryLoadLibary: Can't attach library, xrefs: 02C69738
BTMemoryLoadLibary: dll dos header is not valid, xrefs: 02C6953C
BTMemoryLoadLibary: Get DLLEntyPoint failed, xrefs: 02C6970D
PE, xrefs: 02C69570
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid, xrefs: 02C69581
MZ, xrefs: 02C6952F

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID:
String ID: BTMemoryLoadLibary: BuildImportTable failed$BTMemoryLoadLibary: Can't attach library$BTMemoryLoadLibary: Get DLLEntyPoint failed$BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid$BTMemoryLoadLibary: VirtualAlloc failed$BTMemoryLoadLibary: dll dos header is not valid$MZ$PE
API String ID: 0-3631919656
Opcode ID: 7966455ae0ce41409f76a7294d26e325fc3a992e4a435d9fb64d724a673d2604
Instruction ID: 259bcc77175a794f934ec2504b09abbbc26033390374e9035af41601a4312823
Opcode Fuzzy Hash: 7966455ae0ce41409f76a7294d26e325fc3a992e4a435d9fb64d724a673d2604
Instruction Fuzzy Hash: B3715E75B04205AFDB15EFA9C894BBEB7EAEF88700F0484A5E514E7380D674DD09CB51

Function 02C45B58 Relevance: 21.1, APIs: 14, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 02C45B6F
CreateCompatibleDC.GDI32(00000000), ref: 02C45B79
GetObjectW.GDI32(?,00000018,?), ref: 02C45B99
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 02C45BB0
GetDC.USER32(00000000), ref: 02C45BBC
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 02C45BE9
ReleaseDC.USER32(00000000,00000000), ref: 02C45C0F
SelectObject.GDI32(?,?), ref: 02C45C2A
SelectObject.GDI32(?,00000000), ref: 02C45C39
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 02C45C65
SelectObject.GDI32(?,00000000), ref: 02C45C73
SelectObject.GDI32(?,00000000), ref: 02C45C81
DeleteDC.GDI32(?), ref: 02C45C97
DeleteDC.GDI32(?), ref: 02C45CA0

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: f89f6787752f0dec4c760b0c06bdca903b76360eeddd0fcd96020f42cf87cfa3
Instruction ID: 3e38e0327ef72d0a241c9fedd841007e86ca1e83d10686d5196a535248d24f39
Opcode Fuzzy Hash: f89f6787752f0dec4c760b0c06bdca903b76360eeddd0fcd96020f42cf87cfa3
Instruction Fuzzy Hash: 4D41F9B2E40609BFEB50EBE8C941FAFB7FDEB48740F400495F610E7280D6749A409BA1

Function 02B6C520 Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(02C7AC10,02C6E037,00000400,00000000,02C6E0D7), ref: 02B6C525
GetVersion.KERNEL32(02C7AC10,02C6E037,00000400,00000000,02C6E0D7), ref: 02B6C533
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,02C7AC10,02C6E037,00000400,00000000,02C6E0D7), ref: 02B6C55A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 02B6C560
GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,02C7AC10,02C6E037,00000400,00000000,02C6E0D7), ref: 02B6C574
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 02B6C57A
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,02C7AC10,02C6E037,00000400,00000000,02C6E0D7), ref: 02B6C58E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 02B6C594

Strings

kernel32.dll, xrefs: 02B6C555, 02B6C56F, 02B6C589
GetThreadPreferredUILanguages, xrefs: 02B6C550
SetThreadPreferredUILanguages, xrefs: 02B6C56A
GetThreadUILanguage, xrefs: 02B6C584

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$CriticalInitializeSectionVersion
String ID: GetThreadPreferredUILanguages$GetThreadUILanguage$SetThreadPreferredUILanguages$kernel32.dll
API String ID: 74573329-1403180336
Opcode ID: 138211897f4d23d996b2a6003fe43c1499b9ee6c94e3ad90fbb042da8a02085f
Instruction ID: 9989e44350ce7db1f936429710c02614267b1a54861745627d701ae54e2fcffd
Opcode Fuzzy Hash: 138211897f4d23d996b2a6003fe43c1499b9ee6c94e3ad90fbb042da8a02085f
Instruction Fuzzy Hash: 74F01CE19C0B8436F72037719C0EB3E2F86AB00704B9049E7B18199013DEAD81E48F15

Function 02C4B964 Relevance: 19.8, APIs: 13, Instructions: 255windowCOMMON

Download Yara Rule

APIs

Part of subcall function 02C4C31C: GetDC.USER32(00000000), ref: 02C4C372
Part of subcall function 02C4C31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 02C4C387
Part of subcall function 02C4C31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 02C4C391
Part of subcall function 02C4C31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,02C4A7DB,00000000,02C4A867), ref: 02C4C3B5
Part of subcall function 02C4C31C: ReleaseDC.USER32(00000000,00000000), ref: 02C4C3C0

SelectPalette.GDI32(?,?,000000FF), ref: 02C4B9A7
RealizePalette.GDI32(?), ref: 02C4B9B6
GetDeviceCaps.GDI32(?,0000000C), ref: 02C4B9C8
GetDeviceCaps.GDI32(?,0000000E), ref: 02C4B9D7
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 02C4BA0A
SetStretchBltMode.GDI32(?,00000004), ref: 02C4BA18
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 02C4BA30
SetStretchBltMode.GDI32(00000000,00000003), ref: 02C4BA4D
CreateCompatibleDC.GDI32(00000000), ref: 02C4BAAE
SelectObject.GDI32(?,?), ref: 02C4BAC3
SelectObject.GDI32(?,00000000), ref: 02C4BB22
DeleteDC.GDI32(00000000), ref: 02C4BB31

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: e74c6d9599b2179d0f9d4a99a374c0b8216b2f1bfaa04751204b6d0fc5c057cd
Instruction ID: 644ad3bee7477af126800376c6c478af8b0304c4ac831bbe352a7c7ae9e96c4c
Opcode Fuzzy Hash: e74c6d9599b2179d0f9d4a99a374c0b8216b2f1bfaa04751204b6d0fc5c057cd
Instruction Fuzzy Hash: B49133B1A00245AFDB50EBA9C980F9FBBF9AF09304F104595F519EB691DB34EE40DB60

Function 02C4D7A0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 258windowCOMMON

Download Yara Rule

APIs

Part of subcall function 02C4D0C0: DeleteObject.GDI32(00000000), ref: 02C4D206

DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000000), ref: 02C4D865
GetDIBits.GDI32(00000000,00000000,00000000,00000000,?,?), ref: 02C4D8E3
GetIconInfo.USER32(00000000,?), ref: 02C4D947
GetDIBits.GDI32(00000000,?,00000000,00000000,?,00000000,?), ref: 02C4D980
SetDIBits.GDI32(00000000,00000000,?,00000000,?,00000000,02C4DA2B), ref: 02C4D9E9
DeleteObject.GDI32(?), ref: 02C4D9FF
DeleteObject.GDI32(?), ref: 02C4DA08

Strings

,, xrefs: 02C4D86A
, xrefs: 02C4D890

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: BitsDeleteObject$Icon$DrawInfo
String ID: $,
API String ID: 1810795657-71045815
Opcode ID: 48175114d3f7ded31e85657b9a7bc351c9b490fdbbd5b0ed2d7af7b8f3dec1d8
Instruction ID: bde2e4e413d77564d8ed3be667f949bdb96fb1c7e316480384b31d3d9df778b3
Opcode Fuzzy Hash: 48175114d3f7ded31e85657b9a7bc351c9b490fdbbd5b0ed2d7af7b8f3dec1d8
Instruction Fuzzy Hash: E1910671B00209AFD710EFA9C884A9EBBFAFF48700F5041A5E519EB264DB30ED45DB91

Function 02B853AC Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,02B85691,?,?,?,?,00000000,00000000), ref: 02B853D3
GetThreadLocale.KERNEL32(?,00000001,00000000,02B85691,?,?,?,?,00000000,00000000), ref: 02B853DC

Part of subcall function 02B85380: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,02B85482,?,00000001,00000000,02B85691), ref: 02B85393

Part of subcall function 02B85334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 02B85352

Strings

:mm:ss, xrefs: 02B85644
:mm, xrefs: 02B85629
2, xrefs: 02B8566D
mmmm d, yyyy, xrefs: 02B85502
AMPM, xrefs: 02B8560A
m/d/yy, xrefs: 02B854DD
AMPM , xrefs: 02B85619

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: fcc1941505476096e3c116680d0d83c024553e97384f243847e56757cb85c8bf
Instruction ID: fa2305897f33a221507aa77c73092462144df89a650796cffaaf347a4ffebde1
Opcode Fuzzy Hash: fcc1941505476096e3c116680d0d83c024553e97384f243847e56757cb85c8bf
Instruction Fuzzy Hash: 88714D357001099BDB21FBA4D880BDF77ABEF88700F91C0A5E509AB645DB39DE06CB55

Function 02B85DC8 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 199threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02B68850: GetTickCount.KERNEL32 ref: 02B68887
Part of subcall function 02B68850: GetTickCount.KERNEL32 ref: 02B6889F

Part of subcall function 02B85334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 02B85352

GetThreadLocale.KERNEL32(00000000,00000004), ref: 02B85E60
EnumCalendarInfoW.KERNEL32(02B85C8C,00000000,00000000,00000004), ref: 02B85E6B
GetThreadLocale.KERNEL32(00000000,00000003,02B85C8C,00000000,00000000,00000004), ref: 02B85EA6
EnumCalendarInfoW.KERNEL32(02B85D30,00000000,00000000,00000003,02B85C8C,00000000,00000000,00000004), ref: 02B85EB1
GetThreadLocale.KERNEL32(00000000,00000004), ref: 02B85F42
EnumCalendarInfoW.KERNEL32(02B85C8C,00000000,00000000,00000004), ref: 02B85F4D
GetThreadLocale.KERNEL32(00000000,00000003,02B85C8C,00000000,00000000,00000004), ref: 02B85F8A
EnumCalendarInfoW.KERNEL32(02B85D30,00000000,00000000,00000003,02B85C8C,00000000,00000000,00000004), ref: 02B85F95

Strings

B.C., xrefs: 02B85EF0

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.
API String ID: 1601775584-621294921
Opcode ID: 354cbbc39b5f3b5374be2deae4a3ab99cf52405a1d99216997fc43abe841cf0d
Instruction ID: ce62dadae820b4b4e235dcfe4867aa7d058b1e9e6c6506f32eb34f18d2aa4090
Opcode Fuzzy Hash: 354cbbc39b5f3b5374be2deae4a3ab99cf52405a1d99216997fc43abe841cf0d
Instruction Fuzzy Hash: 49619474A402059FE720EF68D888A6E77FAEF04714B5246E8E919EB390D731ED45CF60

Function 02C44AC0 Relevance: 15.2, APIs: 10, Instructions: 228windowCOMMON

Download Yara Rule

APIs

Part of subcall function 02C44778: EnterCriticalSection.KERNEL32(02C7DE34,?,02C44858,?,?,?,?,?,?,?,?,00000000,02C44870,?,02C7DE34), ref: 02C44780
Part of subcall function 02C44778: LeaveCriticalSection.KERNEL32(02C7DE34,02C7DE34,?,02C44858,?,?,?,?,?,?,?,?,00000000,02C44870,?,02C7DE34), ref: 02C4478D
Part of subcall function 02C44778: EnterCriticalSection.KERNEL32(?,02C7DE34,02C7DE34,?,02C44858,?,?,?,?,?,?,?,?,00000000,02C44870), ref: 02C44796

CreateCompatibleDC.GDI32(00000000), ref: 02C44B64
SelectObject.GDI32(?,?), ref: 02C44B74
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00CC0020), ref: 02C44C70
SetTextColor.GDI32(?,00000000), ref: 02C44C7E
SetBkColor.GDI32(?,00FFFFFF), ref: 02C44C92
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00E20746), ref: 02C44CC5
SetTextColor.GDI32(?,?), ref: 02C44CD5
SetBkColor.GDI32(?,?), ref: 02C44CE5
SelectObject.GDI32(?,00000000), ref: 02C44D15
DeleteDC.GDI32(?), ref: 02C44D1E

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Color$CriticalSection$EnterObjectSelectStretchText$CompatibleCreateDeleteLeave
String ID:
API String ID: 675119849-0
Opcode ID: fa2842b2eae4bd6c02bd6035d2d5b609f24daedecd8082f0dc658e3d09993ed5
Instruction ID: c13802d8ffaca764f3c283cd72e6e206f3a905e26de856157273a235a7be88c8
Opcode Fuzzy Hash: fa2842b2eae4bd6c02bd6035d2d5b609f24daedecd8082f0dc658e3d09993ed5
Instruction Fuzzy Hash: 11918075A00518AFCB50DFA8C980E9EB7F9EF4D300B644595E919EB220CB34EE41DF61

Function 02B685C8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 02B685DD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 02B685E3
GetLogicalProcessorInformation.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 02B685F6
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 02B685FF
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,02B68676,?,00000000,?,GetLogicalProcessorInformation), ref: 02B6862A

Strings

kernel32.dll, xrefs: 02B685D8
@, xrefs: 02B6867D
GetLogicalProcessorInformation, xrefs: 02B685D3

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: 360f0666712f24e10df0ad33c5ae52430036fec91eb18781682e634f74947478
Instruction ID: 38c162b50d1a7a92682b16e0ebb5e0b217e7161de8a9efb2484e30622260d2fc
Opcode Fuzzy Hash: 360f0666712f24e10df0ad33c5ae52430036fec91eb18781682e634f74947478
Instruction Fuzzy Hash: BE1179B1D00208AEEB20EBA4C80CBBDB7B9EB04700F5484E5E814A3250D77C8A88CF91

Function 02B70594 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 02B7064C

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 5486e7fcef16fdf79714de96f9b462b65ef79b631497f8368003537b42c33690
Instruction ID: d3847b87e2275bfa8148e719c9fe2d3a696e0fcb7d67361cc5d4d09fa144399c
Opcode Fuzzy Hash: 5486e7fcef16fdf79714de96f9b462b65ef79b631497f8368003537b42c33690
Instruction Fuzzy Hash: 8AA17075D013099FDB14EFE8D884BAEBBB5FF48314F144A6AE925A7280DB70A944CF50

Function 02C69F0C Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,02C6A171,?,00000000,?,00000000), ref: 02C69F8E
IsBadReadPtr.KERNEL32(?,00000014), ref: 02C6A142

Strings

BuildImportTable: GetProcAddress failed, xrefs: 02C6A115
BuildImportTable: ReallocMemory failed, xrefs: 02C6A020
BuildImportTable: can't load library: , xrefs: 02C69FD5

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: LibraryLoadRead
String ID: BuildImportTable: GetProcAddress failed$BuildImportTable: ReallocMemory failed$BuildImportTable: can't load library:
API String ID: 1452896035-1384308123
Opcode ID: 459911985ae5c901d816d4ce0d5e3b42bef7f2b029c733671069bf5561098495
Instruction ID: da68b5518e6a168605cd91d948eb63df40b68803f6ee419f8f1410ac9754ee97
Opcode Fuzzy Hash: 459911985ae5c901d816d4ce0d5e3b42bef7f2b029c733671069bf5561098495
Instruction Fuzzy Hash: 9E711B70A00205AFDB10EB69CCC9BBAB7FAEF89310F4084A4E559E7250D775AE45CF61

Function 02B90A54 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02B90AED
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02B90B09
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 02B90B42
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02B90BBF
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 02B90BD8
VariantCopy.OLEAUT32(?), ref: 02B90C0D

Strings

, xrefs: 02B90A6E

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: 4d50a89296325ef0fdf9e6951e056667a096c5e053e762f2c5e4ddb089fcda8a
Instruction ID: 7134fc016d38c3cb0270c024e97515e9a8e1a7245f618f0a9592f54696875cf3
Opcode Fuzzy Hash: 4d50a89296325ef0fdf9e6951e056667a096c5e053e762f2c5e4ddb089fcda8a
Instruction Fuzzy Hash: A451F575A0022D9BDF62EF58C880BDAB3BDAF49314F0045E5E649A7251DA34AF84CF61

Function 02C49A04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 02C49AA6
MulDiv.KERNEL32(?,000009EC,00000000), ref: 02C49AC3
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 02C49AEF
GetEnhMetaFileHeader.GDI32(00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 02C49B0F
DeleteEnhMetaFile.GDI32(00000016), ref: 02C49B30
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 02C49B43

Strings

`, xrefs: 02C49A8B

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: a192b18e51b16ec2e75d765a65553f6690b68b2d0af0291fd4341f8f4df993f2
Instruction ID: 3117878751cab7dfda8a769515e3cc14844ba4a3af6769008cb8b4227a4194d7
Opcode Fuzzy Hash: a192b18e51b16ec2e75d765a65553f6690b68b2d0af0291fd4341f8f4df993f2
Instruction Fuzzy Hash: BB410C75D00218AFDB50DFA8C884AAFB7F9EF48710F5085A5E904EB240EB349E44DF65

Function 02B6591C Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,02B661BC), ref: 02B659D3
Sleep.KERNEL32(0000000A,00000000,?,02B661BC), ref: 02B659E9
Sleep.KERNEL32(00000000,?,?,?,02B661BC), ref: 02B65A17
Sleep.KERNEL32(0000000A,00000000,?,?,?,02B661BC), ref: 02B65A2D

Strings

@., xrefs: 02B65AB4, 02B65AD6, 02B65BEC, 02B65C02

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: @.
API String ID: 3472027048-4201455939
Opcode ID: 73bebf8b732dc62eecd15a9cbe9dbb7a232cf5585baef367299c33da9b463689
Instruction ID: 38cef0254da337037779caae587dccff3dd2cecb163e25aa2efd4949aa31e27f
Opcode Fuzzy Hash: 73bebf8b732dc62eecd15a9cbe9dbb7a232cf5585baef367299c33da9b463689
Instruction Fuzzy Hash: 4FC136B2A412418FC725CF68D88C726BBD1EB84324F8847EED5558B385C774D479CBA0

Function 02B65CA0 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?), ref: 02B65D36
Sleep.KERNEL32(0000000A,00000000,?), ref: 02B65D50

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 604b9d30567a773a4fc8a1f202e001a942c79cd9928bb5c37947aca05cc15855
Instruction ID: f7e85971eb6aa95c8d9e85852a5b52681430c562743924744b30cb290a651621
Opcode Fuzzy Hash: 604b9d30567a773a4fc8a1f202e001a942c79cd9928bb5c37947aca05cc15855
Instruction Fuzzy Hash: 947112316402408FD735CF68C88CB36BBD5EB85324F9887EAD8848B2D5D778C865CB91

Function 02B866A0 Relevance: 12.1, APIs: 8, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 02B864A8: VirtualQuery.KERNEL32(?,?,0000001C,00000000,02B86654), ref: 02B864DB
Part of subcall function 02B864A8: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 02B864FF
Part of subcall function 02B864A8: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 02B8651A
Part of subcall function 02B864A8: LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 02B865B5

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,02B867C5), ref: 02B86701
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 02B86734
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 02B86746
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 02B8674C
GetStdHandle.KERNEL32(000000F4,02B867E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 02B86760
WriteFile.KERNEL32(00000000,000000F4,02B867E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 02B86766
LoadStringW.USER32(00000000,0000FFEC,?,00000040), ref: 02B8678A
MessageBoxW.USER32(00000000,?,?,00002010), ref: 02B867A4

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID:
API String ID: 135118572-0
Opcode ID: 3732f26fbeff1a45836d39484c182b827d42dbebc459320c21fd79af7f45935b
Instruction ID: c8b38c5a2ce1ab9c32de57bd188e237256d924f7c66c7be24fefc2252d7e9449
Opcode Fuzzy Hash: 3732f26fbeff1a45836d39484c182b827d42dbebc459320c21fd79af7f45935b
Instruction Fuzzy Hash: 94314175684208BFEB14EAA4DC82FEA73EDEB04700F5041E1BA19E61D0DA746E548B65

Function 02C46084 Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 02C460B2
GetDeviceCaps.GDI32(?,00000068), ref: 02C460CE
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 02C460ED
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 02C46111
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 02C4612F
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 02C46143
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 02C46163
ReleaseDC.USER32(00000000,?), ref: 02C4617B

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: fe4b928bfcb89692458902bcd1785afc261b3bff2805712483b55cbe8abec9ad
Instruction ID: 486ef35dc539be75efae33678c8e2d0578a0719e8df925060d503de641c9d061
Opcode Fuzzy Hash: fe4b928bfcb89692458902bcd1785afc261b3bff2805712483b55cbe8abec9ad
Instruction Fuzzy Hash: 01212AB5A40208BBEB50DBA8CD85FAE73EDEB49704F5004E5F704F6180DA75AE449B25

Function 02B65E98 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6768bbf0e742e02f6e74a240fcf27349f212b4f366d2f98ccfcec06659e13dd5
Instruction ID: 227d41d1e00d6ae6e81edf3298d1ca8763d1469c47c526aab69f5c35187558cb
Opcode Fuzzy Hash: 6768bbf0e742e02f6e74a240fcf27349f212b4f366d2f98ccfcec06659e13dd5
Instruction Fuzzy Hash: E0C1E3A2B106100BD734AA7C9C8C77EB78ADBC4325F9886B9E254CB3C5DB7CD8658750

Function 02C5C798 Relevance: 10.7, APIs: 7, Instructions: 198windowCOMMON

Download Yara Rule

APIs

Part of subcall function 02C5C400: DeleteObject.GDI32(?), ref: 02C5C40B
Part of subcall function 02C5C400: DeleteDC.GDI32(?), ref: 02C5C418
Part of subcall function 02C5C400: DeleteObject.GDI32(?), ref: 02C5C434

CreateCompatibleDC.GDI32(00000000), ref: 02C5C903
CreateHalftonePalette.GDI32(?,00000000), ref: 02C5C93E
ResizePalette.GDI32(?,00000001), ref: 02C5C973
SelectPalette.GDI32(?,?,00000000), ref: 02C5C998
RealizePalette.GDI32(?), ref: 02C5C9A3
CreateDIBSection.GDI32(?,-00000474,00000000,-00000450,00000000,00000000), ref: 02C5C9CE
SelectObject.GDI32(?,00000000), ref: 02C5C9E1

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Palette$CreateDeleteObject$Select$CompatibleHalftoneRealizeResizeSection
String ID:
API String ID: 2525607832-0
Opcode ID: e470db31d7cb599619d4b462895cc9a80ed51459a1c61c412d48eab758b75784
Instruction ID: 7c667a3839b4da4af5f5444054492d890db686d554101e4bb6d948e32e653745
Opcode Fuzzy Hash: e470db31d7cb599619d4b462895cc9a80ed51459a1c61c412d48eab758b75784
Instruction Fuzzy Hash: C07147752006209FDB44DB28C4D4F6673E6EF4A304F0541E6E604CF36ACB34E98ACB9A

Function 02B68850 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02B68CDC: GetCurrentThreadId.KERNEL32 ref: 02B68CDF

GetTickCount.KERNEL32 ref: 02B68887
GetTickCount.KERNEL32 ref: 02B6889F
GetCurrentThreadId.KERNEL32 ref: 02B688CE
GetTickCount.KERNEL32 ref: 02B688F9
GetTickCount.KERNEL32 ref: 02B68930
GetTickCount.KERNEL32 ref: 02B6895A
GetCurrentThreadId.KERNEL32 ref: 02B689CA

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 79ee69578ae38d50098b695464986d430ecca96b9ca3b66a4fa9ef66139004c8
Instruction ID: abc1669f188dab96c914866ad11dd6fd18a512062e1c11e7ad20d9269d9bc256
Opcode Fuzzy Hash: 79ee69578ae38d50098b695464986d430ecca96b9ca3b66a4fa9ef66139004c8
Instruction Fuzzy Hash: 85415E716093419ED721EE7CC98C33EBAD2EF81354F1489ADD6D887281EB799488CB53

Function 02C4A090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 02C4A0E2
MulDiv.KERNEL32(?,?,000009EC), ref: 02C4A0F9
GetDC.USER32(00000000), ref: 02C4A110
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,02C4A1CB,?,00000000,?,?,000009EC,?,?,000009EC), ref: 02C4A134
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,02C4A1AB,?,?,00000000,00000000,00000008,?,00000000,02C4A1CB), ref: 02C4A167

Strings

`, xrefs: 02C4A0C8

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: 6c08e1985d299c651b890baad2de0a33829fdd2158f914143de7c66f19e6c51f
Instruction ID: 7fed63bec54c40f856efbed94b6e2f79c24c6f48c751d906927f66a319660837
Opcode Fuzzy Hash: 6c08e1985d299c651b890baad2de0a33829fdd2158f914143de7c66f19e6c51f
Instruction Fuzzy Hash: 28312F75A40248ABDB00DFE4C891ABFB7B9EF0D700F504495E914EB240DA75AE00EBA5

Function 02C4E9A8 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsEqualGUID.OLE32(?,?), ref: 02C4E9B4
IsEqualGUID.OLE32(?,02C72700), ref: 02C4E9D5
IsEqualGUID.OLE32(?,02C72710), ref: 02C4E9EB

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Equal
String ID:
API String ID: 4016716531-0
Opcode ID: d27913e91ab066e969785e88548b4da2b4140d82584787e723042442c7f4635d
Instruction ID: 5aa59f16a1af4b497c3631b61b607dcce9641f8025090507d6c6e5ab4a5da4ee
Opcode Fuzzy Hash: d27913e91ab066e969785e88548b4da2b4140d82584787e723042442c7f4635d
Instruction Fuzzy Hash: DB11D3B1044540DEDF51DA29CD84BB76F8EBF82258F0D14D2EE404F282DB958549CBF6

Function 02C4A974 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 02C462F0: GetObjectW.GDI32(00000000,00000004), ref: 02C46307
Part of subcall function 02C462F0: GetPaletteEntries.GDI32(00000000,00000000,?,00000028), ref: 02C4632A

GetDC.USER32(00000000), ref: 02C4A9B2
CreateCompatibleDC.GDI32(?), ref: 02C4A9BE
SelectObject.GDI32(?), ref: 02C4A9CB
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,02C4AA23,?,?,?,?,00000000), ref: 02C4A9EF
SelectObject.GDI32(?,?), ref: 02C4AA09
DeleteDC.GDI32(?), ref: 02C4AA12
ReleaseDC.USER32(00000000,?), ref: 02C4AA1D

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: d5a764c99c4841969e23b2dcf908edf156ee783150c03dacccabd767818ad968
Instruction ID: 4759a4a9ccef6d2f5e09e8ac98c5cb1b766e197854a59b6042894377cd2a117d
Opcode Fuzzy Hash: d5a764c99c4841969e23b2dcf908edf156ee783150c03dacccabd767818ad968
Instruction Fuzzy Hash: 76113072E40219BFDB10EBE8CC51AAEB3FDEB49700F4044E5EA14E7240DA759E509FA1

Function 02B698D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,02B6998E,?,?,?,?,02B69AA2,02B66F13,02B66F5A,?,?), ref: 02B69909
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,02B6998E,?,?,?,?,02B69AA2,02B66F13,02B66F5A,?), ref: 02B6990F
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,02B6998E,?,?,?), ref: 02B6992A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,02B6998E), ref: 02B69930

Strings

Runtime error at 00000000, xrefs: 02B69902, 02B69947
Error, xrefs: 02B69942

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 8f125133f6cb6636e70c8dcbd61e098745f90c8ae74349a2c06cabdb43c148f2
Instruction ID: 584dacc65825b16af030834a2907d4bf8fcfeb04433fd091649d0a48063e58b0
Opcode Fuzzy Hash: 8f125133f6cb6636e70c8dcbd61e098745f90c8ae74349a2c06cabdb43c148f2
Instruction Fuzzy Hash: 78F09691A80340B9FB3077B46C5EF7A375C9740B14F544B99B359590C5C7B880989B62

Function 02C465E0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 02C4662E
GetSystemMetrics.USER32(0000000C), ref: 02C4663A
GetDC.USER32(00000000), ref: 02C46656
GetDeviceCaps.GDI32(00000000,0000000E), ref: 02C4667D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 02C4668A
ReleaseDC.USER32(00000000,00000000), ref: 02C466C3

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 457733d9609f54d125e62b583700168451c256b414a61099d0eaad43ddc44d0f
Instruction ID: a5a2dd34137d182c8ab921d0a895ed6326955775acecc99b05024562bee2e308
Opcode Fuzzy Hash: 457733d9609f54d125e62b583700168451c256b414a61099d0eaad43ddc44d0f
Instruction Fuzzy Hash: 6E314174E00208EFEB10DFA5C981AAEBBF9FF89750F1085A5E914AB354CB709940CF61

Function 02C46234 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 02C46252
SelectObject.GDI32(00000000,00000000), ref: 02C4625B
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,?,00000000,?,?,02C4C367), ref: 02C4626F
SelectObject.GDI32(00000000,00000000), ref: 02C4627B
DeleteDC.GDI32(00000000), ref: 02C46281
CreatePalette.GDI32 ref: 02C462DC

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: 30df465cdafede8327223e229e5e327e680b3cdc3a22b1eb51a9e93e1b8bca54
Instruction ID: 455eb70f669c8fc30f6f15ddc1242df518404356233945ffd07eb90ec58a7b25
Opcode Fuzzy Hash: 30df465cdafede8327223e229e5e327e680b3cdc3a22b1eb51a9e93e1b8bca54
Instruction Fuzzy Hash: 6411066160431033E320A7758C41F6B72EDDFC2710F10896DF949D7280EA788848A7A2

Function 02C46A9C Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 02C46950: GetObjectW.GDI32(?,00000054), ref: 02C46964

CreateCompatibleDC.GDI32(00000000), ref: 02C46ABE
SelectPalette.GDI32(?,?,00000000), ref: 02C46ADF
RealizePalette.GDI32(?), ref: 02C46AEB
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 02C46B02
SelectPalette.GDI32(?,00000000,00000000), ref: 02C46B2A
DeleteDC.GDI32(?), ref: 02C46B33

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: ebb72241cc379e76052ed5412e6aefd8f1711ec7c062a88af306b5373aed71ba
Instruction ID: 894038995aa27213ee5ea56fd50264ae9c5bcb322a5b4f573a83c7452f012213
Opcode Fuzzy Hash: ebb72241cc379e76052ed5412e6aefd8f1711ec7c062a88af306b5373aed71ba
Instruction Fuzzy Hash: C6114C75A006047BEB10DBA88C81F9FB7EDEB4D710F5080A5B628E7280DA749A409B61

Function 02B661E4 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,02B65358,00000000,?,00000000,?,?,00000000,02B66B8F), ref: 02B66206
WriteFile.KERNEL32(00000000,000000F4,02B65358,00000000,?,00000000,?,?,00000000,02B66B8F), ref: 02B6620C
GetStdHandle.KERNEL32(000000F4,02B65354,00000000,?,00000000,00000000,000000F4,02B65358,00000000,?,00000000,?,?,00000000,02B66B8F), ref: 02B6622B
WriteFile.KERNEL32(00000000,000000F4,02B65354,00000000,?,00000000,00000000,000000F4,02B65358,00000000,?,00000000,?,?,00000000,02B66B8F), ref: 02B66231
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,02B65354,00000000,?,00000000,00000000,000000F4,02B65358,00000000,?), ref: 02B66248
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,02B65354,00000000,?,00000000,00000000,000000F4,02B65358,00000000), ref: 02B6624E

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: c9c0ce56ceb1cd18b73f7b8b7271eb02ce6882bd09f1fb59f9c006506759e7c8
Instruction ID: 412137e60f730fec9d92c0cb52cfe5eb39ecde441d2dbb08693237fd3d9bc82d
Opcode Fuzzy Hash: c9c0ce56ceb1cd18b73f7b8b7271eb02ce6882bd09f1fb59f9c006506759e7c8
Instruction Fuzzy Hash: 380168A16482107EE660F2B89C8DFBB378D9B59721F500B95B258F20C1CA6CDC548BB1

Function 02B864A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,02B86654), ref: 02B864DB
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 02B864FF
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 02B8651A
LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 02B865B5

Strings

MZP, xrefs: 02B86519

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: f2cc9bbc5afb8d4fb48351abe42b1b7a8be6e6c3dd53ed5472ccefeea1cb75c7
Instruction ID: 26823d9e2f2ec254f26c090a99f9f0295c727ec5333922846a36437958e57c8f
Opcode Fuzzy Hash: f2cc9bbc5afb8d4fb48351abe42b1b7a8be6e6c3dd53ed5472ccefeea1cb75c7
Instruction Fuzzy Hash: 74411BB1A4025C9FDB20EF68CC84BD9B7FAAB59300F4044E5A50CE7241D776AE94CF50

Function 02C4D0C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 02C4D17C
CreateHalftonePalette.GDI32(00000000,00000000), ref: 02C4D189
ReleaseDC.USER32(00000000,00000000), ref: 02C4D198
DeleteObject.GDI32(00000000), ref: 02C4D206

Strings

(, xrefs: 02C4D133

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: CreateDeleteHalftoneObjectPaletteRelease
String ID: (
API String ID: 577518360-3887548279
Opcode ID: 4fc3d711f6a2fa176bb1dec8f118d3545a9610b2519c73e53bb21cbb64c0fdd5
Instruction ID: 17dc5ef083394af73961a9ece03371be2b971b773bce096cb50cb63abfa9736e
Opcode Fuzzy Hash: 4fc3d711f6a2fa176bb1dec8f118d3545a9610b2519c73e53bb21cbb64c0fdd5
Instruction Fuzzy Hash: E0416D70A04208AFDB10EFA5C884B9EFBF6EF89304F5440A5E806AB351DB759E45DB51

Function 02B9690C Relevance: 7.8, APIs: 5, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b60640832d6db820346097bf258c483b95aefc5fca73a19af1a4bf9b25508d0
Instruction ID: 4e75d0346f706ab1c14d0e6d8b109b48314bae40615dac780f7cbf23799dab5f
Opcode Fuzzy Hash: 3b60640832d6db820346097bf258c483b95aefc5fca73a19af1a4bf9b25508d0
Instruction Fuzzy Hash: 52D16C35A04249AFDF01EFA9C4809FDFBBAEF49710F9484F5E850A7210D734AA85DB61

Function 02C61CB0 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 02C61CF9
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 02C61D28
SelectObject.GDI32(?,?), ref: 02C61D38
DeleteObject.GDI32(?), ref: 02C61F51
DeleteDC.GDI32(?), ref: 02C61F5D

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: CreateDeleteObject$CompatibleSectionSelect
String ID:
API String ID: 2986811175-0
Opcode ID: 0167fa3ae48454baa197b3d28432bbb9244175284dbda83da00c44f68e3c73d0
Instruction ID: 37765e545e9509ff1260b81aff9624a8b1a0a853f6642941403ae883a39baf07
Opcode Fuzzy Hash: 0167fa3ae48454baa197b3d28432bbb9244175284dbda83da00c44f68e3c73d0
Instruction Fuzzy Hash: 13B1B474E006099FCB44DFA9C988AAEBBF6FF48301F2485A5E814AB361D774AD41DF50

Function 02C50894 Relevance: 7.6, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000038), ref: 02C508C0
memcpy.MSVCRT(00000000,00000000,000016C4), ref: 02C508F3
memcpy.MSVCRT(00000000,?,?), ref: 02C50989
memcpy.MSVCRT(00000000,?,?), ref: 02C5099F
memcpy.MSVCRT(00000000,?,?), ref: 02C509B5
memcpy.MSVCRT(00000000,?,?), ref: 02C509C9

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction ID: b1ce5cb8a7bbe498bff4c0239331c69e2cd47c385ad7faa998b6f5f5e4f56530
Opcode Fuzzy Hash: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction Fuzzy Hash: 025181B1600600AFDB14DF68DCC5E9677A9FF88314F088669ED0D8F64AE731E950CB94

Function 02C68F54 Relevance: 7.6, APIs: 5, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,02C68E55,?,?,?,?,?,00000000,00000000), ref: 02C68FC4
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00000000,02C68E55,?,?,?,?,?,00000000,00000000), ref: 02C68FF3
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00000000,02C68E55,?,?,?,?,?,00000000,00000000), ref: 02C68FFE
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,02C68E55,?,?,?,?,?,00000000,00000000), ref: 02C69004
VirtualFree.KERNEL32(?,?,00008000,?,?,?,?,00000000,02C68E55,?,?,?,?,?,00000000,00000000), ref: 02C69044

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Free$HeapVirtual$LibraryProcess
String ID:
API String ID: 565514093-0
Opcode ID: c4b1ced6cffb9864ea216645eba83079f8fa8014517a8bfc374ee1b845c1b89f
Instruction ID: ac54ffbeed8836414ac7405c0490f6aebd67c9b410bc8270fd02728cee7c339c
Opcode Fuzzy Hash: c4b1ced6cffb9864ea216645eba83079f8fa8014517a8bfc374ee1b845c1b89f
Instruction Fuzzy Hash: E831AF75600605AFD720EE68CCC8F36B3AAFF88B14F104668F564CB290C731E9598BE0

Function 02C4C31C Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 02C4C372
GetDeviceCaps.GDI32(00000000,0000000C), ref: 02C4C387
GetDeviceCaps.GDI32(00000000,0000000E), ref: 02C4C391
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,02C4A7DB,00000000,02C4A867), ref: 02C4C3B5
ReleaseDC.USER32(00000000,00000000), ref: 02C4C3C0

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction ID: c9e84037bd8aecef3bd3f2f54615d0d944e08fa5e01d295163319e088595bfd9
Opcode Fuzzy Hash: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction Fuzzy Hash: C7110832142399AEDB20AF75C4407EF3BD6AF85359F041092FC149A1D0CBB58B90DBA5

Function 02C4619C Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 02C461B4
GetDeviceCaps.GDI32(?,00000068), ref: 02C461D0
GetPaletteEntries.GDI32(D6080894,00000000,00000008,?), ref: 02C461E8
GetPaletteEntries.GDI32(D6080894,00000008,00000008,?), ref: 02C46200
ReleaseDC.USER32(00000000,?), ref: 02C4621C

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: a2a65a8cffcfbcf1f080c704d80b1f8efaefa31f867518b8ab98909dd2f032ad
Instruction ID: 8dc8c2ae8a5d110fc3785023fe53d338a2ba847e014631629a153b98da0b9be7
Opcode Fuzzy Hash: a2a65a8cffcfbcf1f080c704d80b1f8efaefa31f867518b8ab98909dd2f032ad
Instruction Fuzzy Hash: 00110431A88344BEFB51DBA8E841F6A7BEDEB09B00F5084D6F614EA1C0DBB69404C720

Function 02B83C28 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,02B83D0B), ref: 02B83CAE
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,02B83D0B), ref: 02B83CB4

Strings

yyyy, xrefs: 02B83C89
, xrefs: 02B83C7A

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 2bd26d82cce11ccc0d28c57afd85f9c2e9b44da8c6c0a8258cf4b096bacc716d
Instruction ID: b788fa94338e74d8926fe11a5a0d29c3295b2c0c4fa55965ede8750c7f89ddb3
Opcode Fuzzy Hash: 2bd26d82cce11ccc0d28c57afd85f9c2e9b44da8c6c0a8258cf4b096bacc716d
Instruction Fuzzy Hash: 46214175A04618ABDB11EF98C895ABEB3F9EF08B00F5140E5FD09E7250E7349E40CBA5

Function 02C43ED0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000000,00000000), ref: 02C43EF7
GetObjectW.GDI32(?,00000010,?), ref: 02C43F0A
GetObjectW.GDI32(?,00000000,?), ref: 02C43F63

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Object
String ID:
API String ID: 2936123098-0
Opcode ID: 1d851fb5a1027d62b7a44852b74bd73f75ab3924783baef76ace4e0b5034ca88
Instruction ID: 1c0825ca394dc220887b0c525c79fd2ec9279cbc1ec75ec430ffd36bef982f27
Opcode Fuzzy Hash: 1d851fb5a1027d62b7a44852b74bd73f75ab3924783baef76ace4e0b5034ca88
Instruction Fuzzy Hash: A931A171604784AFE721DF69C880D6BBBF9EF89210B2485EAF955DB601D731E900CB20

Function 02B6C998 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 02B6C9A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 02B6CA07
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 02B6CA64
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 02B6CA97

Part of subcall function 02B6C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,02B6CA15), ref: 02B6C96B
Part of subcall function 02B6C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,02B6CA15), ref: 02B6C988

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 0b000afb18e6dacb890c1427d88aff219a8a18e208d7499ce094eca533e465cc
Instruction ID: 6815aec142befa7d29a85ae10ff48a89cf8f0c66fec4df768f64e3273db8ecca
Opcode Fuzzy Hash: 0b000afb18e6dacb890c1427d88aff219a8a18e208d7499ce094eca533e465cc
Instruction Fuzzy Hash: 19313C71E0011AABDB10DFE9C88CBBEB7B9FF04304F4045A6D5A5E7285DB799A05CB90

Function 02C4A788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 02C44778: EnterCriticalSection.KERNEL32(02C7DE34,?,02C44858,?,?,?,?,?,?,?,?,00000000,02C44870,?,02C7DE34), ref: 02C44780
Part of subcall function 02C44778: LeaveCriticalSection.KERNEL32(02C7DE34,02C7DE34,?,02C44858,?,?,?,?,?,?,?,?,00000000,02C44870,?,02C7DE34), ref: 02C4478D
Part of subcall function 02C44778: EnterCriticalSection.KERNEL32(?,02C7DE34,02C7DE34,?,02C44858,?,?,?,?,?,?,?,?,00000000,02C44870), ref: 02C44796

Part of subcall function 02C4C31C: GetDC.USER32(00000000), ref: 02C4C372
Part of subcall function 02C4C31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 02C4C387
Part of subcall function 02C4C31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 02C4C391
Part of subcall function 02C4C31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,02C4A7DB,00000000,02C4A867), ref: 02C4C3B5
Part of subcall function 02C4C31C: ReleaseDC.USER32(00000000,00000000), ref: 02C4C3C0

CreateCompatibleDC.GDI32(00000000), ref: 02C4A7DD
SelectObject.GDI32(00000000,?), ref: 02C4A7F6
SelectPalette.GDI32(00000000,?,000000FF), ref: 02C4A81F
RealizePalette.GDI32(00000000), ref: 02C4A82B

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: 3ffb5b68a314d74de448ab402795954848f4e81c571fd387d96d0ffce98dac54
Instruction ID: 980246a6a0aa217ced291307bef745ff303727a1619760b847d4747a2f910801
Opcode Fuzzy Hash: 3ffb5b68a314d74de448ab402795954848f4e81c571fd387d96d0ffce98dac54
Instruction Fuzzy Hash: D731F434A44644EFD714EB69C980D5EB3F6EF48710BA241A1E804AB321CB30EE81EF90

Function 02C4DF8C Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 02C4DFAD
GetObjectW.GDI32(?,00000018,?), ref: 02C4DFCE
DeleteObject.GDI32(?), ref: 02C4DFFA
DeleteObject.GDI32(?), ref: 02C4E003

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: 62707a7b9c379f47bdc47e7f9b3d02683a1ec267ff676a91bf67981d69d354d7
Instruction ID: 33fe048e49f18023b27204cdb7ed385d0312e7a2bca8273dcd206aebc5d999dc
Opcode Fuzzy Hash: 62707a7b9c379f47bdc47e7f9b3d02683a1ec267ff676a91bf67981d69d354d7
Instruction Fuzzy Hash: 3C111C75A00208AFAB04DFA9D981C9EB7F9FB88310B5585A5A915D7250DB31EE00AA90

Function 02C0A910 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,00000000,?,02C0A7FE,00000000,?), ref: 02C0A927
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,02C0A7FE,00000000,?), ref: 02C0A941
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,02C0A7FE,00000000,?), ref: 02C0A95B
LockResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,02C0A7FE,00000000), ref: 02C0A965

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction ID: b1e511ae4608ce4bb61cdceb961cf93b5e2a35c1fd5c628e3f741106777e8898
Opcode Fuzzy Hash: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction Fuzzy Hash: 3DF03CB36052047F5748FE6CA880E6F77EDEF8926035001AAFA18D7345DA30DE025B79

Function 02C4EDD0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 02C4EDD9
SelectObject.GDI32(00000000,058A00B4), ref: 02C4EDEB
GetTextMetricsW.GDI32(00000000), ref: 02C4EDF6
ReleaseDC.USER32(00000000,00000000), ref: 02C4EE07

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: d0001d2a86392a042f6f76adb36a2a3019db7900231a6df8f44a893e2606f3d8
Instruction ID: eb0c0f7218c1ce11a07c6ecdfc9a155021ac56a499d84f676cdb1eafaeb658ce
Opcode Fuzzy Hash: d0001d2a86392a042f6f76adb36a2a3019db7900231a6df8f44a893e2606f3d8
Instruction Fuzzy Hash: 61E086526425B132D75161651D85BDB269D8F426E5F4901D0FD64992C0EF06CE1097F3

Function 02C4EBA4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

SetDIBits.GDI32(00000000,00000000), ref: 02C4ECF4

Strings

,, xrefs: 02C4EC6A
, xrefs: 02C4EC8B

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,
API String ID: 3573556081-71045815
Opcode ID: f6d7b365fd2d492e20ddaa3e732f8eabbe6990316118a2da1408328edddb8e35
Instruction ID: f9770e80d248156505c2ea345f06d40e45827c1d916059ec90b660ade885a3e4
Opcode Fuzzy Hash: f6d7b365fd2d492e20ddaa3e732f8eabbe6990316118a2da1408328edddb8e35
Instruction Fuzzy Hash: D051D075A00208AFDB40DFA9D884E9EB7F9FB48314F5181A5E915EB361DB30EE04CB10

Function 02C4E3C8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

GetDIBits.GDI32(00000000,00000000,00000000,?,?,0000002C,00000000), ref: 02C4E4B2

Strings

, xrefs: 02C4E483
,, xrefs: 02C4E468

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,
API String ID: 3573556081-71045815
Opcode ID: f89da9f29483c14b7df78e09a9896aa6a98fab68bc8d55833a6d853a94ee915f
Instruction ID: a6f8fefd363a17c1b0e246145196d6d109ee01917635572f9437e0dc15dbe459
Opcode Fuzzy Hash: f89da9f29483c14b7df78e09a9896aa6a98fab68bc8d55833a6d853a94ee915f
Instruction Fuzzy Hash: 104125B1A10104AFDB40DFA8C884A9A77FAFF49314B5251A1EC09EB255DB70ED45CF91

Function 02C68BB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 02C68BFD
VirtualProtect.KERNEL32(?,?,?,?,?), ref: 02C68C82

Strings

FinalizeSections: VirtualProtect failed, xrefs: 02C68C90

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID: FinalizeSections: VirtualProtect failed
API String ID: 2581862158-3584865983
Opcode ID: 106a674d75456394c40cbd14f3e703be467fec61811ed34d3ad9f249d72e33ee
Instruction ID: 3f6a7ad1787658d3e9a796dbec8170dac6f5c2c997d07e01d3e0c2daadd3b756
Opcode Fuzzy Hash: 106a674d75456394c40cbd14f3e703be467fec61811ed34d3ad9f249d72e33ee
Instruction Fuzzy Hash: 3D311674702605AFDB10DB5CC9C9FAAB7EABF48344F154280EA54DB3A1C334EA48DB90

Function 02B88748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,02B8BB77,00000000,02B8BCB7), ref: 02B88707

Strings

Z, xrefs: 02B88763
A, xrefs: 02B8875E

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: CharUpper
String ID: A$Z
API String ID: 9403516-4098844585
Opcode ID: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction ID: e3f3dfd4ebf8ba9a252b44e37c43e93a55469bfe0631304f60f114c1585e6508
Opcode Fuzzy Hash: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction Fuzzy Hash: 181138267456181BE73074BE9C95BFBA68BDB863A0FC902BAE549C72C0D9488C41C3D1

Function 02C49928 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetEnhMetaFileBits.GDI32(0000006C,?,00000000,02C499F3), ref: 02C499AB

Strings

EMF, xrefs: 02C4994B
l, xrefs: 02C49959

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: EMF$l
API String ID: 858000408-2398670571
Opcode ID: b58c4b27d9b1ddba5a2458b2db7130fc9bc2c4a9a50b1ac3cc495161c88b081f
Instruction ID: 755b1638cdc4763fa529ccbcaf163b093aa796421989dd9024b7259f8c49d624
Opcode Fuzzy Hash: b58c4b27d9b1ddba5a2458b2db7130fc9bc2c4a9a50b1ac3cc495161c88b081f
Instruction Fuzzy Hash: 76213831A00218DFDB10EFA8C890A6FB7FAFF89710F544269D409AB249DB34AD01DF95

Function 02B889EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,02C6E4DB,00000000,02C6E512), ref: 02B889F2

Part of subcall function 02B739B0: GetProcAddress.KERNEL32(02B9C998,?), ref: 02B739DA

Strings

GetDiskFreeSpaceExW, xrefs: 02B889FD
kernel32.dll, xrefs: 02B889ED

Memory Dump Source

Source File: 00000020.00000002.1629785315.0000000002B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 02B60000, based on PE: true

Associated: 00000020.00000002.1629751702.0000000002B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629918239.0000000002C6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629951953.0000000002C70000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1629988721.0000000002C71000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630023350.0000000002C75000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630059756.0000000002C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630086496.0000000002C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630153321.0000000002C80000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630194479.0000000002C81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1630237473.0000000002C84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2b60000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: 381e5972efbc0a339dbfce02009ff6fcb62c05b502eaeb6a5217066d954b40c7
Instruction ID: fef023ad1dd61e099b6b7da1d70d83b60071c749c016cb40e4f8e1f39e53ef06
Opcode Fuzzy Hash: 381e5972efbc0a339dbfce02009ff6fcb62c05b502eaeb6a5217066d954b40c7
Instruction Fuzzy Hash: 44D05E61A9038B4BE751BAE27484B122B95E300A09B8026E9F32F49A42C7B28410D641

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report n57kYr8YQW.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_179c87a774e29d2b1a37a03f881953e6c2ac927_7522e4b5_523f2ff1-0f9d-47c7-a7f5-50d8a8328fc2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_88e9c7714235511c882c5cf68cc356ed44bb976_7522e4b5_51f7a9c7-1823-4e38-9491-999216950cb2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_88e9c7714235511c882c5cf68cc356ed44bb976_7522e4b5_9573f0f9-eb1a-4019-862f-b313d4edf902\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7846.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78C4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78F4.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F85.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA070.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA10E.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA11B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA36E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3BD.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
n57kYr8YQW.dll