Edit tour

Windows Analysis Report
KfHeFsr9Ce.dll

Overview

General Information

Sample name:	KfHeFsr9Ce.dll renamed because original name is a hash value
Original sample name:	b751e2ba0f0223835582e83eedf94b0e688e47484828be083f0469fb30e86302.dll
Analysis ID:	1544810
MD5:	ce3788861571ea3c978b7a1e4e053334
SHA1:	0f40ba47e4547602695850c2cf0ca99be45f76ec
SHA256:	b751e2ba0f0223835582e83eedf94b0e688e47484828be083f0469fb30e86302
Tags:	2024bankerdllgolangloadermekotiouser-johnk3r
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 2924 cmdline: loaddll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 2816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3564 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 968 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 1496 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 648 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 2256 cmdline: rundll32.exe C:\Users\user\Desktop\KfHeFsr9Ce.dll,BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4048 cmdline: rundll32.exe C:\Users\user\Desktop\KfHeFsr9Ce.dll,BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7068 cmdline: rundll32.exe C:\Users\user\Desktop\KfHeFsr9Ce.dll,BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5468 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5472 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3284 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3964 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeSetFocus MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5916 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeSetDirty MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6912 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeResize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1240 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkePaint2 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1352 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeKillFocus MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 644 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeIsDirty MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7176 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeInitialize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7184 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeGetCaretRect MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7204 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireMouseWheelEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7220 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireMouseEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7232 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireKeyUpEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7240 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireKeyPressEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7248 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireKeyDownEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7264 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireContextMenuEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7276 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFinalize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7320 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeDestroyWebView MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7368 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeCreateWebView MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7380 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",dbkFCallWrapperAddr MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7404 cmdline: rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",__dbk_fcall_wrapper MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: KfHeFsr9Ce.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: KfHeFsr9Ce.dll

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.1% probability

Source: KfHeFsr9Ce.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_041BD1C4 FindFirstFileW,FindClose,	4_2_041BD1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_041BCBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	4_2_041BCBF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_0040D1C4 FindFirstFileW,FindClose,	40_2_0040D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_0040CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	40_2_0040CBF8

Source: unknown

DNS traffic detected: query: 198.187.3.20.in-addr.arpa replaycode: Name error (3)

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: Amcache.hve.8.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0429A1D8 GetClipboardData,CopyEnhMetaFileW,GetEnhMetaFileHeader,

4_2_0429A1D8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0429AA7C GetObjectW,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

4_2_0429AA7C

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042A6444	4_2_042A6444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042A6704	4_2_042A6704
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04260F64	4_2_04260F64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04296918	4_2_04296918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_041EB4C4	4_2_041EB4C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042610A8	4_2_042610A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042AFD00	4_2_042AFD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0429FE80	4_2_0429FE80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042A5F80	4_2_042A5F80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042A1FC4	4_2_042A1FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_004F6444	40_2_004F6444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_004F6704	40_2_004F6704
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_004E6918	40_2_004E6918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_004B0F64	40_2_004B0F64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_004B10A8	40_2_004B10A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_0043B4C4	40_2_0043B4C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_004FFD00	40_2_004FFD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_004EFE80	40_2_004EFE80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_004F1FC4	40_2_004F1FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_004F5F80	40_2_004F5F80

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 648

Source: KfHeFsr9Ce.dll

Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: KfHeFsr9Ce.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal60.winDLL@59/5@1/0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_04295AA0 GetLastError,FormatMessageW,

4_2_04295AA0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_041D19D8 GetDiskFreeSpaceW,

4_2_041D19D8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0425A910 FindResourceW,LoadResource,SizeofResource,LockResource,

4_2_0425A910

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess968
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2816:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\72eb9324-90ea-41b3-85cd-9898baab4786

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\KfHeFsr9Ce.dll,BarCreate

Source: KfHeFsr9Ce.dll

ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\KfHeFsr9Ce.dll,BarCreate
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 648
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\KfHeFsr9Ce.dll,BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\KfHeFsr9Ce.dll,BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",BarCreate
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeSetFocus
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeSetDirty
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeResize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkePaint2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeKillFocus
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeIsDirty
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeInitialize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeGetCaretRect
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireMouseWheelEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireMouseEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireKeyUpEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireKeyPressEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireKeyDownEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireContextMenuEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFinalize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeDestroyWebView
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeCreateWebView
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",dbkFCallWrapperAddr
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",__dbk_fcall_wrapper
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\KfHeFsr9Ce.dll,BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\KfHeFsr9Ce.dll,BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\KfHeFsr9Ce.dll,BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeSetFocus	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeSetDirty	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeResize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkePaint2	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeKillFocus	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeIsDirty	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeInitialize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeGetCaretRect	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireMouseWheelEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireMouseEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireKeyUpEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireKeyPressEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireKeyDownEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireContextMenuEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFinalize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeDestroyWebView	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeCreateWebView	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",dbkFCallWrapperAddr	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",__dbk_fcall_wrapper	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: KfHeFsr9Ce.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: KfHeFsr9Ce.dll

Static file information: File size 1271296 > 1048576

Source: KfHeFsr9Ce.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x10cc00

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_042B90EC LoadLibraryW,GetProcAddress,GetProcAddress,IsBadReadPtr,

4_2_042B90EC

Source: KfHeFsr9Ce.dll

Static PE information: section name: .didata

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042BE47C push 042BE519h; ret	4_2_042BE511
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042BE000 push 042BE0DEh; ret	4_2_042BE0D6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04214450 push ecx; mov dword ptr [esp], ecx	4_2_04214454
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042BE540 push 042BE5F6h; ret	4_2_042BE5EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0427460C push ecx; mov dword ptr [esp], edx	4_2_0427460D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042BE610 push 042BE671h; ret	4_2_042BE669
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0421670C push ecx; mov dword ptr [esp], edx	4_2_0421670D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0421671C push ecx; mov dword ptr [esp], edx	4_2_0421671D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042BE740 push 042BE7DCh; ret	4_2_042BE7D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042327C4 push 04232826h; ret	4_2_0423281E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042B4014 push 042B403Ah; ret	4_2_042B4032
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04210068 push ecx; mov dword ptr [esp], edx	4_2_04210069
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_041E80A4 push ecx; mov dword ptr [esp], eax	4_2_041E80A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042B41A4 push 042B41CAh; ret	4_2_042B41C2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04214264 push ecx; mov dword ptr [esp], ecx	4_2_04214268
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04216248 push ecx; mov dword ptr [esp], ecx	4_2_0421624C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0426E2E4 push ecx; mov dword ptr [esp], edx	4_2_0426E2E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042742F4 push ecx; mov dword ptr [esp], edx	4_2_042742F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042182FC push ecx; mov dword ptr [esp], ecx	4_2_04218300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0426A2F8 push ecx; mov dword ptr [esp], edx	4_2_0426A2FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04270340 push ecx; mov dword ptr [esp], edx	4_2_04270341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042B2340 push 042B2398h; ret	4_2_042B2390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042BA35C push 042BA3A8h; ret	4_2_042BA3A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_042B239C push ecx; mov dword ptr [esp], ecx	4_2_042B23A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_041EA3D0 push ecx; mov dword ptr [esp], eax	4_2_041EA3D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04276C80 push ecx; mov dword ptr [esp], edx	4_2_04276C81
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04212CE0 push ecx; mov dword ptr [esp], ecx	4_2_04212CE4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04216CFC push ecx; mov dword ptr [esp], ecx	4_2_04216D00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_041E6D2C push ecx; mov dword ptr [esp], ecx	4_2_041E6D2F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0426CE1C push ecx; mov dword ptr [esp], edx	4_2_0426CE1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04278E4C push ecx; mov dword ptr [esp], edx	4_2_04278E4D

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.6 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.5 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_041BD1C4 FindFirstFileW,FindClose,	4_2_041BD1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_041BCBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	4_2_041BCBF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_0040D1C4 FindFirstFileW,FindClose,	40_2_0040D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 40_2_0040CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	40_2_0040CBF8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_041BEE84 GetSystemInfo,

4_2_041BEE84

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node			graph_4-47381
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node			graph_40-48044

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_04268000 IsDebuggerPresent,RaiseException,

4_2_04268000

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_042B90EC LoadLibraryW,GetProcAddress,GetProcAddress,IsBadReadPtr,

4_2_042B90EC

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_042B8BF4 VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualAlloc,VirtualAlloc,

4_2_042B8BF4

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_041B79E8 cpuid

4_2_041B79E8

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	4_2_041BD2FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_041BC79C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_041D8FD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_041D920C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_041D5334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_041D5380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	40_2_0040D2FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	40_2_0040C79C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	40_2_00428FD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	40_2_0042920C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	40_2_00425334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	40_2_00425380

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_041D3818 GetLocalTime,

4_2_041D3818

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_041BC520 InitializeCriticalSection,GetVersion,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,

4_2_041BC520

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
KfHeFsr9Ce.dll	50%	ReversingLabs	Win32.Trojan.Midie
KfHeFsr9Ce.dll	100%	Avira	TR/Redcap.aliue

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
198.187.3.20.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544810
Start date and time:	2024-10-29 19:14:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KfHeFsr9Ce.dll renamed because original name is a hash value
Original Sample Name:	b751e2ba0f0223835582e83eedf94b0e688e47484828be083f0469fb30e86302.dll
Detection:	MAL
Classification:	mal60.winDLL@59/5@1/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 34 Number of non-executed functions: 144
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.172
Excluded domains from analysis (whitelisted): onedsblobprdeus07.eastus.cloudapp.azure.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: KfHeFsr9Ce.dll

Simulations

Behavior and APIs

Time	Type	Description
14:15:03	API Interceptor	1x Sleep call for process: loaddll32.exe modified
14:15:13	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c5d089c8cf748e1b13ba2105216189e689b02e_7522e4b5_13afcf82-ac04-4d3d-a715-aa7139a6a92a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.869732281566418
Encrypted:	false
SSDEEP:	192:SueHiiOeah0BU/wjeT4zuiFaZ24IO84ci:SBHiDeaiBU/wjeMzuiFaY4IO84ci
MD5:	E6BBAEC743BE236791DB60F6670EAA9C
SHA1:	C0977C099B13C17050A377F39751BA80DF1489DD
SHA-256:	B2BFCE7BAB011963F5190F1D9AAAF204178B96712C06BAB429F48875102C1B08
SHA-512:	6625698FDE759A9AE6EC8F7B9D73B6F19927C544CA7E0FAA5B8B9DE43F6DEDF8CB5CB492B67FF061268FD8916BAE1801F0875167ADE2D61F89CBDB8E0D298830
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.9.2.9.3.8.9.7.3.6.9.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.9.2.9.4.2.8.7.9.9.7.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.3.a.f.c.f.8.2.-.a.c.0.4.-.4.d.3.d.-.a.7.1.5.-.a.a.7.1.3.9.a.6.a.9.2.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.5.6.a.2.7.d.3.-.6.7.b.0.-.4.a.a.5.-.a.4.9.4.-.1.c.6.d.5.c.c.2.9.6.e.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.3.c.8.-.0.0.0.1.-.0.0.1.4.-.0.1.5.f.-.a.5.7.3.2.e.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.r.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7334.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 18:14:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42908
Entropy (8bit):	1.952828786075903
Encrypted:	false
SSDEEP:	96:538uB6Uyoqs71ytSz/sw08XuSgyvsoi75I4v4aiq8Jh4KgGV20bMGI6uyr1WIkWE:O12bsYXtO5H4B2GI6kIkW45fd9LA3K
MD5:	324047FD8360A59B5229BEC9D32B4CCC
SHA1:	BCBDA42F42384960E8530EA53D308CF67BCEFB8D
SHA-256:	F666086C1FF0340FD9AA7A133A17660CEDD42F5489734605D0F678C1A99AF843
SHA-512:	60B15C58306C37DA25295858F694D03B3709809574AA114E43DFFD71E27DFE8AEAF0C212AC4D3AB6686F189E3B6DDDAF0C431F256ACA8D85E574F2E730262381
Malicious:	false
Preview:	MDMP..a..... ........&!g.........................................)..........T.......8...........T......................................................................................................................eJ......,.......GenuineIntel............T............&!g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER73C2.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8318
Entropy (8bit):	3.6893259944774357
Encrypted:	false
SSDEEP:	192:R6l7wVeJKm6IUzMz6YHe6Hgmf8P8prQ89b5lsfATm:R6lXJT6IUzMz6Y+6Hgmf8PE5+fp
MD5:	39BC90B51972ACF092AE3CCE1B43DB1D
SHA1:	CE895D620906EC1B1F779C0E1709C4D53139B450
SHA-256:	E363BED5B380D6B99B7F34D2C6017FC179FF61C1F11EBC50CFD769E405F48453
SHA-512:	ACE9232DFACB5859B7F0A4651004D7D8439F6F11F8EB4E6B173F63D6D73BEDB3F4475AAD0419FBA25A14AB413380A8D02958C21862B1986FD86356463C6137DC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.9.6.8.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER73F2.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4751
Entropy (8bit):	4.45169200378925
Encrypted:	false
SSDEEP:	48:cvIwWl8zsOJg77aI9qFWpW8VYO5Ym8M4JCdP7nFuDL+q8vjP7i786GScS9d:uIjfEI7k07VBoJEQLKXiY6J39d
MD5:	70DBA7CA60FD579D6EB0D92A76DB2161
SHA1:	E5D648A258DC31F2FD5EECBA6697D8AFB0DCDE0A
SHA-256:	4C0D641DA73C78F41AB0D47D6290A64B2890C3F12A4D0B6364C063317B3B8D2C
SHA-512:	60F604468B65B1BBEA3016F99EEB7B4A2C423E2DC202FD6D36DD8C96EA9E17FDEEDFDB1E9C8AEC495FB31DF85F9D25879B9FCD1F12E27716FB52E1E7355FAF8E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565037" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.417446721560075
Encrypted:	false
SSDEEP:	6144:5cifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNo5+:mi58oSWIZBk2MM6AFBWo
MD5:	73910DF7A1CBF6F4E9543B5EA194866A
SHA1:	45BDBF694DDAA4C95A7C0478DB79447DE3F48C4D
SHA-256:	5687E729206B0CB2EBAA666C93357B3C2B302E89A2BFD8BEBFAAA59400742CB9
SHA-512:	6A43D64B8F4A39861DA9003D1F0142DD5220F52DC6AF12C167BB8CF27F645E1CC8002E24D631B4D9B0B8837237F626667817DFC85597EA926515AC4F08C369BA
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmbX.s.*................................................................................................................................................................................................................................................................................................................................................G........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.646787288668097
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 95.46% Win32 EXE PECompact compressed (generic) (41571/9) 3.96% Win16/32 Executable Delphi generic (2074/23) 0.20% Generic Win/DOS Executable (2004/3) 0.19% DOS Executable Generic (2002/1) 0.19%
File name:	KfHeFsr9Ce.dll
File size:	1'271'296 bytes
MD5:	ce3788861571ea3c978b7a1e4e053334
SHA1:	0f40ba47e4547602695850c2cf0ca99be45f76ec
SHA256:	b751e2ba0f0223835582e83eedf94b0e688e47484828be083f0469fb30e86302
SHA512:	6c314a9edb3c20453fafd58b7d581783dbd63a2efb3b3cb921d8e01babc0a19940a640e623cfcacee630b9f680d7dc1a4e83e05ac607af3301d0d49b50feff67
SSDEEP:	24576:JGETpy4J+EQMAFF1E3CEQlBDzYYTtVKh:j4bE8ayEMDzvTtVK
TLSH:	8A455C62F245643EC4AA0A364977AD50583FB7A2755EEC1E57F40888CE399802F3E74F
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x50eee0
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x66F43F85 [Wed Sep 25 16:51:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6327992c879b906e750778c69d550fed

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC0h
mov eax, 0050A408h
call 00007FDFDD12937Dh
call 00007FDFDD122798h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x122000	0x2aa	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11f000	0x1c46	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13d000	0x4800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x124000	0x18530	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11f5a4	0x464	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x121000	0x366	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10ca14	0x10cc00	046e597cffeb82a4bdf348816a633a2a	False	0.3667287427325581	data	6.4916614356338	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x10e000	0xef8	0x1000	3a54ae111c8d1a5d39d344d2e7f9ea92	False	0.535888671875	data	6.088005153435772	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x10f000	0x8f88	0x9000	1c4fab99f1efc6403a90e0d2d02f1254	False	0.6362847222222222	data	6.625889571431147	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x118000	0x6310	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x11f000	0x1c46	0x1e00	bd166391d3b2991897d3f90ec0b419cb	False	0.32083333333333336	data	4.974350011480841	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x121000	0x366	0x400	9c7b1e6fd492c18332b403fa3ad29c2e	False	0.3544921875	data	3.0967012674854977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x122000	0x2aa	0x400	9b25950f1b106824ad0c07317449bd35	False	0.4189453125	data	4.062505967588195	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rdata	0x123000	0x44	0x200	c9f8bfa36b2dc5163b75d3196d251b45	False	0.15625	data	1.1660636886017055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x124000	0x18530	0x18600	20654efab06deda36829fe36a4297e21	False	0.5805789262820513	data	6.71113397411243	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x13d000	0x4800	0x4800	11b249e4413f47e4fa8fd82b7be1a2d1	False	0.2676866319444444	data	3.612722643299022	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_STRING	0x13d460	0x31c	DOS executable (COM, 0x8C-variant)			0.4258793969849246
RT_STRING	0x13d77c	0xb5c	data			0.2548143053645117
RT_STRING	0x13e2d8	0x428	data			0.37406015037593987
RT_STRING	0x13e700	0x3c4	data			0.37655601659751037
RT_STRING	0x13eac4	0x3cc	data			0.2757201646090535
RT_STRING	0x13ee90	0x394	data			0.4334061135371179
RT_STRING	0x13f224	0x4e4	data			0.35303514376996803
RT_STRING	0x13f708	0x374	data			0.3563348416289593
RT_STRING	0x13fa7c	0x454	data			0.38898916967509023
RT_STRING	0x13fed0	0x1ec	data			0.3983739837398374
RT_STRING	0x1400bc	0xc4	data			0.6428571428571429
RT_STRING	0x140180	0x170	data			0.5597826086956522
RT_STRING	0x1402f0	0x334	data			0.41585365853658535
RT_STRING	0x140624	0x408	data			0.3168604651162791
RT_STRING	0x140a2c	0x36c	data			0.4018264840182648
RT_STRING	0x140d98	0x2b8	data			0.4367816091954023
RT_RCDATA	0x141050	0x10	data			1.5
RT_RCDATA	0x141060	0x390	data			0.6008771929824561
RT_RCDATA	0x1413f0	0x2	data	English	United States	5.0
RT_VERSION	0x1413f4	0x218	data	English	United States	0.4626865671641791

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, TlsFree, TlsAlloc, LocalFree, LocalAlloc, FreeLibrary
user32.dll	ReleaseDC, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, LoadImageW, LoadIconW, GetSystemMetrics, GetSysColor, GetIconInfo, GetDC, GetClipboardData, FrameRect, FillRect, DrawTextExW, DrawIconEx, DrawFocusRect, DestroyIcon, CreateIcon, CopyIcon, CharUpperBuffW, CharUpperW, CharLowerBuffW
gdi32.dll	UnrealizeObject, StretchDIBits, StretchBlt, SetWinMetaFileBits, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, RoundRect, ResizePalette, Rectangle, RealizePalette, Polyline, Polygon, PolyBezierTo, PolyBezier, PlayEnhMetaFile, Pie, PatBlt, MoveToEx, MaskBlt, LineTo, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsW, GetTextExtentPoint32W, GetSystemPaletteEntries, GetStretchBltMode, GetStockObject, GetPixel, GetPaletteEntries, GetObjectW, GetNearestPaletteIndex, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionW, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExtTextOutW, ExtFloodFill, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectW, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileW, Chord, BitBlt, ArcTo, Arc, AngleArc
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, VerSetConditionMask, VerifyVersionInfoW, SwitchToThread, SuspendThread, Sleep, SizeofResource, SetThreadPriority, SetFilePointer, SetEvent, SetEndOfFile, ResumeThread, ResetEvent, ReadFile, RaiseException, IsDebuggerPresent, MulDiv, LockResource, LocalFree, LoadResource, LoadLibraryW, LeaveCriticalSection, IsValidLocale, IsBadReadPtr, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GetVersionExW, GetTickCount, GetThreadPriority, GetThreadLocale, GetStdHandle, GetProcessHeap, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetExitCodeThread, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcess, GetCPInfoExW, GetCPInfo, GetACP, FreeResource, FreeLibrary, FormatMessageW, FindResourceW, EnumSystemLocalesW, EnumCalendarInfoW, EnterCriticalSection, DeleteCriticalSection, CreateFileW, CreateEventW, CompareStringW, CloseHandle
advapi32.dll	RegUnLoadKeyW, RegSetValueExW, RegSaveKeyW, RegRestoreKeyW, RegReplaceKeyW, RegQueryValueExW, RegQueryInfoKeyW, RegOpenKeyExW, RegLoadKeyW, RegFlushKey, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegConnectRegistryW, RegCloseKey
kernel32.dll	Sleep
netapi32.dll	NetApiBufferFree, NetWkstaGetInfo
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
ole32.dll	CoCreateInstance, IsEqualGUID
msvcrt.dll	memset, memcpy

Exports

Name	Ordinal	Address
BarCreate	4	0x50a3fc
BarDestroy	5	0x50a3f8
BarFreeRec	6	0x50a3f4
BarRecognize	7	0x50a3f0
TMethodImplementationIntercept	3	0x45f330
__dbk_fcall_wrapper	2	0x41041c
dbkFCallWrapperAddr	1	0x51b630
wkeCreateWebView	13	0x50a3d8
wkeDestroyWebView	8	0x50a3ec
wkeFinalize	9	0x50a3e8
wkeFireContextMenuEvent	16	0x50a3cc
wkeFireKeyDownEvent	12	0x50a3dc
wkeFireKeyPressEvent	14	0x50a3d4
wkeFireKeyUpEvent	23	0x50a3b0
wkeFireMouseEvent	15	0x50a3d0
wkeFireMouseWheelEvent	17	0x50a3c8
wkeGetCaretRect	20	0x50a3bc
wkeInitialize	22	0x50a3b4
wkeIsDirty	21	0x50a3b8
wkeKillFocus	19	0x50a3c0
wkePaint2	24	0x50a3ac
wkeResize	11	0x50a3e0
wkeSetDirty	10	0x50a3e4
wkeSetFocus	18	0x50a3c4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 19:15:25.974843025 CET	53	60068	162.159.36.2	192.168.2.7
Oct 29, 2024 19:15:26.578897953 CET	59747	53	192.168.2.7	1.1.1.1
Oct 29, 2024 19:15:26.590213060 CET	53	59747	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 19:15:26.578897953 CET	192.168.2.7	1.1.1.1	0x4709	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 19:15:26.590213060 CET	1.1.1.1	192.168.2.7	0x4709	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	14:14:53
Start date:	29/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll"
Imagebase:	0xf0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:14:53
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:14:53
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",#1
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:14:53
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\KfHeFsr9Ce.dll,BarCreate
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:14:53
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",#1
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:14:53
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 648
Imagebase:	0xc40000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:14:56
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\KfHeFsr9Ce.dll,BarDestroy
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:14:59
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\KfHeFsr9Ce.dll,BarFreeRec
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",BarCreate
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",BarDestroy
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",BarFreeRec
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeSetFocus
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeSetDirty
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeResize
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkePaint2
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeKillFocus
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeIsDirty
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeInitialize
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeGetCaretRect
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireMouseWheelEvent
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireMouseEvent
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireKeyUpEvent
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireKeyPressEvent
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireKeyDownEvent
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFireContextMenuEvent
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	14:15:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeFinalize
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	14:15:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeDestroyWebView
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	14:15:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",wkeCreateWebView
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	14:15:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",dbkFCallWrapperAddr
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	14:15:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\KfHeFsr9Ce.dll",__dbk_fcall_wrapper
Imagebase:	0x150000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.7%
Total number of Nodes:	331
Total number of Limit Nodes:	23

Executed Functions

Function 041BD2FC Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,041BD3BC,?,?), ref: 041BD32E
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,041BD3BC,?,?), ref: 041BD337

Part of subcall function 041BD1C4: FindFirstFileW.KERNEL32(00000000,?,00000000,041BD222,?,00000001), ref: 041BD1F7
Part of subcall function 041BD1C4: FindClose.KERNEL32(00000000,00000000,?,00000000,041BD222,?,00000001), ref: 041BD207

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 9db5d744d8cf5f3d86c69d8eb86ad0375798415690cbc054d103c352f618b9d5
Instruction ID: c8276219bd3b570cf5518afa5e3998b9013db9a39c0dceea2c29777cc43cda07
Opcode Fuzzy Hash: 9db5d744d8cf5f3d86c69d8eb86ad0375798415690cbc054d103c352f618b9d5
Instruction Fuzzy Hash: 03119DB0A042099BEF04EFA4D9C0AEEB3B8EF48308F504475E984E7350DB747E058AA5

Function 041BD1C4 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,041BD222,?,00000001), ref: 041BD1F7
FindClose.KERNEL32(00000000,00000000,?,00000000,041BD222,?,00000001), ref: 041BD207

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 58f5fb5532b0bac8cca11cd80d5749b04a2358669ef466d3d240d8a61f02fafd
Instruction ID: 6371fc4e69635e29d04bd59c0291cd53ee2ba95f7b229b0061a161a1feca4dcc
Opcode Fuzzy Hash: 58f5fb5532b0bac8cca11cd80d5749b04a2358669ef466d3d240d8a61f02fafd
Instruction Fuzzy Hash: AEF082B1554648AFEB11FB79ECD18DEB7FCEB4821479005E1E484D3190EB35BE0099D4

Function 041BEE84 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 041BEE88

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction ID: 46f13a23367281e221c09cb1f53547ee609bc858767288c2cc2a9481c7cf8950
Opcode Fuzzy Hash: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction Fuzzy Hash: 10A012104084001EC408B7184C8244F3180194101CFC40610E89C953C1E705956502DB

Function 041BCDE8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,041BD00D,?,?), ref: 041BCE21
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,041BD00D,?,?), ref: 041BCE6A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,041BD00D,?,?), ref: 041BCE8C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 041BCEAA
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 041BCEC8
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 041BCEE6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 041BCF04
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,041BCFF0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,041BD00D), ref: 041BCF44
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,041BCFF0,?,80000001), ref: 041BCF6F
RegCloseKey.ADVAPI32(?,041BCFF7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,041BCFF0,?,80000001,Software\Embarcadero\Locales), ref: 041BCFEA

Strings

Software\Borland\Locales, xrefs: 041BCEDC
Software\Borland\Delphi\Locales, xrefs: 041BCEFA
Software\CodeGear\Locales, xrefs: 041BCEA0, 041BCEBE
Software\Embarcadero\Locales, xrefs: 041BCE60, 041BCE82

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 674c153533d616b4fef6cd43469a3e80ff32ddc7e21d278681e3bb730668286f
Instruction ID: ccdf790d13159495da46529899995155ec0a769d4a3766151f70494d47d4d764
Opcode Fuzzy Hash: 674c153533d616b4fef6cd43469a3e80ff32ddc7e21d278681e3bb730668286f
Instruction Fuzzy Hash: 21510475B40209BEEB10EBA5DCC1FEEB7BCDB08708F5040A9FA44E6181E770B9408AD5

Function 041BCAB4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(042CAC10,00000000,041BCBB8,?,?,?,00000000,?,041BD480,00000000,041BD4DF,?,?,00000000,00000000,00000000), ref: 041BCAD2
LeaveCriticalSection.KERNEL32(042CAC10,042CAC10,00000000,041BCBB8,?,?,?,00000000,?,041BD480,00000000,041BD4DF,?,?,00000000,00000000), ref: 041BCAF6
LeaveCriticalSection.KERNEL32(042CAC10,042CAC10,00000000,041BCBB8,?,?,?,00000000,?,041BD480,00000000,041BD4DF,?,?,00000000,00000000), ref: 041BCB05
IsValidLocale.KERNEL32(00000000,00000002,042CAC10,042CAC10,00000000,041BCBB8,?,?,?,00000000,?,041BD480,00000000,041BD4DF), ref: 041BCB17
EnterCriticalSection.KERNEL32(042CAC10,00000000,00000002,042CAC10,042CAC10,00000000,041BCBB8,?,?,?,00000000,?,041BD480,00000000,041BD4DF), ref: 041BCB74
LeaveCriticalSection.KERNEL32(042CAC10,042CAC10,00000000,00000002,042CAC10,042CAC10,00000000,041BCBB8,?,?,?,00000000,?,041BD480,00000000,041BD4DF), ref: 041BCB9D

Strings

en-GB,en,en-US,, xrefs: 041BCAE2, 041BCB89

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: e31168a0c1c4b47efcffcfe7dce7aa012b1f223f64b1347fd2320dee3ec0dceb
Instruction ID: 977492f274743f97f8c04fb9afa2fe9f7f086b1764c34bc5a8d764e43e71d7c7
Opcode Fuzzy Hash: e31168a0c1c4b47efcffcfe7dce7aa012b1f223f64b1347fd2320dee3ec0dceb
Instruction Fuzzy Hash: 2621AC2035020867FB10BB68DDD1BED2289DF89B8CF514569E5C096240EBA4BE419BEA

Function 0429EE14 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0429EE3A

Part of subcall function 0429EDD0: GetDC.USER32(00000000), ref: 0429EDD9
Part of subcall function 0429EDD0: SelectObject.GDI32(00000000,058A00B4), ref: 0429EDEB
Part of subcall function 0429EDD0: GetTextMetricsW.GDI32(00000000), ref: 0429EDF6
Part of subcall function 0429EDD0: ReleaseDC.USER32(00000000,00000000), ref: 0429EE07

Strings

Tahoma, xrefs: 0429EE5C
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 0429EE90
MS Shell Dlg 2, xrefs: 0429EEA4

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma
API String ID: 2013942131-1011973972
Opcode ID: 03319b45b165fa06ae77fd0d41cf680e5376c951f7cf58360baf007441796f70
Instruction ID: 8127130c60e2b2a849149bb4302a6f4769a8b5d5391cdeadad8c8826972674d9
Opcode Fuzzy Hash: 03319b45b165fa06ae77fd0d41cf680e5376c951f7cf58360baf007441796f70
Instruction Fuzzy Hash: 20119170720109EFEB11EF68DC51A9D7BE5EB46618F9240A5E440E77C0DB71BD41CB50

Function 041B961C Relevance: 6.2, APIs: 4, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 041B9653

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: bb6eb97e832477aa5264c684c41f99a138805b2e2d54a00bbf9cf3c4423b8c03
Instruction ID: 8fad123bc32317800984bd38b2f2e53d272f563653a35b31ec212590871e7250
Opcode Fuzzy Hash: bb6eb97e832477aa5264c684c41f99a138805b2e2d54a00bbf9cf3c4423b8c03
Instruction Fuzzy Hash: 5B5183B06106049FEB24EF78D4C87DA7BE1EF49318F148599E6898B241D774F886CBE1

Function 042BE000 Relevance: 6.0, APIs: 4, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadLocale.KERNEL32(00000400,00000000,042BE0D7), ref: 042BE02D

Part of subcall function 041BC520: InitializeCriticalSection.KERNEL32(042CAC10,042BE037,00000400,00000000,042BE0D7), ref: 041BC525
Part of subcall function 041BC520: GetVersion.KERNEL32(042CAC10,042BE037,00000400,00000000,042BE0D7), ref: 041BC533
Part of subcall function 041BC520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,042CAC10,042BE037,00000400,00000000,042BE0D7), ref: 041BC55A
Part of subcall function 041BC520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041BC560
Part of subcall function 041BC520: GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,042CAC10,042BE037,00000400,00000000,042BE0D7), ref: 041BC574
Part of subcall function 041BC520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041BC57A
Part of subcall function 041BC520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,042CAC10,042BE037,00000400,00000000,042BE0D7), ref: 041BC58E
Part of subcall function 041BC520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041BC594

Part of subcall function 041BEE84: GetSystemInfo.KERNEL32 ref: 041BEE88

GetCommandLineW.KERNEL32(00000400,00000000,042BE0D7), ref: 042BE092

Part of subcall function 041B5244: GetStartupInfoW.KERNEL32 ref: 041B5255

GetACP.KERNEL32(00000400,00000000,042BE0D7), ref: 042BE0A6
GetCurrentThreadId.KERNEL32 ref: 042BE0BA

Part of subcall function 041BEE98: GetVersion.KERNEL32(042BE0C9,00000400,00000000,042BE0D7), ref: 041BEE98

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$InfoThreadVersion$CommandCriticalCurrentInitializeLineLocaleSectionStartupSystem
String ID:
API String ID: 2740004594-0
Opcode ID: f5cf1e4e2f5509851ca5cf626d369aa113429cbe8a9c565c77d8d72d32bc2b42
Instruction ID: 3bb07dd8c29613f991da2cbf4e18f3aa951b529f5bc200c2ac1f094be3236e93
Opcode Fuzzy Hash: f5cf1e4e2f5509851ca5cf626d369aa113429cbe8a9c565c77d8d72d32bc2b42
Instruction Fuzzy Hash: F71127706047909AF701FF78F8882997BA5FB4530EF02C868C5845A640EB7D6804CBFB

Function 0428915C Relevance: 4.6, APIs: 3, Instructions: 150
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,0428931F), ref: 042891D5
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,0428931F), ref: 0428924B
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 042892BC

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 15672229bcf894a18db3ab013dc9929c4b4ca9759090ce4f175f1b9baa35dfed
Instruction ID: a81f7750591f7a720a6be3e42686bba1327af0b202e0f2e6de6feeec9172f00d
Opcode Fuzzy Hash: 15672229bcf894a18db3ab013dc9929c4b4ca9759090ce4f175f1b9baa35dfed
Instruction Fuzzy Hash: 06518F70B11208ABEB11FBA4CC80B9EB7FAAF44244F5084A8E444E3691DB75BF45D795

Function 041D7884 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,041D7984), ref: 041D78C9
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,041D7967,?,00000000,?,00000000,041D7984), ref: 041D7902
VerQueryValueW.VERSION(?,041D7998,?,?,00000000,?,00000000,?,00000000,041D7967,?,00000000,?,00000000,041D7984), ref: 041D791C

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: 063ee09806459c86d3b4d4acd805ec5aeb070e0eba1c760e5baa4e245ffb7b08
Instruction ID: aaf2091565754dc392996b1161dcd0b49571050bbe2c7f9024c2f38078523a75
Opcode Fuzzy Hash: 063ee09806459c86d3b4d4acd805ec5aeb070e0eba1c760e5baa4e245ffb7b08
Instruction Fuzzy Hash: 94314AB1A04209AFEB05DFA9CCC1DAEB7F8EB49614B5144B9E954E3240DB74FE00CB60

Function 041BD3C8 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,041BD4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,041BD566,00000000,?,00000105), ref: 041BD473
GetSystemDefaultUILanguage.KERNEL32(00000000,041BD4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,041BD566,00000000,?,00000105), ref: 041BD49B

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: a58fe448486b6e110776d3af077d49821fb0ec07e8ce93d780aeaf178ec9ba27
Instruction ID: 2a55e5313c254c6a567b5edb79eb32694d65ae7e2dd350dd3941c65e64f323ad
Opcode Fuzzy Hash: a58fe448486b6e110776d3af077d49821fb0ec07e8ce93d780aeaf178ec9ba27
Instruction Fuzzy Hash: F7311A70A142499FEB18EFA8D8C0AEEB7B5EF44308F5044A5D580A3A50DB74BD418BD1

Function 041BD4EC Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,041BD5A6,?,041B0000,042BFC1C), ref: 041BD528
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,041BD5A6,?,041B0000,042BFC1C), ref: 041BD579

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: e1310149e450ea55170845e33ecd854db219985c379f8c0e2b4dd8f8737d885d
Instruction ID: 627823a4afd5ed1bfbaad8b337bc865197f59f1a146aae48984a162c3e25f5ed
Opcode Fuzzy Hash: e1310149e450ea55170845e33ecd854db219985c379f8c0e2b4dd8f8737d885d
Instruction Fuzzy Hash: A9119170A4431CABEB14EB50DCC5BDD73B8DB04308F4140E5E548A3290EB706F818ED5

Function 041B5600 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,041B5C17), ref: 041B5617

Strings

@., xrefs: 041B5652, 041B5670

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: @.
API String ID: 4275171209-4201455939
Opcode ID: b73764b605d07c5d6af817081b5ec9277439b985cf20e56ac608a3539c3f375d
Instruction ID: 747c20afcb1ed764b279dacce43452eb3817c491c2cab3c23a054d62e55eb9e8
Opcode Fuzzy Hash: b73764b605d07c5d6af817081b5ec9277439b985cf20e56ac608a3539c3f375d
Instruction Fuzzy Hash: 49F03CB2B002115FE714AF7CE9447426AE5EB4935AF15827EE949DB784EB749C008B80

Function 04288EA0 Relevance: 3.0, APIs: 2, Instructions: 18
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegFlushKey.ADVAPI32(00000000,?,04288F0C,?,?,00000000,04289123,00000000,00000000,00000000,?,?,00000000,04289139), ref: 04288EB1
RegCloseKey.ADVAPI32(00000000,?,04288F0C,?,?,00000000,04289123,00000000,00000000,00000000,?,?,00000000,04289139), ref: 04288EBA

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction ID: ccb905ead48cadd92af5110fc9db1062959b7389a1b650c850c741433c66a326
Opcode Fuzzy Hash: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction Fuzzy Hash: 16D017E0B212098AEF51FF79C9C4A86BBDC6F04204B48C4AAAD08CF186D734E4008B20

Function 04289EDC Relevance: 1.6, APIs: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,04289BB9), ref: 04289F07

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2cc339edae3f7b5d8c4a46d9a49a5521e4ac1dbbb7f9da79116d34b443c0f04b
Instruction ID: 3cc68c5f94065dca73247305ccde4644cd3768e8d0223422d6cc88f99969c062
Opcode Fuzzy Hash: 2cc339edae3f7b5d8c4a46d9a49a5521e4ac1dbbb7f9da79116d34b443c0f04b
Instruction Fuzzy Hash: 66017575B01108AFEB00EEACDCC09DEB7ACDB58214F108166F954D7341D675AE0587A0

Function 042898DC Relevance: 1.5, APIs: 1, Instructions: 36
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,?,?,?,04289AE0,00000000,04289C1C), ref: 0428990D

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 45af8dcbdd2c5adf3947c8e46fc95e82dd974bf530efeb322097dd60e67ff395
Instruction ID: 55f5c890ac3385d7a94d87faecfa0ac407ac2191a13c506a4270d3df299f126f
Opcode Fuzzy Hash: 45af8dcbdd2c5adf3947c8e46fc95e82dd974bf530efeb322097dd60e67ff395
Instruction Fuzzy Hash: FEF030623051046FE344FA6C9CC4F9B66DCDBC8654F10843EF68CC7281DA60EC0583A1

Function 041BC278 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(041B0000,?,0000020A), ref: 041BC296

Part of subcall function 041BD4EC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,041BD5A6,?,041B0000,042BFC1C), ref: 041BD528
Part of subcall function 041BD4EC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,041BD5A6,?,041B0000,042BFC1C), ref: 041BD579

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction ID: 23a94c4d1979accf37a5d2ca950fbe86a3bbb1025ad0f673bffa8dd61b47e494
Opcode Fuzzy Hash: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction Fuzzy Hash: 56E0ED71A003109BDB14DF98D9C5A9637D8AB08658F044595ED54CF346E771E91087D1

Non-executed Functions

Function 0429AA7C Relevance: 48.5, APIs: 32, Instructions: 501windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 0429AAFC
GetDC.USER32(00000000), ref: 0429AB0D
CreateCompatibleDC.GDI32(00000000), ref: 0429AB1E
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0429AB6A
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 0429AB8E
SelectObject.GDI32(?,?), ref: 0429ADE6
SelectPalette.GDI32(?,00000000,00000000), ref: 0429AE26
RealizePalette.GDI32(?), ref: 0429AE32
SetTextColor.GDI32(?,00000000), ref: 0429AE9B
SetBkColor.GDI32(?,00000000), ref: 0429AEB6
SetDIBColorTable.GDI32(?,00000000,00000002,?,?,00000000,?,00000000,00000000,0429B046,?,00000000,0429B068,?,00000000,0429B079), ref: 0429AEFF
FillRect.USER32(?,00000000,00000000), ref: 0429AE83

Part of subcall function 042932AC: GetSysColor.USER32(?), ref: 042932B6

PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 0429AF21
CreateCompatibleDC.GDI32(00000000), ref: 0429AF34
SelectObject.GDI32(0429B33B,00000000), ref: 0429AF57
SelectPalette.GDI32(0429B33B,00000000,00000000), ref: 0429AF73
RealizePalette.GDI32(0429B33B), ref: 0429AF7E
SetTextColor.GDI32(0429B33B,00000000), ref: 0429AF9C
SetBkColor.GDI32(0429B33B,00000000), ref: 0429AFB7
BitBlt.GDI32(?,00000000,00000000,?,?,0429B33B,00000000,00000000,00CC0020), ref: 0429AFDF
SelectPalette.GDI32(0429B33B,00000000,000000FF), ref: 0429AFF1
SelectObject.GDI32(0429B33B,00000000), ref: 0429AFFB
DeleteDC.GDI32(0429B33B), ref: 0429B016

Part of subcall function 042945BC: EnterCriticalSection.KERNEL32(-00000008), ref: 042945E4
Part of subcall function 042945BC: CreateBrushIndirect.GDI32(?), ref: 04294671
Part of subcall function 042945BC: LeaveCriticalSection.KERNEL32(?,042946A5,-00000008), ref: 04294698

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: ColorSelect$CreatePalette$Object$Compatible$BitmapCriticalRealizeSectionText$BrushDeleteEnterFillIndirectLeaveRectTable
String ID:
API String ID: 3271313764-0
Opcode ID: 93c94fe5faa8c8cd7b243007723c0b3730636405eb68052c6e23441d95caa4d6
Instruction ID: 50fb7daecdc73ff7e1826a26e5c5516a11f829b18be6f46dd235692025e6c45b
Opcode Fuzzy Hash: 93c94fe5faa8c8cd7b243007723c0b3730636405eb68052c6e23441d95caa4d6
Instruction Fuzzy Hash: CB12C275A10209AFEB10DFA8C884FAEB7F9EB18314F558455F918EB291C774ED80CB60

Function 042B8BF4 Relevance: 21.2, APIs: 6, Strings: 8, Instructions: 217COMMON

Download Yara Rule

Strings

PE, xrefs: 042B8C70
MZ, xrefs: 042B8C2F
BTMemoryLoadLibary: BuildImportTable failed, xrefs: 042B8DC0
BTMemoryLoadLibary: Can't attach library, xrefs: 042B8E38
BTMemoryLoadLibary: VirtualAlloc failed, xrefs: 042B8CD8
BTMemoryLoadLibary: dll dos header is not valid, xrefs: 042B8C3C
BTMemoryLoadLibary: Get DLLEntyPoint failed, xrefs: 042B8E0D
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid, xrefs: 042B8C81

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID:
String ID: BTMemoryLoadLibary: BuildImportTable failed$BTMemoryLoadLibary: Can't attach library$BTMemoryLoadLibary: Get DLLEntyPoint failed$BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid$BTMemoryLoadLibary: VirtualAlloc failed$BTMemoryLoadLibary: dll dos header is not valid$MZ$PE
API String ID: 0-3631919656
Opcode ID: c550489b4ad59bb6e589b961539ddee14982f2ed1afe02096299d3856f863858
Instruction ID: 842b7d114fce25a3eec250199d6587ed2b8d54262c1933c14ed8c6e7ee37bcfa
Opcode Fuzzy Hash: c550489b4ad59bb6e589b961539ddee14982f2ed1afe02096299d3856f863858
Instruction Fuzzy Hash: 4F71A371B142059FEB14EB69DC80BEEB3E9EF88354F0484A5F648E7280D674F945CB90

Function 041BC520 Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(042CAC10,042BE037,00000400,00000000,042BE0D7), ref: 041BC525
GetVersion.KERNEL32(042CAC10,042BE037,00000400,00000000,042BE0D7), ref: 041BC533
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,042CAC10,042BE037,00000400,00000000,042BE0D7), ref: 041BC55A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041BC560
GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,042CAC10,042BE037,00000400,00000000,042BE0D7), ref: 041BC574
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041BC57A
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,042CAC10,042BE037,00000400,00000000,042BE0D7), ref: 041BC58E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041BC594

Strings

GetThreadPreferredUILanguages, xrefs: 041BC550
SetThreadPreferredUILanguages, xrefs: 041BC56A
GetThreadUILanguage, xrefs: 041BC584
kernel32.dll, xrefs: 041BC555, 041BC56F, 041BC589

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$CriticalInitializeSectionVersion
String ID: GetThreadPreferredUILanguages$GetThreadUILanguage$SetThreadPreferredUILanguages$kernel32.dll
API String ID: 74573329-1403180336
Opcode ID: 9fdaa9ccd0bd076cc0b2ba947a726914cac8498fdd516d7e8edcd91246fe3c41
Instruction ID: 8697bba4da60777166eefe11825ad3e4b44504a34332ac2d53017ccd1eb89f80
Opcode Fuzzy Hash: 9fdaa9ccd0bd076cc0b2ba947a726914cac8498fdd516d7e8edcd91246fe3c41
Instruction Fuzzy Hash: 79F01CE178034437E7003778E8CABD92686DF8164CB108528E1C0A5201FFED76408BE5

Function 041BCBF8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,041CA5A8,?,?), ref: 041BCC15
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 041BCC26
FindFirstFileW.KERNEL32(?,?,kernel32.dll,041CA5A8,?,?), ref: 041BCD26
FindClose.KERNEL32(?,?,?,kernel32.dll,041CA5A8,?,?), ref: 041BCD38
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,041CA5A8,?,?), ref: 041BCD44
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,041CA5A8,?,?), ref: 041BCD89

Strings

\, xrefs: 041BCD56
GetLongPathNameW, xrefs: 041BCC20
kernel32.dll, xrefs: 041BCC10

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 9f72d163cd458d08c41b91ac60973989621c84b7c1673b393cfd4330d6c116be
Instruction ID: 320b5ab5390a3666bffa722ba21abf047336282d2fdb9bb59dc36827ee3bc511
Opcode Fuzzy Hash: 9f72d163cd458d08c41b91ac60973989621c84b7c1673b393cfd4330d6c116be
Instruction Fuzzy Hash: DE419B75A00A189BDB20EFA8CCC4ADDB3B6AF84314F1485A9D584E7244FB74BE40DBC5

Function 042AFD00 Relevance: 15.7, APIs: 10, Instructions: 742windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 042AFE79
CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 042AFEC0
DeleteObject.GDI32(00000000), ref: 042AFEDE
DeleteDC.GDI32(00000000), ref: 042AFEE7
SelectObject.GDI32(00000000,00000000), ref: 042AFF18
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 042AFF47
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 042B0607
SelectObject.GDI32(00000000,?), ref: 042B0614
DeleteObject.GDI32(00000000), ref: 042B061D
DeleteDC.GDI32(00000000), ref: 042B0626

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: DeleteObject$CreateSelect$CompatibleSection
String ID:
API String ID: 1283611041-0
Opcode ID: a87600263f6baa74f420413eb0f0b9a45c0d3fc74f4632ae4807ea8e342be4eb
Instruction ID: 4df8252336ef45d68e94c5cfd665c5c82146ae24d3bf43e73a1714c22737c140
Opcode Fuzzy Hash: a87600263f6baa74f420413eb0f0b9a45c0d3fc74f4632ae4807ea8e342be4eb
Instruction Fuzzy Hash: 5852A171E142598FDB15CFA9C880BEEFBF1EF45300F1481AAE494EB392C638A945DB50

Function 042B90EC Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,042B9351,?,00000000,?,00000000), ref: 042B916E
IsBadReadPtr.KERNEL32(?,00000014), ref: 042B9322

Strings

BuildImportTable: GetProcAddress failed, xrefs: 042B92F5
BuildImportTable: ReallocMemory failed, xrefs: 042B9200
BuildImportTable: can't load library: , xrefs: 042B91B5

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: LibraryLoadRead
String ID: BuildImportTable: GetProcAddress failed$BuildImportTable: ReallocMemory failed$BuildImportTable: can't load library:
API String ID: 1452896035-1384308123
Opcode ID: 28448677c2cfe4d7edf5e298778155f3fdf6832a9584aab20048198c9cb4d46f
Instruction ID: 36bf17e2fa6e5f84609675c607ece6b4dcb57939936ea4212150fe816c234b00
Opcode Fuzzy Hash: 28448677c2cfe4d7edf5e298778155f3fdf6832a9584aab20048198c9cb4d46f
Instruction Fuzzy Hash: A0712CB0B10205AFEB10DB69CC81BEAB7F9EF89354F4084A4E695DB250D774BD85CB90

Function 0425A910 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,00000000,?,0425A7FE,00000000,?), ref: 0425A927
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,0425A7FE,00000000,?), ref: 0425A941
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,0425A7FE,00000000,?), ref: 0425A95B
LockResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,0425A7FE,00000000), ref: 0425A965

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction ID: b3863aa80b72334f336127171e298601fe27858e0140ac8312f63e15fd106b32
Opcode Fuzzy Hash: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction Fuzzy Hash: EFF08CB36042187FA744EEACAC81E6F77ECEE89264320426AFD18D7215DA31FD014378

Function 041BC79C Relevance: 4.6, APIs: 3, Instructions: 99COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,041BC901,?,041CA5A8,?,00000000), ref: 041BC846
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,041BC901,?,041CA5A8,?,00000000), ref: 041BC862
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,041BC901,?,041CA5A8,?,00000000), ref: 041BC873

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: 9ac9697ec1eccf97043482938f18f061d3367b763c238f3bd771a167d33dcca8
Instruction ID: 09f64c2c592ea5b3fd8f8be61ac3fdfd1491a2916569bf5b9cfd90418d5ac694
Opcode Fuzzy Hash: 9ac9697ec1eccf97043482938f18f061d3367b763c238f3bd771a167d33dcca8
Instruction Fuzzy Hash: 1231AE70A4061CABEB24DF64ECD4BDE77B9EB88705F5100E9E588A7250E7746E80CED0

Function 0429A1D8 Relevance: 4.6, APIs: 3, Instructions: 51fileclipboardCOMMON

Download Yara Rule

APIs

GetClipboardData.USER32(0000000E), ref: 0429A1E5
CopyEnhMetaFileW.GDI32(00000000,00000000), ref: 0429A207
GetEnhMetaFileHeader.GDI32(?,0000006C,?,00000000,00000000), ref: 0429A219

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: FileMeta$ClipboardCopyDataHeader
String ID:
API String ID: 1752724394-0
Opcode ID: 2b831084bcc5cbcf9eab80bf9fcc406d9a6c006e82a9c426f6b7f7d8ddf052e3
Instruction ID: c5196b331d9c9011671420552e47006bd9aaf662a03c0211808e1f1d6193e033
Opcode Fuzzy Hash: 2b831084bcc5cbcf9eab80bf9fcc406d9a6c006e82a9c426f6b7f7d8ddf052e3
Instruction Fuzzy Hash: 08113572B002059FDB10DFADC8C4A9AB7F8EF59214F10866AE919DB251DB74EC48CB94

Function 0429FE80 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 783COMMON

Download Yara Rule

Strings

jjj, xrefs: 042A0654

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID:
String ID: jjj
API String ID: 0-2289343631
Opcode ID: 2763102c82c5049541ce7a6ec2cf7cc2dfecf2fede7bbadd19130fc1372313db
Instruction ID: 517adc1c5eb29c7759e70e7c279355e7790252b47afcb7f4f5a966396b334177
Opcode Fuzzy Hash: 2763102c82c5049541ce7a6ec2cf7cc2dfecf2fede7bbadd19130fc1372313db
Instruction Fuzzy Hash: 70723770A20201CFDB69CF18D9C4B667BB2FB45314F148699DC468F28AD774F8A6CB61

Function 04268000 Relevance: 3.1, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(00000000,042680BB), ref: 04268032
RaiseException.KERNEL32(406D1388,00000000,00000004,00001000,00000000,0426808D,?,00000000,042680BB), ref: 0426807E

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: DebuggerExceptionPresentRaise
String ID:
API String ID: 1899633966-0
Opcode ID: 819d8e527d7c2f3c79c58a65cf3b55a2c8b22a615bed56026e2621c07d094d3d
Instruction ID: cda0cbee94e3c1f2b58a508ba90092a93e17105047ade216ee4d589688a977ff
Opcode Fuzzy Hash: 819d8e527d7c2f3c79c58a65cf3b55a2c8b22a615bed56026e2621c07d094d3d
Instruction Fuzzy Hash: 041193B1A24208AFEB11EF61DC91ADEBBF8EB48704F514876E501D2650E7747A00CAA4

Function 04295AA0 Relevance: 3.0, APIs: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,04295B3C,?,00000000,?,04295B54,00000000,0429B19B,00000000,0429B33B,?,00000000,00000054,?,00000000,?), ref: 04295AC0
FormatMessageW.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,04295B3C,?,00000000,?,04295B54,00000000,0429B19B,00000000), ref: 04295AE6

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: de7d74e06f563af3ce266ece22bc6a3b7c88db0869108060be28d17e5692de13
Instruction ID: 63977c24a8560ba8b09a7c898271e607071a626c476fb0dcadacc7fa875243dc
Opcode Fuzzy Hash: de7d74e06f563af3ce266ece22bc6a3b7c88db0869108060be28d17e5692de13
Instruction Fuzzy Hash: FE01A7B1764349AFFB22FB608CD1F9973E8EB04704F4044B4EA08A2581EBB47D808A54

Function 042A1FC4 Relevance: 1.9, APIs: 1, Instructions: 699COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d1310bdbdfb39e8b40f23f33318d4915d8c3803f6548f7d95db27afe1e8101e
Instruction ID: 5ba3195be941ec3d68384159b647c5c94fbcf385a374845f51b2c3bf88d88a40
Opcode Fuzzy Hash: 4d1310bdbdfb39e8b40f23f33318d4915d8c3803f6548f7d95db27afe1e8101e
Instruction Fuzzy Hash: 78627D70A20219CFDF19CF58C8847AEBBB1BF88304F148199DC559B386D774E995CB90

Function 041D19D8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 041D19F9

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 7055af4c37e798c4eedd1ab66a3f56a97fac90cff517f4e9d1e1818016eb5d1c
Instruction ID: 4756a57199e759f8f836a87301bed4fe0ac12c943530d1642d18219697f283eb
Opcode Fuzzy Hash: 7055af4c37e798c4eedd1ab66a3f56a97fac90cff517f4e9d1e1818016eb5d1c
Instruction Fuzzy Hash: 7311D2B5E01209AF9B44CF99C881DEFF7F9EFC8704B14C559A515E7254E731AA01CB90

Function 041D5334 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 041D5352

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ea3b3c1b5a1cf1a130d0f040b5935ae3e0cd2e837d4e3e09926aa746a21f6665
Instruction ID: fe741889b54e1743cb99d25494c43bceb1b4e16b6ebdbe97970b7df80d1dc75e
Opcode Fuzzy Hash: ea3b3c1b5a1cf1a130d0f040b5935ae3e0cd2e837d4e3e09926aa746a21f6665
Instruction Fuzzy Hash: 1DE0927170421837E714A5598CC4AEAB25DAB48340F40456EBA15C7341EFA0BE4442E5

Function 041D920C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(041D8FB4,00000002,?,?,041D958D,041D57FD,?,00000000,041D583E,?,?,?,00000000,00000000), ref: 041D9239

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 6070099c365e7ddac9394540850221f3cea1743258e429ed9e4eb1958130e792
Instruction ID: 570519f16016d29efeda80a38f3fb2ceff220395ac225c568f92162aac7e23d0
Opcode Fuzzy Hash: 6070099c365e7ddac9394540850221f3cea1743258e429ed9e4eb1958130e792
Instruction Fuzzy Hash: 32E026D27405204BE120BBB80CC1BDABA024F81EA4F088670E8E8CF390D7112C0101E2

Function 041D5380 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,041D5482,?,00000001,00000000,041D5691), ref: 041D5393

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e6b6a51cb939c12e8be8693ad0cf5385fb4deb90edb709e785ba876ef48dd5f6
Instruction ID: 748245512be5c65de9973e504d821ae59821afdbeef2b66cd3abc8e259459cfb
Opcode Fuzzy Hash: e6b6a51cb939c12e8be8693ad0cf5385fb4deb90edb709e785ba876ef48dd5f6
Instruction Fuzzy Hash: 2FD05EA631922076E214915B6E84D7B56DDCBC47A2F04483EBA48C6100E350DC059271

Function 041D3818 Relevance: 1.5, APIs: 1, Instructions: 22timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 041D3820

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 4f9b7d43ec185e7a6a89ffe2b054e45fb80c64ee8d8e0ae38377adb1054bd4c4
Instruction ID: 1bdda0d9d17c94098b05898fc258bda00f9f7b7958f3ebdde00442d23197e6eb
Opcode Fuzzy Hash: 4f9b7d43ec185e7a6a89ffe2b054e45fb80c64ee8d8e0ae38377adb1054bd4c4
Instruction Fuzzy Hash: 9BE059A040D625A1D344EF56C88047FF7E5AED4A46F408C5EF8D4402D1EB39D5E8D367

Function 041D8FD0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000400,?,041D9086,?,00000000,041D91D3), ref: 041D8FEB

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4b498ff0c44464bb9c319f2c4cdb7eba90f2cd8f1e1edfbafd7f3df4e5c9a38
Instruction ID: 887f8a8aaa6e9ca8735867c3a0e9bab05168112d89bba513ccf18f742a7ba9d9
Opcode Fuzzy Hash: e4b498ff0c44464bb9c319f2c4cdb7eba90f2cd8f1e1edfbafd7f3df4e5c9a38
Instruction Fuzzy Hash: 64D0A7E1B5420023F30412548C81B6722889B88704F10442CB7D8873C0EF7D680552EA

Function 041EB4C4 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f15239c25a07cbe7d172505b81851bc302b4578a5e7efd7bcfcc8bcb146717
Instruction ID: b8668ba7f37d112b28548665a77cd76638d33dded6cf7bf6cdac12af3d03b756
Opcode Fuzzy Hash: 99f15239c25a07cbe7d172505b81851bc302b4578a5e7efd7bcfcc8bcb146717
Instruction Fuzzy Hash: BB02EF36904635CFDB96CF6AC080115B7B6FF8A32432A82D1D854AB229D370BE51DFD1

Function 042A5F80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8e7f5fa08233c9cf6af3f4da3c8a8b0854dd8decd54ec8197df6d450736b3b
Instruction ID: 1596c7010fe353bebb623e7c03e9620c842c16477ec8030c764c7b8532ea83c9
Opcode Fuzzy Hash: 3c8e7f5fa08233c9cf6af3f4da3c8a8b0854dd8decd54ec8197df6d450736b3b
Instruction Fuzzy Hash: 2D71873239978247D7288E7D9CE02B7EAD36FC531472ED93D94DAC3F42D9B9A0264144

Function 042A6704 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13bad30657ccca9bd025132e5562d49b730675542f4417c1d1335505904ffdce
Instruction ID: 4e24040294e923f92cf26b2c275e1da928227d2736ed3270b558ad6cda557331
Opcode Fuzzy Hash: 13bad30657ccca9bd025132e5562d49b730675542f4417c1d1335505904ffdce
Instruction Fuzzy Hash: CE814177E605734BE7628E28C8043A17392AFCC39DF6B42B4ED04ABA42D535BD5386C0

Function 042A6444 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcdf700a2de9b9b92222d0f170d701dc9aafe2e9c4dc7da7ad2b24527a6b408b
Instruction ID: 3520c8a166d416315bf72465cbe5f9e69fead17352cc474c5492de29d824ea6b
Opcode Fuzzy Hash: fcdf700a2de9b9b92222d0f170d701dc9aafe2e9c4dc7da7ad2b24527a6b408b
Instruction Fuzzy Hash: AA712977E204775BEB608E68C8043617392EF8965CF6F46B4DE44BBA42C636BC5396C0

Function 04260F64 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction ID: b90737f74700b081ec98c12c9b8fe2f34ad3c839d01ba12077d44e3098146004
Opcode Fuzzy Hash: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction Fuzzy Hash: 4441A331B102659BDB58DE2DC8C1666B7A3AFC4214B18CA74DC698F30FC939ED52C790

Function 042610A8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction ID: 5b6f5676820b144d7eed6c02facd585ffd639da70b39403b6ce2a944fd4b4436
Opcode Fuzzy Hash: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction Fuzzy Hash: 46418235B102559BD744DE6DC8C1666B7A3BFC4214B18C6B4DCA98B30BC538EA52CBD0

Function 04296918 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc20041c257ff7d61a283088bfa9f2de2708563aa29e0e00101f28d62c41ba6
Instruction ID: 2dc40e0aa77415d55bc0616e35fc77692ce9a422371aba29c42deb2143eb0115
Opcode Fuzzy Hash: 2bc20041c257ff7d61a283088bfa9f2de2708563aa29e0e00101f28d62c41ba6
Instruction Fuzzy Hash: EEE0016420010A8ED348BF38C1098A2B3E3EFECA1038BC4D0D44A9F23EF622C481C300

Function 041B79E8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction ID: c1f34be03cf0569538104f0038f02cfb84df381903d0011f2ebedd3a3241928c
Opcode Fuzzy Hash: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction Fuzzy Hash: 76C0E9B550D6066E975C8F1AB480815FBE5FAC8324364C22EA01C83644D73154518A64

Function 042AABB4 Relevance: 49.7, APIs: 33, Instructions: 249windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 042AABD2
CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 042AABE7
SelectObject.GDI32(00000000,00000000), ref: 042AABEE
CreateCompatibleDC.GDI32(?), ref: 042AAC22
CreateCompatibleDC.GDI32(?), ref: 042AAC2E
CreateCompatibleDC.GDI32(?), ref: 042AAC3A
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 042AAC4D
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 042AAC5D
CreateCompatibleBitmap.GDI32(?,?,?), ref: 042AAC6B
SelectObject.GDI32(?,?), ref: 042AAC7B
SelectObject.GDI32(?,?), ref: 042AAC8B
SelectObject.GDI32(?,?), ref: 042AAC9B
SetBkColor.GDI32(00000000,?), ref: 042AACA8
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 042AACCC
SetBkColor.GDI32(00000000,?), ref: 042AACD6
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00330008), ref: 042AACF2
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 042AAD12
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 042AAD2E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,008800C6), ref: 042AAD4F
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00EE0086), ref: 042AAD70
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 042AAD90
SelectObject.GDI32(?,?), ref: 042AAD9D
DeleteObject.GDI32(00000000), ref: 042AADA3
SelectObject.GDI32(?,?), ref: 042AADB0
DeleteObject.GDI32(00000000), ref: 042AADB6
SelectObject.GDI32(?,?), ref: 042AADC3
DeleteObject.GDI32(00000000), ref: 042AADC9
SelectObject.GDI32(00000000,?), ref: 042AADD3
DeleteObject.GDI32(00000000), ref: 042AADD9
DeleteDC.GDI32(?), ref: 042AADE2
DeleteDC.GDI32(?), ref: 042AADEB
DeleteDC.GDI32(?), ref: 042AADF4
DeleteDC.GDI32(00000000), ref: 042AADFA

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteSelect$Compatible$Bitmap$Stretch$Color
String ID:
API String ID: 881050057-0
Opcode ID: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction ID: 5a9c8ee4799e7e30fbc5e0b2cf7ac0f38dd75dd6572f622167865beaee124e4b
Opcode Fuzzy Hash: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction Fuzzy Hash: 658149B1E40218BBEB50EAE8CDC5FDFB7BCAB19614F104459FA14FB280C675AD108B65

Function 041DEF9C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 041DEFA5

Part of subcall function 041DEF70: GetProcAddress.KERNEL32(00000000), ref: 041DEF89

Strings

VarDiv, xrefs: 041DF037
VarBstrFromDate, xrefs: 041DF16B
VarMod, xrefs: 041DF063
VarBstrFromBool, xrefs: 041DF181
VarMul, xrefs: 041DF021
VarAdd, xrefs: 041DEFF5
VarI4FromStr, xrefs: 041DF0D1
VarDateFromStr, xrefs: 041DF113
VarSub, xrefs: 041DF00B
VarBstrFromCy, xrefs: 041DF155
VarXor, xrefs: 041DF0A5
VarR8FromStr, xrefs: 041DF0FD
VarCmp, xrefs: 041DF0BB
VarOr, xrefs: 041DF08F
VarNeg, xrefs: 041DEFC9
VarIdiv, xrefs: 041DF04D
VarCyFromStr, xrefs: 041DF129
VarR4FromStr, xrefs: 041DF0E7
VarBoolFromStr, xrefs: 041DF13F
VariantChangeTypeEx, xrefs: 041DEFB3
VarAnd, xrefs: 041DF079
oleaut32.dll, xrefs: 041DEFA0
VarNot, xrefs: 041DEFDF

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 65ef2527f516848d57bb4cf286e2b1a6aff9b73de3fac5e33ef7cfacd08c29c1
Instruction ID: 9d15d362f068a89c8fa2e3c60a09b02e86377faf7f2f30b2d5692d6e4594f476
Opcode Fuzzy Hash: 65ef2527f516848d57bb4cf286e2b1a6aff9b73de3fac5e33ef7cfacd08c29c1
Instruction Fuzzy Hash: 0C414FE5758B065BB6087B6DBAC042673D9EB4520E360452AB409FF748DF34FE82472D

Function 04295CEC Relevance: 37.7, APIs: 25, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 04295D2F
SelectObject.GDI32(?,?), ref: 04295D44
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029,00000000,04295DB4,?,?), ref: 04295D88
SelectObject.GDI32(?,?), ref: 04295DA2
DeleteObject.GDI32(?), ref: 04295DAE
CreateCompatibleDC.GDI32(00000000), ref: 04295DC2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 04295DE3
SelectObject.GDI32(?,?), ref: 04295DF8
SelectPalette.GDI32(?,2E080D0A,00000000), ref: 04295E0C
SelectPalette.GDI32(?,?,00000000), ref: 04295E1E
SelectPalette.GDI32(?,00000000,000000FF), ref: 04295E33
SelectPalette.GDI32(?,2E080D0A,000000FF), ref: 04295E49
RealizePalette.GDI32(?), ref: 04295E55
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 04295E77
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 04295E99
SetTextColor.GDI32(?,00000000), ref: 04295EA1
SetBkColor.GDI32(?,00FFFFFF), ref: 04295EAF
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 04295EDB
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 04295F00
SetTextColor.GDI32(?,?), ref: 04295F0A
SetBkColor.GDI32(?,?), ref: 04295F14
SelectObject.GDI32(?,00000000), ref: 04295F27
DeleteObject.GDI32(?), ref: 04295F30
SelectPalette.GDI32(?,00000000,00000000), ref: 04295F52
DeleteDC.GDI32(?), ref: 04295F5B

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: 6d4093f1511c00eee1953676da903ddb323d139017fa8632a2766d6e1df3a207
Instruction ID: 80caef5835d6ca5ad8a996cd51e4724af2ccf52b87b95ee95005eb33780661af
Opcode Fuzzy Hash: 6d4093f1511c00eee1953676da903ddb323d139017fa8632a2766d6e1df3a207
Instruction Fuzzy Hash: 8F81AFB2B00209BFEB51DEA8CD84EEF77FCAB1D614F144519FA18E7240C675AD408B61

Function 0429B140 Relevance: 31.7, APIs: 21, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 0429B163
GetDC.USER32(00000000), ref: 0429B191
CreateCompatibleDC.GDI32(?), ref: 0429B1A2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0429B1BD
SelectObject.GDI32(?,00000000), ref: 0429B1D7
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 0429B1F9
CreateCompatibleDC.GDI32(?), ref: 0429B207
SelectObject.GDI32(00000000,00000000), ref: 0429B24F
SelectPalette.GDI32(00000000,?,00000000), ref: 0429B262
RealizePalette.GDI32(00000000), ref: 0429B26B
SelectPalette.GDI32(?,?,00000000), ref: 0429B277
RealizePalette.GDI32(?), ref: 0429B280
SetBkColor.GDI32(00000000,00000000), ref: 0429B28A
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0429B2AE
SetBkColor.GDI32(00000000,00000000), ref: 0429B2B8
SelectObject.GDI32(00000000,00000000), ref: 0429B2CB
DeleteObject.GDI32(00000000), ref: 0429B2D7
DeleteDC.GDI32(00000000), ref: 0429B2ED
SelectObject.GDI32(?,00000000), ref: 0429B308
DeleteDC.GDI32(00000000), ref: 0429B324
ReleaseDC.USER32(00000000,00000000), ref: 0429B335

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 7533a2dd7d7500c9384d4cf95d9e65bc25137b161451caa7ee4e5d68a14ba1b8
Instruction ID: 56c816f76c0c0fd4addf23c4a52166d0b791032784d504809a14931f7492a44b
Opcode Fuzzy Hash: 7533a2dd7d7500c9384d4cf95d9e65bc25137b161451caa7ee4e5d68a14ba1b8
Instruction Fuzzy Hash: 6B51EB72F10209BBEF11DAE89C95BAEBBF8EB19704F504469B614E7280D774B9408B64

Function 0429C71C Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 357windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0429C9A4
CreateCompatibleDC.GDI32(00000001), ref: 0429CA09
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 0429CA1E
SelectObject.GDI32(?,00000000), ref: 0429CA28
SelectPalette.GDI32(?,?,00000000), ref: 0429CA58
RealizePalette.GDI32(?), ref: 0429CA64
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 0429CA88
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,0429CAE1,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 0429CA96
SelectPalette.GDI32(?,00000000,000000FF), ref: 0429CAC8
SelectObject.GDI32(?,?), ref: 0429CAD5
DeleteObject.GDI32(00000000), ref: 0429CADB

Strings

BM, xrefs: 0429C83D
(, xrefs: 0429C8D2

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: 4448f79f2541d2f16d733747c353eedf6490fc6409884ab107fa9d6529957f78
Instruction ID: a131d32e1afe40314c14642fa3870325521e0e334d0e8837fa43069fba8ad942
Opcode Fuzzy Hash: 4448f79f2541d2f16d733747c353eedf6490fc6409884ab107fa9d6529957f78
Instruction Fuzzy Hash: 0AE14871B10219AFEF14DFA9C894BAEBBF5FF49304F008469E914AB294D734AC40CB65

Function 0429B698 Relevance: 24.3, APIs: 16, Instructions: 265windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0429C31C: GetDC.USER32(00000000), ref: 0429C372
Part of subcall function 0429C31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0429C387
Part of subcall function 0429C31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 0429C391
Part of subcall function 0429C31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,0429A7DB,00000000,0429A867), ref: 0429C3B5
Part of subcall function 0429C31C: ReleaseDC.USER32(00000000,00000000), ref: 0429C3C0

SelectPalette.GDI32(?,?,000000FF), ref: 0429B6DB
RealizePalette.GDI32(?), ref: 0429B6EA
GetStretchBltMode.GDI32(00000000), ref: 0429B6FC
GetDeviceCaps.GDI32(?,0000000C), ref: 0429B70D
GetDeviceCaps.GDI32(?,0000000E), ref: 0429B71C
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C,00000000), ref: 0429B74F
SetStretchBltMode.GDI32(?,00000004), ref: 0429B75D
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C,00000000), ref: 0429B775
SetStretchBltMode.GDI32(00000000,00000003), ref: 0429B792
CreateCompatibleDC.GDI32(00000000), ref: 0429B7F3
SelectObject.GDI32(?,?), ref: 0429B808
SelectObject.GDI32(?,00000000), ref: 0429B867
DeleteDC.GDI32(00000000), ref: 0429B876

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: CapsDevice$ModePaletteSelectStretch$BrushCreateObject$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 28117789-0
Opcode ID: d38b121222a1e024e3ccbf26231df49ef17f8fc14c3fc7a7e6bd800fdf27a7b8
Instruction ID: 667fe83f60c546a6d2390d4fb27b906e57d0b8e0d481ad616dbd4248e322cf4d
Opcode Fuzzy Hash: d38b121222a1e024e3ccbf26231df49ef17f8fc14c3fc7a7e6bd800fdf27a7b8
Instruction Fuzzy Hash: 24A1E271B10209AFEB40EBA9D984E9EBBE8BF09604F504598F519EB691D734FD40CB60

Function 04295B58 Relevance: 21.1, APIs: 14, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 04295B6F
CreateCompatibleDC.GDI32(00000000), ref: 04295B79
GetObjectW.GDI32(?,00000018,?), ref: 04295B99
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 04295BB0
GetDC.USER32(00000000), ref: 04295BBC
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 04295BE9
ReleaseDC.USER32(00000000,00000000), ref: 04295C0F
SelectObject.GDI32(?,?), ref: 04295C2A
SelectObject.GDI32(?,00000000), ref: 04295C39
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 04295C65
SelectObject.GDI32(?,00000000), ref: 04295C73
SelectObject.GDI32(?,00000000), ref: 04295C81
DeleteDC.GDI32(?), ref: 04295C97
DeleteDC.GDI32(?), ref: 04295CA0

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 51143f3dc0cb164e68a8fb20fb813ce966dc3aa78989ead011e555918ed277b1
Instruction ID: 6af10552fbb0d22009866a7dd46577eb9bac5baf70f108c671f2b0989262f1ca
Opcode Fuzzy Hash: 51143f3dc0cb164e68a8fb20fb813ce966dc3aa78989ead011e555918ed277b1
Instruction Fuzzy Hash: 2341D972F10209BFEB51EAE8CD85FAEB7FCAB19704F404459BA14E7240D774AD408BA4

Function 0429B964 Relevance: 19.8, APIs: 13, Instructions: 255windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0429C31C: GetDC.USER32(00000000), ref: 0429C372
Part of subcall function 0429C31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0429C387
Part of subcall function 0429C31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 0429C391
Part of subcall function 0429C31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,0429A7DB,00000000,0429A867), ref: 0429C3B5
Part of subcall function 0429C31C: ReleaseDC.USER32(00000000,00000000), ref: 0429C3C0

SelectPalette.GDI32(?,?,000000FF), ref: 0429B9A7
RealizePalette.GDI32(?), ref: 0429B9B6
GetDeviceCaps.GDI32(?,0000000C), ref: 0429B9C8
GetDeviceCaps.GDI32(?,0000000E), ref: 0429B9D7
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 0429BA0A
SetStretchBltMode.GDI32(?,00000004), ref: 0429BA18
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 0429BA30
SetStretchBltMode.GDI32(00000000,00000003), ref: 0429BA4D
CreateCompatibleDC.GDI32(00000000), ref: 0429BAAE
SelectObject.GDI32(?,?), ref: 0429BAC3
SelectObject.GDI32(?,00000000), ref: 0429BB22
DeleteDC.GDI32(00000000), ref: 0429BB31

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: 4bfdfd883a923dd7b82784a0809a640cbb699f89b9f4a380e040ec548c48f7a6
Instruction ID: f6f940008fe3d3b23cd207e81550e22d19f2d4905c4b6759e26642bad479d7a7
Opcode Fuzzy Hash: 4bfdfd883a923dd7b82784a0809a640cbb699f89b9f4a380e040ec548c48f7a6
Instruction Fuzzy Hash: 4C910371B10249AFEB50EBA9C984F9EBBE8BF09204F104558F915EB691D734FE40CB60

Function 0429D7A0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 258windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0429D0C0: DeleteObject.GDI32(00000000), ref: 0429D206

DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0429D865
GetDIBits.GDI32(00000000,00000000,00000000,00000000,?,?), ref: 0429D8E3
GetIconInfo.USER32(00000000,?), ref: 0429D947
GetDIBits.GDI32(00000000,?,00000000,00000000,?,00000000,?), ref: 0429D980
SetDIBits.GDI32(00000000,00000000,?,00000000,?,00000000,0429DA2B), ref: 0429D9E9
DeleteObject.GDI32(?), ref: 0429D9FF
DeleteObject.GDI32(?), ref: 0429DA08

Strings

, xrefs: 0429D890
,, xrefs: 0429D86A

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: BitsDeleteObject$Icon$DrawInfo
String ID: $,
API String ID: 1810795657-71045815
Opcode ID: b1b939ad7287dcdf6019a677b4b8ddb26706b6bab1d291769d4c1690d6bc613c
Instruction ID: 970e9579ead6d1d6dd0414e8d85ff61ac6eb9195ce26200e04425046ecf5ec1c
Opcode Fuzzy Hash: b1b939ad7287dcdf6019a677b4b8ddb26706b6bab1d291769d4c1690d6bc613c
Instruction Fuzzy Hash: FB91F771B20109AFEB10EFA9CC84A9EBBF9FF49604F5041A4E519EB250DB31ED45CB91

Function 041D53AC Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,041D5691,?,?,?,?,00000000,00000000), ref: 041D53D3
GetThreadLocale.KERNEL32(?,00000001,00000000,041D5691,?,?,?,?,00000000,00000000), ref: 041D53DC

Part of subcall function 041D5380: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,041D5482,?,00000001,00000000,041D5691), ref: 041D5393

Part of subcall function 041D5334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 041D5352

Strings

m/d/yy, xrefs: 041D54DD
:mm, xrefs: 041D5629
2, xrefs: 041D566D
AMPM , xrefs: 041D5619
:mm:ss, xrefs: 041D5644
mmmm d, yyyy, xrefs: 041D5502
AMPM, xrefs: 041D560A

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: b70f5018700a744d1cebb19292e04859c7bdddd232c68d8551400815f8048987
Instruction ID: 88bf4e4f702513ef1e24b981d261c5d319feb0e4917cceffaf928914eb64e0e9
Opcode Fuzzy Hash: b70f5018700a744d1cebb19292e04859c7bdddd232c68d8551400815f8048987
Instruction Fuzzy Hash: 88712DB0700549BBFB01EBA4C9C0ADE76ABEF88348F908065E504AF745DB34FA068795

Function 041D5DC8 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 199threadCOMMON

Download Yara Rule

APIs

Part of subcall function 041B8850: GetTickCount.KERNEL32 ref: 041B8887
Part of subcall function 041B8850: GetTickCount.KERNEL32 ref: 041B889F

Part of subcall function 041D5334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 041D5352

GetThreadLocale.KERNEL32(00000000,00000004), ref: 041D5E60
EnumCalendarInfoW.KERNEL32(041D5C8C,00000000,00000000,00000004), ref: 041D5E6B
GetThreadLocale.KERNEL32(00000000,00000003,041D5C8C,00000000,00000000,00000004), ref: 041D5EA6
EnumCalendarInfoW.KERNEL32(041D5D30,00000000,00000000,00000003,041D5C8C,00000000,00000000,00000004), ref: 041D5EB1
GetThreadLocale.KERNEL32(00000000,00000004), ref: 041D5F42
EnumCalendarInfoW.KERNEL32(041D5C8C,00000000,00000000,00000004), ref: 041D5F4D
GetThreadLocale.KERNEL32(00000000,00000003,041D5C8C,00000000,00000000,00000004), ref: 041D5F8A
EnumCalendarInfoW.KERNEL32(041D5D30,00000000,00000000,00000003,041D5C8C,00000000,00000000,00000004), ref: 041D5F95

Strings

B.C., xrefs: 041D5EF0

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.
API String ID: 1601775584-621294921
Opcode ID: 39f587ed6a0ac28fb4670de50df3dd36f52f0503dc22052b392f037ccfbacff4
Instruction ID: 5254c10f3548919db1334d0b66728c78f82f177fb489aeb9368368dd11daa172
Opcode Fuzzy Hash: 39f587ed6a0ac28fb4670de50df3dd36f52f0503dc22052b392f037ccfbacff4
Instruction Fuzzy Hash: 8C61A4B5B40605AFF710EF6CE8C5AAE7BA5EF48715B0041A8E914EB390C734FD458B90

Function 04294AC0 Relevance: 15.2, APIs: 10, Instructions: 228windowCOMMON

Download Yara Rule

APIs

Part of subcall function 04294778: EnterCriticalSection.KERNEL32(042CDE34,?,04294858,?,?,?,?,?,?,?,?,00000000,04294870,?,042CDE34), ref: 04294780
Part of subcall function 04294778: LeaveCriticalSection.KERNEL32(042CDE34,042CDE34,?,04294858,?,?,?,?,?,?,?,?,00000000,04294870,?,042CDE34), ref: 0429478D
Part of subcall function 04294778: EnterCriticalSection.KERNEL32(?,042CDE34,042CDE34,?,04294858,?,?,?,?,?,?,?,?,00000000,04294870), ref: 04294796

CreateCompatibleDC.GDI32(00000000), ref: 04294B64
SelectObject.GDI32(?,?), ref: 04294B74
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00CC0020), ref: 04294C70
SetTextColor.GDI32(?,00000000), ref: 04294C7E
SetBkColor.GDI32(?,00FFFFFF), ref: 04294C92
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00E20746), ref: 04294CC5
SetTextColor.GDI32(?,?), ref: 04294CD5
SetBkColor.GDI32(?,?), ref: 04294CE5
SelectObject.GDI32(?,00000000), ref: 04294D15
DeleteDC.GDI32(?), ref: 04294D1E

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Color$CriticalSection$EnterObjectSelectStretchText$CompatibleCreateDeleteLeave
String ID:
API String ID: 675119849-0
Opcode ID: 659d4d371a4bf7997e65b9c2b3baea9f0ef944221458a6b9b44acb3cbfd79901
Instruction ID: 4f3f39db51ffe5a9d59585593d89768732acae86e44e9b208f9746f1f6de7722
Opcode Fuzzy Hash: 659d4d371a4bf7997e65b9c2b3baea9f0ef944221458a6b9b44acb3cbfd79901
Instruction Fuzzy Hash: 66918E75A14118AFDB40EFA8C980E9EBBF9FF4D604B548599E918EB260C734BD41CB60

Function 041B85C8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 041B85DD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041B85E3
GetLogicalProcessorInformation.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 041B85F6
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 041B85FF
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,041B8676,?,00000000,?,GetLogicalProcessorInformation), ref: 041B862A

Strings

kernel32.dll, xrefs: 041B85D8
GetLogicalProcessorInformation, xrefs: 041B85D3
@, xrefs: 041B867D

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: 196d02c0eb2bdb38019fd455c6c30435da3ab2227d32e3e7fd3be60dca5f9a66
Instruction ID: 9fa0bbee48d938205b8e8b98896bc97bc55fd52a018a985d70878a8907217042
Opcode Fuzzy Hash: 196d02c0eb2bdb38019fd455c6c30435da3ab2227d32e3e7fd3be60dca5f9a66
Instruction Fuzzy Hash: 73117271D00208AEEB10FFA4C8C4ADDB7B9EB00B08F1088E5D894A7251E775AA408BD1

Function 041C0594 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 041C064C

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 9b85bc824a1ae946e482ad5fc963516653dbd41f02ba70003e778fa7cc2d650f
Instruction ID: f1da3a974337cacde6b49ac8b7d578d2057167225113c599191fb92f8f31d4d1
Opcode Fuzzy Hash: 9b85bc824a1ae946e482ad5fc963516653dbd41f02ba70003e778fa7cc2d650f
Instruction Fuzzy Hash: C4A15875A01309DFDB14CFE8ECC4BAEBBB5EB58310F15812DE959AB280DB74A941CB50

Function 041E0A54 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 041E0AED
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 041E0B09
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 041E0B42
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 041E0BBF
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 041E0BD8
VariantCopy.OLEAUT32(?), ref: 041E0C0D

Strings

, xrefs: 041E0A6E

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction ID: fada9f0942b6d8e47bcb591b5664e1761b00b30fbb3c8cc446f0d153fdb68991
Opcode Fuzzy Hash: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction Fuzzy Hash: A55118B9900A2D9BDB26DF59C8C0BE9B7FCAF4C204F0041D9E649A7201D770AF848F61

Function 04299A04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 04299AA6
MulDiv.KERNEL32(?,000009EC,00000000), ref: 04299AC3
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 04299AEF
GetEnhMetaFileHeader.GDI32(00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 04299B0F
DeleteEnhMetaFile.GDI32(00000016), ref: 04299B30
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 04299B43

Strings

`, xrefs: 04299A8B

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: 174438983c6c50905628f1a6fd0f0e0d48daf27174b27630399098f3cf95603a
Instruction ID: d4dd05daef0ee41e433b2e408c7cf2906042388475846636c92ab33a8e973fff
Opcode Fuzzy Hash: 174438983c6c50905628f1a6fd0f0e0d48daf27174b27630399098f3cf95603a
Instruction Fuzzy Hash: 55410DB5E10209AFDF40DFA8C880AAEB7F9FF48710F508559E944EB240D734AE40CB65

Function 041B591C Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 041B59D3
Sleep.KERNEL32(0000000A,00000000), ref: 041B59E9
Sleep.KERNEL32(00000000), ref: 041B5A17
Sleep.KERNEL32(0000000A,00000000), ref: 041B5A2D

Strings

@., xrefs: 041B5AB4, 041B5AD6, 041B5BEC, 041B5C02

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: @.
API String ID: 3472027048-4201455939
Opcode ID: 54bf336d8ca77d34cc3223ac3ae0e68e8d333c322b45959439f090e6a042289e
Instruction ID: a1a3ba2fed48ec41926b1e152d273c12a498ebf5f60280d53838107f4a97a870
Opcode Fuzzy Hash: 54bf336d8ca77d34cc3223ac3ae0e68e8d333c322b45959439f090e6a042289e
Instruction Fuzzy Hash: E2C12372701251AFD71ADF2CE8C8396BBE3EB84329F1981A9D4998B385C774B841C7D4

Function 041B5CA0 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,041B5912), ref: 041B5D36
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,041B5912), ref: 041B5D50

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e0e8addf273d23840b266ebaea346bd5d44269704139d86faf9a2e06ab8c1dd8
Instruction ID: 96fa7af8792dd4a328c9b1b5520507121213d44aea7d87e8316e9ab9744a88d3
Opcode Fuzzy Hash: e0e8addf273d23840b266ebaea346bd5d44269704139d86faf9a2e06ab8c1dd8
Instruction Fuzzy Hash: BA71F231704340AFE716EF68D8C8B96BBD6AF8531DF1886A9D8C48B391D774A841C7D1

Function 041D66A0 Relevance: 12.1, APIs: 8, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 041D64A8: VirtualQuery.KERNEL32(?,?,0000001C,00000000,041D6654), ref: 041D64DB
Part of subcall function 041D64A8: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 041D64FF
Part of subcall function 041D64A8: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 041D651A
Part of subcall function 041D64A8: LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 041D65B5

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,041D67C5), ref: 041D6701
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 041D6734
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 041D6746
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 041D674C
GetStdHandle.KERNEL32(000000F4,041D67E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 041D6760
WriteFile.KERNEL32(00000000,000000F4,041D67E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 041D6766
LoadStringW.USER32(00000000,0000FFEC,?,00000040), ref: 041D678A
MessageBoxW.USER32(00000000,?,?,00002010), ref: 041D67A4

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID:
API String ID: 135118572-0
Opcode ID: 8b92061bfa9d4db499634ed3ef534215e79eae378691002a2bf70586867b8eed
Instruction ID: bf4225cd93bdbec70358c56198898181c9b26ddaa21ffd3bab6b0abe4dce9044
Opcode Fuzzy Hash: 8b92061bfa9d4db499634ed3ef534215e79eae378691002a2bf70586867b8eed
Instruction Fuzzy Hash: 153154B5644208BFFB14E694DCC2FEA73ACEB44704F5041A5BA14E61D0DB747E448BA5

Function 04296084 Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 042960B2
GetDeviceCaps.GDI32(?,00000068), ref: 042960CE
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 042960ED
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 04296111
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 0429612F
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 04296143
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 04296163
ReleaseDC.USER32(00000000,?), ref: 0429617B

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 856a5872ee115e7a95bcebae1557c91dcd18c13f1abbc2fcb5edad6216302fdf
Instruction ID: cd4f4cfc22214ee043e2a890379b8f1c56e9012ff342b101fde8b90ed4ad790a
Opcode Fuzzy Hash: 856a5872ee115e7a95bcebae1557c91dcd18c13f1abbc2fcb5edad6216302fdf
Instruction Fuzzy Hash: 632130B1A40208BAEB50DAA4CD85FAE73ECEB08708F904495FB08E7180D675BE408B65

Function 041B5E98 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c877c91396bba385d3ffd001d8707de023afa87dcb87fa318e05ef8d6d9b89c9
Instruction ID: b171f99e485b349544d3382bb0167fc040f3bcb2090f00e79f94c63f32e86fcc
Opcode Fuzzy Hash: c877c91396bba385d3ffd001d8707de023afa87dcb87fa318e05ef8d6d9b89c9
Instruction Fuzzy Hash: 51C134627106102BE719AB7DDCC43EEB2879BC432AF58867DE2D4CB385DB64E84583D1

Function 042AC798 Relevance: 10.7, APIs: 7, Instructions: 198windowCOMMON

Download Yara Rule

APIs

Part of subcall function 042AC400: DeleteObject.GDI32(?), ref: 042AC40B
Part of subcall function 042AC400: DeleteDC.GDI32(?), ref: 042AC418
Part of subcall function 042AC400: DeleteObject.GDI32(?), ref: 042AC434

CreateCompatibleDC.GDI32(00000000), ref: 042AC903
CreateHalftonePalette.GDI32(?,00000000), ref: 042AC93E
ResizePalette.GDI32(?,00000001), ref: 042AC973
SelectPalette.GDI32(?,?,00000000), ref: 042AC998
RealizePalette.GDI32(?), ref: 042AC9A3
CreateDIBSection.GDI32(?,-00000474,00000000,-00000450,00000000,00000000), ref: 042AC9CE
SelectObject.GDI32(?,00000000), ref: 042AC9E1

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Palette$CreateDeleteObject$Select$CompatibleHalftoneRealizeResizeSection
String ID:
API String ID: 2525607832-0
Opcode ID: a930444d4a5a4403e1b2074f51be96fc9af25bfb322d53c8d5448eda8efc3902
Instruction ID: be9e032e90ac1f5989176f144e4d668e73a76dc15279908cdecd785d93c56583
Opcode Fuzzy Hash: a930444d4a5a4403e1b2074f51be96fc9af25bfb322d53c8d5448eda8efc3902
Instruction Fuzzy Hash: 167125757105249FEB04DB19C8D4FA533E5EB4A304F0541E6EA048F3AACA70F85ACB96

Function 041B8850 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 041B8CDC: GetCurrentThreadId.KERNEL32 ref: 041B8CDF

GetTickCount.KERNEL32 ref: 041B8887
GetTickCount.KERNEL32 ref: 041B889F
GetCurrentThreadId.KERNEL32 ref: 041B88CE
GetTickCount.KERNEL32 ref: 041B88F9
GetTickCount.KERNEL32 ref: 041B8930
GetTickCount.KERNEL32 ref: 041B895A
GetCurrentThreadId.KERNEL32 ref: 041B89CA

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: a783da43aa8e5f6244e2c0acf16ed349082771b4d0cb622d17f5e164f14428f2
Instruction ID: ed2310c16b770578d5aa36613ad6bbff6c61f6999e8a470dc067a6825f0caa7b
Opcode Fuzzy Hash: a783da43aa8e5f6244e2c0acf16ed349082771b4d0cb622d17f5e164f14428f2
Instruction Fuzzy Hash: 51414D312083419EEB21FE7CC8C439ABAD9AFC1B58F15896DD4D887281EB75A484D793

Function 0429A090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 0429A0E2
MulDiv.KERNEL32(?,?,000009EC), ref: 0429A0F9
GetDC.USER32(00000000), ref: 0429A110
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,0429A1CB,?,00000000,?,?,000009EC,?,?,000009EC), ref: 0429A134
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,0429A1AB,?,?,00000000,00000000,00000008,?,00000000,0429A1CB), ref: 0429A167

Strings

`, xrefs: 0429A0C8

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: bf4cf5cc083e9c18f9becd1848000ed936424dac063612adcd6caea65500d80e
Instruction ID: 9bb6937c580f76f8851f4ba50edeb7d3b0e87a0f25c463f4ea0e36fb55f2fc12
Opcode Fuzzy Hash: bf4cf5cc083e9c18f9becd1848000ed936424dac063612adcd6caea65500d80e
Instruction Fuzzy Hash: 85314B75B10348ABEF00DFA4D881AAEB7F9EF08704F504495E904EB280D775AE40DBA5

Function 0429E9A8 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsEqualGUID.OLE32(?,?), ref: 0429E9B4
IsEqualGUID.OLE32(?,042C2700), ref: 0429E9D5
IsEqualGUID.OLE32(?,042C2710), ref: 0429E9EB

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Equal
String ID:
API String ID: 4016716531-0
Opcode ID: 49658c3c288a375e8e4cef2d9e3ae3d2dc18d69cd4da7973285872ec9ac44818
Instruction ID: 4c1db29870d044c569100d871fb04fd714a533b8e96a8f4cec5d76ef53fe49da
Opcode Fuzzy Hash: 49658c3c288a375e8e4cef2d9e3ae3d2dc18d69cd4da7973285872ec9ac44818
Instruction Fuzzy Hash: 6C118431314541DEFF55DA29EDC4BBA278DBF42208F051086ED548F2C2E7D5AC45CB66

Function 0429A974 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 042962F0: GetObjectW.GDI32(00000000,00000004), ref: 04296307
Part of subcall function 042962F0: GetPaletteEntries.GDI32(00000000,00000000,?,00000028), ref: 0429632A

GetDC.USER32(00000000), ref: 0429A9B2
CreateCompatibleDC.GDI32(?), ref: 0429A9BE
SelectObject.GDI32(?), ref: 0429A9CB
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,0429AA23,?,?,?,?,00000000), ref: 0429A9EF
SelectObject.GDI32(?,?), ref: 0429AA09
DeleteDC.GDI32(?), ref: 0429AA12
ReleaseDC.USER32(00000000,?), ref: 0429AA1D

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: dc9c36a6b81cde568a9a158aed88eaa0f1530f6219aabcf103bdc422bb6cd42c
Instruction ID: 4bc5887e79d42d6b3ff6bc31544ce000a735c6422fa251beaeaa9bccde9dbf0a
Opcode Fuzzy Hash: dc9c36a6b81cde568a9a158aed88eaa0f1530f6219aabcf103bdc422bb6cd42c
Instruction Fuzzy Hash: A5111272E10359BFEB10EBE8DC91AEEB3FCEB09714F5084A5A914E7240D774AE504B50

Function 041B98D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,041B998E,?,?,?,?,041B9AA2,041B6F13,041B6F5A,?,?), ref: 041B9909
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,041B998E,?,?,?,?,041B9AA2,041B6F13,041B6F5A,?), ref: 041B990F
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,041B998E,?,?,?), ref: 041B992A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,041B998E), ref: 041B9930

Strings

Runtime error at 00000000, xrefs: 041B9902, 041B9947
Error, xrefs: 041B9942

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: b0a89db87dbaf3508b822f68e68a628b4d297390594f8cfafba8df9dfeab94fb
Instruction ID: adb935025d1f546786407f5f22d5ef75555ca04af95c692b9f7580b8b92ca36b
Opcode Fuzzy Hash: b0a89db87dbaf3508b822f68e68a628b4d297390594f8cfafba8df9dfeab94fb
Instruction Fuzzy Hash: F1F0F6907A4340B9F7207BA8EDCAFDA2B5C9740B1DF14A60AF3D0E90C1C7B4748186E2

Function 042965E0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0429662E
GetSystemMetrics.USER32(0000000C), ref: 0429663A
GetDC.USER32(00000000), ref: 04296656
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0429667D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0429668A
ReleaseDC.USER32(00000000,00000000), ref: 042966C3

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: ebf15f8cf1e9fdcac20f31329e84bc99d066584d109e5d321908ba02d0cdae40
Instruction ID: b20efebcef97d35adba07afed2a9a1771555af802eb55e5beb6fbaba5a2db45d
Opcode Fuzzy Hash: ebf15f8cf1e9fdcac20f31329e84bc99d066584d109e5d321908ba02d0cdae40
Instruction Fuzzy Hash: 90314D74B10209EFEB00DFA4C981AAEBBF5EF49710F108569E918AB344D774AD40CBA1

Function 04296234 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 04296252
SelectObject.GDI32(00000000,00000000), ref: 0429625B
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,?,00000000,?,?,0429C367), ref: 0429626F
SelectObject.GDI32(00000000,00000000), ref: 0429627B
DeleteDC.GDI32(00000000), ref: 04296281
CreatePalette.GDI32 ref: 042962DC

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: f20511fa785460e14535b5a71f19f78c76a2019e9bc653984a77b238e6b229d1
Instruction ID: 70da24535401f7c1b09155efd26c3bd1daa81689ccf1a8f9964b2749728b6dbb
Opcode Fuzzy Hash: f20511fa785460e14535b5a71f19f78c76a2019e9bc653984a77b238e6b229d1
Instruction Fuzzy Hash: 6D11A32171430472FB18A7A59C81BAF72E8DFC5718F00C42EF989D7281EA78AC499396

Function 04296A9C Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 04296950: GetObjectW.GDI32(?,00000054), ref: 04296964

CreateCompatibleDC.GDI32(00000000), ref: 04296ABE
SelectPalette.GDI32(?,?,00000000), ref: 04296ADF
RealizePalette.GDI32(?), ref: 04296AEB
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 04296B02
SelectPalette.GDI32(?,00000000,00000000), ref: 04296B2A
DeleteDC.GDI32(?), ref: 04296B33

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: 585434fbcf0c3fa170e76296b8a1dd1e76ea2120a64e535b4b98db7fe84daf5c
Instruction ID: 6c5971f58fbdb87301fb857b4a82813d7343eab9a0beb6254a44c037748af201
Opcode Fuzzy Hash: 585434fbcf0c3fa170e76296b8a1dd1e76ea2120a64e535b4b98db7fe84daf5c
Instruction Fuzzy Hash: 82114275B002087FEB10DBA88C91F9EB7ECDB59710F508069B918E7280D674AD008764

Function 041B61E4 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,041B5358,00000000,?,00000000,?,?,00000000,041B6B8F), ref: 041B6206
WriteFile.KERNEL32(00000000,000000F4,041B5358,00000000,?,00000000,?,?,00000000,041B6B8F), ref: 041B620C
GetStdHandle.KERNEL32(000000F4,041B5354,00000000,?,00000000,00000000,000000F4,041B5358,00000000,?,00000000,?,?,00000000,041B6B8F), ref: 041B622B
WriteFile.KERNEL32(00000000,000000F4,041B5354,00000000,?,00000000,00000000,000000F4,041B5358,00000000,?,00000000,?,?,00000000,041B6B8F), ref: 041B6231
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,041B5354,00000000,?,00000000,00000000,000000F4,041B5358,00000000,?), ref: 041B6248
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,041B5354,00000000,?,00000000,00000000,000000F4,041B5358,00000000), ref: 041B624E

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: 0e49636a9815049819cf274b1b2a0ab2fd7dbdf653f9bee08c5812e586d71ee6
Instruction ID: c155ba8c741c78a096d064d80394c749ec017cfaf4a7592db1482fc57411efa0
Opcode Fuzzy Hash: 0e49636a9815049819cf274b1b2a0ab2fd7dbdf653f9bee08c5812e586d71ee6
Instruction Fuzzy Hash: 3F01FBA12596107DF290F7A8ACC8FEB378D9F58669F100A51F298E21D1C764AC4083F2

Function 041D64A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,041D6654), ref: 041D64DB
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 041D64FF
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 041D651A
LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 041D65B5

Strings

MZP, xrefs: 041D6519

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: d249ad8c9537017ed19ccc11f2869dcc594b63553fea0bc310c5f74cbe0b9b06
Instruction ID: 5c30dcb8c0092002bd117635cb54149ed1f06197dd3aa59b62377d79f6460d5c
Opcode Fuzzy Hash: d249ad8c9537017ed19ccc11f2869dcc594b63553fea0bc310c5f74cbe0b9b06
Instruction Fuzzy Hash: 8E4139B0A002589FEB20EF68CDC1BD9B7B9AB59344F4044E9E508E7240D776BE94CF51

Function 0429D0C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0429D17C
CreateHalftonePalette.GDI32(00000000,00000000), ref: 0429D189
ReleaseDC.USER32(00000000,00000000), ref: 0429D198
DeleteObject.GDI32(00000000), ref: 0429D206

Strings

(, xrefs: 0429D133

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: CreateDeleteHalftoneObjectPaletteRelease
String ID: (
API String ID: 577518360-3887548279
Opcode ID: e54395e50b803298aae2fefc7eb6c0b2de19ee4ad69c89c3f2482450253790e6
Instruction ID: 3948eedcd5e88117a1b5c21b224e4330182a9b285a2e34cf02327a8aa11a68d2
Opcode Fuzzy Hash: e54395e50b803298aae2fefc7eb6c0b2de19ee4ad69c89c3f2482450253790e6
Instruction Fuzzy Hash: A0419C70B24208EFEF14DFA8D888A9DBBF5EF49304F5080A5E404AB351DB74AE45EB50

Function 041E690C Relevance: 7.8, APIs: 5, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2180067fafba2259a42eb502b9bb3e2ff70bd091c56667adbf10d9886d8c36
Instruction ID: 9824d31711e43128b3c9d7d4e216b957d983d8ba066c96935f72935a0a6f1a59
Opcode Fuzzy Hash: dc2180067fafba2259a42eb502b9bb3e2ff70bd091c56667adbf10d9886d8c36
Instruction Fuzzy Hash: 1CD18C39A00A49AFDB00EF96C4C09FDBBB9FF59714FC440A5E840A7211E734BA95DB61

Function 042B1CB0 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 042B1CF9
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 042B1D28
SelectObject.GDI32(?,?), ref: 042B1D38
DeleteObject.GDI32(?), ref: 042B1F51
DeleteDC.GDI32(?), ref: 042B1F5D

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: CreateDeleteObject$CompatibleSectionSelect
String ID:
API String ID: 2986811175-0
Opcode ID: 254610e10f634edbe17c7f3ff1ce18189fc6ce40596856f56ea616684ab941e2
Instruction ID: 72e184902da5bce523edcf9875e6ea62d9c0b5b828d0d93f0d5ac560492d9b82
Opcode Fuzzy Hash: 254610e10f634edbe17c7f3ff1ce18189fc6ce40596856f56ea616684ab941e2
Instruction Fuzzy Hash: DDB1A0B4E102099FDB00DFA8C994AEEBBF5FF58344F2085A5E854AB365D730AD41CB90

Function 042A0894 Relevance: 7.6, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000038), ref: 042A08C0
memcpy.MSVCRT(00000000,00000000,000016C4), ref: 042A08F3
memcpy.MSVCRT(00000000,?,?), ref: 042A0989
memcpy.MSVCRT(00000000,?,?), ref: 042A099F
memcpy.MSVCRT(00000000,?,?), ref: 042A09B5
memcpy.MSVCRT(00000000,?,?), ref: 042A09C9

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction ID: 4ca1854ab95cbfc4eed35a981c315186f070f0ffa074394bff453562b3b3578a
Opcode Fuzzy Hash: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction Fuzzy Hash: 9E5151B1610600EFDB14CF68DCC5A9677A8BF88314F188669EE0D8F256E771F960CB94

Function 042B9DA8 Relevance: 7.6, APIs: 5, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,042B96E1,?,?,?,?,?,00000000,00000000), ref: 042B9E18
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00000000,042B96E1,?,?,?,?,?,00000000,00000000), ref: 042B9E47
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00000000,042B96E1,?,?,?,?,?,00000000,00000000), ref: 042B9E52
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,042B96E1,?,?,?,?,?,00000000,00000000), ref: 042B9E58
VirtualFree.KERNEL32(?,?,00008000,?,?,?,?,00000000,042B96E1,?,?,?,?,?,00000000,00000000), ref: 042B9E98

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Free$HeapVirtual$LibraryProcess
String ID:
API String ID: 565514093-0
Opcode ID: 4f0f11b22a6c76bee5274267447fb13333c91d1926d0ab53424ed3394fd4c7fa
Instruction ID: dd66ed2ced2c440abc841c3406b322d130d120f744c83a9f3dff63f7c4129531
Opcode Fuzzy Hash: 4f0f11b22a6c76bee5274267447fb13333c91d1926d0ab53424ed3394fd4c7fa
Instruction Fuzzy Hash: 8C3182B13006066FE310EE68DC84FA7B3A8FB85750F10861AE6A4C7260C720F885CBE0

Function 0429C31C Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0429C372
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0429C387
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0429C391
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,0429A7DB,00000000,0429A867), ref: 0429C3B5
ReleaseDC.USER32(00000000,00000000), ref: 0429C3C0

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction ID: 23ca149d73f90f7a02296a593174e656f9a6906256ee2af0d835fdfcc4eebe97
Opcode Fuzzy Hash: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction Fuzzy Hash: 5611BE3175129AAEEF30AF26C880BAE7BD1AF45355F441025FC109A180C7B4ADE1C7A5

Function 0429619C Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 042961B4
GetDeviceCaps.GDI32(?,00000068), ref: 042961D0
GetPaletteEntries.GDI32(2E080D0A,00000000,00000008,?), ref: 042961E8
GetPaletteEntries.GDI32(2E080D0A,00000008,00000008,?), ref: 04296200
ReleaseDC.USER32(00000000,?), ref: 0429621C

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: 6ad635b7e249461ea646c76d2ad636a1f3a8ff035744332f91d5a406d6404a0c
Instruction ID: 4010178eb941f8d6ed4f86f302493a1c943895e7e865319f7cd691804c26723f
Opcode Fuzzy Hash: 6ad635b7e249461ea646c76d2ad636a1f3a8ff035744332f91d5a406d6404a0c
Instruction Fuzzy Hash: 3211E571A48308BEFB04DBA8EC85BA97BE9E719714F808499F914DA1C0DAB67804C760

Function 041D3C28 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,041D3D0B), ref: 041D3CAE
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,041D3D0B), ref: 041D3CB4

Strings

yyyy, xrefs: 041D3C89
, xrefs: 041D3C7A

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 1e2ecaa2a8531d98c6c11841b8454635e1c4c855c192f839b219fa5dc6f6e55b
Instruction ID: 358c4ec24dc54db50794801cda914bdb0abb494c79930919dfd037324648547b
Opcode Fuzzy Hash: 1e2ecaa2a8531d98c6c11841b8454635e1c4c855c192f839b219fa5dc6f6e55b
Instruction Fuzzy Hash: FF2195B560461CABEB11DF58C9C16ADB3F8EF08740F5140A6ED45E7240D730BE00C7A6

Function 04293ED0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000000,00000000), ref: 04293EF7
GetObjectW.GDI32(?,00000010,?), ref: 04293F0A
GetObjectW.GDI32(?,00000000,?), ref: 04293F63

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Object
String ID:
API String ID: 2936123098-0
Opcode ID: d1a7e3cf58ae80fd88c1faef82ca287a06a422dbb061fddc6b53987912d2b056
Instruction ID: b719d2aa75e80277a4f36d727b463ad7ab236a1387bab4f62078eab11cef5cf4
Opcode Fuzzy Hash: d1a7e3cf58ae80fd88c1faef82ca287a06a422dbb061fddc6b53987912d2b056
Instruction Fuzzy Hash: BD318DB1714749AFEB20CF69CC80D6ABBF9AF49610B14846DECA4DB651D670EC008B60

Function 041BC998 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 041BC9A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 041BCA07
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 041BCA64
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 041BCA97

Part of subcall function 041BC954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,041BCA15), ref: 041BC96B
Part of subcall function 041BC954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,041BCA15), ref: 041BC988

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: d100bdb5d138ff05e3b188575e596ef1128f9c5c98578595b90d2aa7a219a849
Instruction ID: 4811286e5af7317c31621486c339372816a38e93979827517fe41a42c30d56be
Opcode Fuzzy Hash: d100bdb5d138ff05e3b188575e596ef1128f9c5c98578595b90d2aa7a219a849
Instruction Fuzzy Hash: 65310D70E0021A9BEB10DFB8D8C5BEEB7B5EF44304F0045A9D5A5E7250EB74AA05CBD1

Function 0429A788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 04294778: EnterCriticalSection.KERNEL32(042CDE34,?,04294858,?,?,?,?,?,?,?,?,00000000,04294870,?,042CDE34), ref: 04294780
Part of subcall function 04294778: LeaveCriticalSection.KERNEL32(042CDE34,042CDE34,?,04294858,?,?,?,?,?,?,?,?,00000000,04294870,?,042CDE34), ref: 0429478D
Part of subcall function 04294778: EnterCriticalSection.KERNEL32(?,042CDE34,042CDE34,?,04294858,?,?,?,?,?,?,?,?,00000000,04294870), ref: 04294796

Part of subcall function 0429C31C: GetDC.USER32(00000000), ref: 0429C372
Part of subcall function 0429C31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0429C387
Part of subcall function 0429C31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 0429C391
Part of subcall function 0429C31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,0429A7DB,00000000,0429A867), ref: 0429C3B5
Part of subcall function 0429C31C: ReleaseDC.USER32(00000000,00000000), ref: 0429C3C0

CreateCompatibleDC.GDI32(00000000), ref: 0429A7DD
SelectObject.GDI32(00000000,?), ref: 0429A7F6
SelectPalette.GDI32(00000000,?,000000FF), ref: 0429A81F
RealizePalette.GDI32(00000000), ref: 0429A82B

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: 38cfb6c1de88b08fd63403358eb73da5d637aa909897ad0294e83a46f501d4a3
Instruction ID: d32445dadfe1be4ba42cb617dd1284ec205744402131fc9a72aa76844d5bec31
Opcode Fuzzy Hash: 38cfb6c1de88b08fd63403358eb73da5d637aa909897ad0294e83a46f501d4a3
Instruction Fuzzy Hash: 4331F434B14648EFEB04EB69D980D9DB3F5FF48614BA241A5E804AB321D730FE81DB50

Function 0429DF8C Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 0429DFAD
GetObjectW.GDI32(?,00000018,?), ref: 0429DFCE
DeleteObject.GDI32(?), ref: 0429DFFA
DeleteObject.GDI32(?), ref: 0429E003

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: 416dbb97ca228ff66995d54da286a65da97052cef55220ab30287edf7cbd8a45
Instruction ID: 710e401bc77f2bfe14ae0c5459589f6a7dee20986cffe84cf40cafd7cab1d44d
Opcode Fuzzy Hash: 416dbb97ca228ff66995d54da286a65da97052cef55220ab30287edf7cbd8a45
Instruction Fuzzy Hash: 48114C75B14208AFDB04DFA9C981DAEB7F9EB88310B5184A9E904E7650DB30EE10DA50

Function 0429EDD0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0429EDD9
SelectObject.GDI32(00000000,058A00B4), ref: 0429EDEB
GetTextMetricsW.GDI32(00000000), ref: 0429EDF6
ReleaseDC.USER32(00000000,00000000), ref: 0429EE07

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: 8784cb8d719465d506d09a7a32dc72d3c1a48639f93ccd46392fc84f84c6e675
Instruction ID: 91d83e7fd8bd5513ba05950025a94f3b5eb611ca1ad4e1e084330f7aa8995335
Opcode Fuzzy Hash: 8784cb8d719465d506d09a7a32dc72d3c1a48639f93ccd46392fc84f84c6e675
Instruction Fuzzy Hash: 9AE04F6271666632E951A1695DC5BEB26888F125BAF490128FDA4992C0DB05ED10C3F3

Function 0429EBA4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

SetDIBits.GDI32(00000000,00000000), ref: 0429ECF4

Strings

,, xrefs: 0429EC6A
, xrefs: 0429EC8B

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,
API String ID: 3573556081-71045815
Opcode ID: 393874d369757f09cfdde50b59d714cef66776336864fdca136353f488b6ad4c
Instruction ID: ef3cedc6c48bd5465de3a5dd20afe7af7ba227455ddd11b92468a86b39262ffa
Opcode Fuzzy Hash: 393874d369757f09cfdde50b59d714cef66776336864fdca136353f488b6ad4c
Instruction Fuzzy Hash: 4451BF74A10208AFEB40DF99D8C4E9EB7F9FB48314F5181A5E914EB7A1D731AE04CB60

Function 0429E3C8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

GetDIBits.GDI32(00000000,00000000,00000000,?,?,0000002C,00000000), ref: 0429E4B2

Strings

,, xrefs: 0429E468
, xrefs: 0429E483

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,
API String ID: 3573556081-71045815
Opcode ID: a505ff082424428d887b4e155bafba2d66a785456775af2b639f365f06bb4e34
Instruction ID: 9293825d7a2bbcd55f4430f9dcd3aa577a9c8995b6f9b6268d4c6e0bb96425e3
Opcode Fuzzy Hash: a505ff082424428d887b4e155bafba2d66a785456775af2b639f365f06bb4e34
Instruction Fuzzy Hash: 204124B1A10108EFDB40DF68D888A9A77F9FF49314B5211A1EC08EB256D771FD45CB90

Function 042B989C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 042B98E9
VirtualProtect.KERNEL32(?,?,?,?,?), ref: 042B996E

Strings

FinalizeSections: VirtualProtect failed, xrefs: 042B997C

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID: FinalizeSections: VirtualProtect failed
API String ID: 2581862158-3584865983
Opcode ID: 9307abe5205ef066bfcacd73392628948bd9e7bd46a7c881c43d9dc737b572f7
Instruction ID: f9913a83484be8c370bef7f8588bbe37aa8781e24437c7e8b52ece7da0addac5
Opcode Fuzzy Hash: 9307abe5205ef066bfcacd73392628948bd9e7bd46a7c881c43d9dc737b572f7
Instruction Fuzzy Hash: 453105B47216069FE750DF59C884FDAB7E8AF49784F154584EAA8DB3A1C330F980CB94

Function 041D8748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,041DBB77,00000000,041DBCB7), ref: 041D8707

Strings

A, xrefs: 041D875E
Z, xrefs: 041D8763

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: CharUpper
String ID: A$Z
API String ID: 9403516-4098844585
Opcode ID: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction ID: db1b740147e831bb108541dbae72223292c567868f5547c293effd7c11454759
Opcode Fuzzy Hash: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction Fuzzy Hash: E81126527456101BF734747F5CC5BFEA68ADB863A4F4A023AE565C72C0EA44BC0193E1

Function 04299928 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetEnhMetaFileBits.GDI32(0000006C,?,00000000,042999F3), ref: 042999AB

Strings

EMF, xrefs: 0429994B
l, xrefs: 04299959

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: EMF$l
API String ID: 858000408-2398670571
Opcode ID: 00d296799d2abf1cc490e139c7e303ebb1d20a52c53f74be8660fce0b4a8a9fa
Instruction ID: 4fe2f12c535b454251620a4f1811ac49ebdb8f8ca5d08b34817f0a747a37716d
Opcode Fuzzy Hash: 00d296799d2abf1cc490e139c7e303ebb1d20a52c53f74be8660fce0b4a8a9fa
Instruction Fuzzy Hash: 66211871B10208DFEF11EFA8C890AAEB7F5FF48614B54456CE809AB344DB34BD419B99

Function 041D89EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,042BE4DB,00000000,042BE512), ref: 041D89F2

Part of subcall function 041C39B0: GetProcAddress.KERNEL32(041EC998,?), ref: 041C39DA

Strings

kernel32.dll, xrefs: 041D89ED
GetDiskFreeSpaceExW, xrefs: 041D89FD

Memory Dump Source

Source File: 00000004.00000002.1439672635.00000000041B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041B0000, based on PE: true

Associated: 00000004.00000002.1439652529.00000000041B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439766211.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439786523.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439809067.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439834420.00000000042C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439858845.00000000042C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439883284.00000000042CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439928144.00000000042D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439950114.00000000042D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1439978408.00000000042D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_41b0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: ddd6e7be6b352a9ddf34e01d4022ffc04ccf21e08420dbfe1d570e1182c5abe5
Instruction ID: cea170c5e28dbd19cda87f53367caf817e80bea0e65b135973a8df750a55ac8b
Opcode Fuzzy Hash: ddd6e7be6b352a9ddf34e01d4022ffc04ccf21e08420dbfe1d570e1182c5abe5
Instruction Fuzzy Hash: 1DD05EE07003665BE710BEAC7DC4B222284EB00709B401129B22595A03C7B5B8008680

Analysis Process: rundll32.exePID: 7380, Parent PID: 2924COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	332
Total number of Limit Nodes:	36

Executed Functions

Function 0040D2FC Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040D3BC,?,?), ref: 0040D32E
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040D3BC,?,?), ref: 0040D337

Part of subcall function 0040D1C4: FindFirstFileW.KERNEL32(00000000,?,00000000,0040D222,?,00000001), ref: 0040D1F7
Part of subcall function 0040D1C4: FindClose.KERNEL32(00000000,00000000,?,00000000,0040D222,?,00000001), ref: 0040D207

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: bb5aebafb1050cca1833a86485a25d2ce173cc466728c947d737821306c0bec7
Instruction ID: 31cc6c2f53d714b9faa06a3b986118d36ba9187928ad3646f11bb52bdd509fcd
Opcode Fuzzy Hash: bb5aebafb1050cca1833a86485a25d2ce173cc466728c947d737821306c0bec7
Instruction Fuzzy Hash: DD113670E042099BDF00EFA5D952AAEB3B4EF45304F50447EB904B73C2D7785E098669

Function 0040D1C4 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040D222,?,00000001), ref: 0040D1F7
FindClose.KERNEL32(00000000,00000000,?,00000000,0040D222,?,00000001), ref: 0040D207

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: fd6b56c6bec8101a1a2edd49b896a968750317b75b60eb436ea3e7407fe2b467
Instruction ID: f2706f95e4b90df003fff4208de2c5c05cd5cdeba3f5e8022b992bb7b9acb03d
Opcode Fuzzy Hash: fd6b56c6bec8101a1a2edd49b896a968750317b75b60eb436ea3e7407fe2b467
Instruction Fuzzy Hash: 80F08271944608BEDB20FBB5DC5299EB7FCEB48314BA005BAB404F31D2EB389E14995D

Function 0040CDE8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D00D,?,?), ref: 0040CE21
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D,?,?), ref: 0040CE6A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D,?,?), ref: 0040CE8C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040CEAA
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040CEC8
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040CEE6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040CF04
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D), ref: 0040CF44
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001), ref: 0040CF6F
RegCloseKey.ADVAPI32(?,0040CFF7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001,Software\Embarcadero\Locales), ref: 0040CFEA

Strings

Software\Embarcadero\Locales, xrefs: 0040CE60, 0040CE82
Software\Borland\Delphi\Locales, xrefs: 0040CEFA
Software\CodeGear\Locales, xrefs: 0040CEA0, 0040CEBE
Software\Borland\Locales, xrefs: 0040CEDC

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: f7c917e479dc5b8b684dcf2a59e43bffe3130ab6fea02e13758483d346620e00
Instruction ID: 80583e44c54d8f6c8431ac525ce0e8cce3f8a82ce7c118a8e5b64ed8406c3328
Opcode Fuzzy Hash: f7c917e479dc5b8b684dcf2a59e43bffe3130ab6fea02e13758483d346620e00
Instruction Fuzzy Hash: DC512675A40609BEEB20DBA5CC82FAFB7BCDB08704F504077BA04F61C1D6789D059A5D

Function 0040CAB4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000,00000000), ref: 0040CAD2
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000), ref: 0040CAF6
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000), ref: 0040CB05
IsValidLocale.KERNEL32(00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB17
EnterCriticalSection.KERNEL32(0051AC10,00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB74
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB9D

Strings

en-GB,en,en-US,, xrefs: 0040CAE2, 0040CB89

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 16983b795ea3f6d15511b6f3b7a2fd081026003eab2b4e0bc2c7165cd39925dc
Instruction ID: dbd07ac227d82710da470fa0a9828874cbe6fbb8e5c29b4c0eb771d3e90eaa4c
Opcode Fuzzy Hash: 16983b795ea3f6d15511b6f3b7a2fd081026003eab2b4e0bc2c7165cd39925dc
Instruction Fuzzy Hash: 59214220740744D7EA12B77AA85376E36A4EB45718F50853BB000B72C2D9BD9D418ADF

Function 004EEE14 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 004EEE3A

Part of subcall function 004EEDD0: GetDC.USER32(00000000), ref: 004EEDD9
Part of subcall function 004EEDD0: SelectObject.GDI32(00000000,058A00B4), ref: 004EEDEB
Part of subcall function 004EEDD0: GetTextMetricsW.GDI32(00000000), ref: 004EEDF6
Part of subcall function 004EEDD0: ReleaseDC.USER32(00000000,00000000), ref: 004EEE07

Strings

Tahoma, xrefs: 004EEE5C
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 004EEE90
MS Shell Dlg 2, xrefs: 004EEEA4

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma
API String ID: 2013942131-1011973972
Opcode ID: b43b7c253ca0e7b020e713c2f7fd32678dfc82551290083d2e8bc1c55bd140be
Instruction ID: e763a377c61329ebe6d03e34391351f465eb33a0e0e014ec5a7948b0a484b682
Opcode Fuzzy Hash: b43b7c253ca0e7b020e713c2f7fd32678dfc82551290083d2e8bc1c55bd140be
Instruction Fuzzy Hash: AE11D030600149AFC711EF6BCC52A9E7BB5EB45705F90847BF400A7791DB39AD01CB18

Function 0040961C Relevance: 6.2, APIs: 4, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00409653

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 5a2d98b2b9303db085ca7903a3e8743554e309b17d8937ec0eab1567879db523
Instruction ID: 57d564f7514a768ac0d6b140dc1e0ae383663f7c9c7dd69698fd604fdf563357
Opcode Fuzzy Hash: 5a2d98b2b9303db085ca7903a3e8743554e309b17d8937ec0eab1567879db523
Instruction Fuzzy Hash: FF516B706002449BDB25EF6AC88479B7BE1AF59314F14843FE809AA3D3D779DC88CB59

Function 0050E000 Relevance: 6.0, APIs: 4, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadLocale.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E02D

Part of subcall function 0040C520: InitializeCriticalSection.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C525
Part of subcall function 0040C520: GetVersion.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C533
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C55A
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C560
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C574
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C57A
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C58E
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C594

Part of subcall function 0040EE84: GetSystemInfo.KERNEL32 ref: 0040EE88

GetCommandLineW.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E092

Part of subcall function 00405244: GetStartupInfoW.KERNEL32 ref: 00405255

GetACP.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E0A6
GetCurrentThreadId.KERNEL32 ref: 0050E0BA

Part of subcall function 0040EE98: GetVersion.KERNEL32(0050E0C9,00000400,00000000,0050E0D7), ref: 0040EE98

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$InfoThreadVersion$CommandCriticalCurrentInitializeLineLocaleSectionStartupSystem
String ID:
API String ID: 2740004594-0
Opcode ID: da96efc90d0f3f823da1e0c30568e20cb602c22b5ccd4f7319bb0d9d278b2238
Instruction ID: b63630b870325ab19e945f9b7a74bc4420f07e9680e2ed97b13d29786ef075bf
Opcode Fuzzy Hash: da96efc90d0f3f823da1e0c30568e20cb602c22b5ccd4f7319bb0d9d278b2238
Instruction Fuzzy Hash: 3411217040478889D720FF72AC1A2693AA4FB19308710C87ED1006A2E2DFBD540CEF6E

Function 004D915C Relevance: 4.6, APIs: 3, Instructions: 150
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,004D931F), ref: 004D91D5
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,004D931F), ref: 004D924B
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 004D92BC

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 297e97f5790f3bfbe46446021c8049ae68c7a4fb6bdd877cd8b5aad7bbb95b8b
Instruction ID: ad3af0877aad2f918cc60e01b05eab59aa261d8504b712c7e441bbb361f6d9d3
Opcode Fuzzy Hash: 297e97f5790f3bfbe46446021c8049ae68c7a4fb6bdd877cd8b5aad7bbb95b8b
Instruction Fuzzy Hash: 87515431B00208BFDB11EBA5C852B9EB7FAAB48304F15446FB444E3382DA7D9F069759

Function 00427884 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,00427984), ref: 004278C9
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,00427967,?,00000000,?,00000000,00427984), ref: 00427902
VerQueryValueW.VERSION(?,00427998,?,?,00000000,?,00000000,?,00000000,00427967,?,00000000,?,00000000,00427984), ref: 0042791C

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: d254ea856f19eca79d65d9f3d227b80f169b0e93736270e157245cabf41f0a7c
Instruction ID: c637f2b1f86e41ba3c57f6c02bd3706f471a10e856d15e50b91235f572eefc7d
Opcode Fuzzy Hash: d254ea856f19eca79d65d9f3d227b80f169b0e93736270e157245cabf41f0a7c
Instruction Fuzzy Hash: BC3141B5A04319AFEB00DFA9D881DAEB7F8EB48704B9144BAF544E3241D778DE40CB65

Function 004D9EDC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,004D9BB9), ref: 004D9F07

Strings

8DA, xrefs: 004D9F26

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID: 8DA
API String ID: 3660427363-1089967677
Opcode ID: 0a138df36aef8c56d6c37a4c0dd57039eb0c0b1a053c200ce182fa245fd5cb98
Instruction ID: f2ccb1d253c45af4273b80b33fee71bea22e6aed8a8f890824dd2200bfb714ae
Opcode Fuzzy Hash: 0a138df36aef8c56d6c37a4c0dd57039eb0c0b1a053c200ce182fa245fd5cb98
Instruction Fuzzy Hash: 7E015E71A00208AFDB00EFA9DC81ADAB7A89B59314F0081ABF914DB342DA759E0587A5

Function 0040D3C8 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040D566,00000000,?,00000105), ref: 0040D473
GetSystemDefaultUILanguage.KERNEL32(00000000,0040D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040D566,00000000,?,00000105), ref: 0040D49B

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: e5fbb9e0fc620f56b36578c07845851fe2fed8148833940ec20a2950b4b279a8
Instruction ID: 914cf1b0947d833fcc03ff50d5076885400eec8b7426a2207ce03941fa5f7576
Opcode Fuzzy Hash: e5fbb9e0fc620f56b36578c07845851fe2fed8148833940ec20a2950b4b279a8
Instruction Fuzzy Hash: DB31EB30E142099BDB10EFA9C891BAEB7B5EF44304F50457BE400B72D2D778AD498A59

Function 0040D4EC Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D528
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D579

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 783f705d58062fb5f8e85dc88ba71afedba3f43c8334a4a5c8ebaaa4e4aa5bf8
Instruction ID: 258510d9c4dee0299c5f3f79c4fbca46c564eaaadbdb9c5c4e3057b0bb4fa4ad
Opcode Fuzzy Hash: 783f705d58062fb5f8e85dc88ba71afedba3f43c8334a4a5c8ebaaa4e4aa5bf8
Instruction Fuzzy Hash: 3F114F70E4461CABDB10EB94CC86BDE73B8DB04304F5144BAB508B72D1EA785F858A99

Function 00405600 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,00405C17), ref: 00405617

Strings

@., xrefs: 00405652, 00405670

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: @.
API String ID: 4275171209-4201455939
Opcode ID: e9bd031fac14de1d523f3f0fd1d0bc821c44dc6a8c79c950d7b754ab0e602f81
Instruction ID: 7dac567e4a07de2f06f580edb35680116b9bdba5c2a0860377bbd693bdd19f0d
Opcode Fuzzy Hash: e9bd031fac14de1d523f3f0fd1d0bc821c44dc6a8c79c950d7b754ab0e602f81
Instruction Fuzzy Hash: 49F0AFF2B003004FD7248F789D407A67AD4FB08324F10827FE908EB798DBB488048B84

Function 004D8EA0 Relevance: 3.0, APIs: 2, Instructions: 18
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegFlushKey.ADVAPI32(00000000,?,004D8F0C,?,?,00000000,004D9123,00000000,00000000,00000000,?,?,00000000,004D9139), ref: 004D8EB1
RegCloseKey.ADVAPI32(00000000,?,004D8F0C,?,?,00000000,004D9123,00000000,00000000,00000000,?,?,00000000,004D9139), ref: 004D8EBA

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction ID: 6f4c2654893a1a96a1da4be1dd0c350b83e18a7e628d6434c516513760379d46
Opcode Fuzzy Hash: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction Fuzzy Hash: 40D067B1E042049ADF60EF7AC9C5A577BDC6F44315B08C4ABB808DF247DA3CD9409B28

Function 004D98DC Relevance: 1.5, APIs: 1, Instructions: 36
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,?,?,?,004D9AE0,00000000,004D9C1C), ref: 004D990D

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ad67be82557188437bc6127552a9993e0998d0cde0f580ab283647e522f4a4dc
Instruction ID: bf80709a24f295cc4fff76cdf4c79f612c8773d4563c6b2b62db8eae0a0485ee
Opcode Fuzzy Hash: ad67be82557188437bc6127552a9993e0998d0cde0f580ab283647e522f4a4dc
Instruction Fuzzy Hash: 3CF01C623052046FD344FA6E9C81F6B66DC9B88754F10843FB248C7342D964DC058375

Function 0040C278 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00400000,?,0000020A), ref: 0040C296

Part of subcall function 0040D4EC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D528
Part of subcall function 0040D4EC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D579

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction ID: dd2aa8039920255b97d322d6193c29fca073ce87a4a4145dda77fc50cf625817
Opcode Fuzzy Hash: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction Fuzzy Hash: 07E0ED71E003109BCB10DF98C9C5A4737D8AB08754F0446A6AD14DF387D775DD148BD5

Function 0040EE84 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0040EE88

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction ID: 4e8efc271a9064b51e8e7fb51594f2112b3c6a5914667696f4d1ddbf71e3eb2d
Opcode Fuzzy Hash: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction Fuzzy Hash: 72A012208088000EC408A7194C4350F31805941118FC40624785CA92C2E619896546EF

Non-executed Functions

Function 0040CBF8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0041A5A8,?,?), ref: 0040CC15
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040CC26
FindFirstFileW.KERNEL32(?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD26
FindClose.KERNEL32(?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD38
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD44
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD89

Strings

kernel32.dll, xrefs: 0040CC10
\, xrefs: 0040CD56
GetLongPathNameW, xrefs: 0040CC20

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 047ad798f282a4f53d2bfa85006bf39dd452bc892cd983c7192c00f70524a19f
Instruction ID: 182d901b7ba620ca83dfe24b28ff924219823170be1df94bbfac5eeb8ceb1ef4
Opcode Fuzzy Hash: 047ad798f282a4f53d2bfa85006bf39dd452bc892cd983c7192c00f70524a19f
Instruction Fuzzy Hash: 73417F71A00618DBDB20EBA4CCC5ADEB3B5AF84314F1846BA9504F72C1E77CAE45CB49

Function 004FABB4 Relevance: 49.7, APIs: 33, Instructions: 249windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 004FABD2
CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 004FABE7
SelectObject.GDI32(00000000,00000000), ref: 004FABEE
CreateCompatibleDC.GDI32(?), ref: 004FAC22
CreateCompatibleDC.GDI32(?), ref: 004FAC2E
CreateCompatibleDC.GDI32(?), ref: 004FAC3A
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004FAC4D
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004FAC5D
CreateCompatibleBitmap.GDI32(?,?,?), ref: 004FAC6B
SelectObject.GDI32(?,?), ref: 004FAC7B
SelectObject.GDI32(?,?), ref: 004FAC8B
SelectObject.GDI32(?,?), ref: 004FAC9B
SetBkColor.GDI32(00000000,?), ref: 004FACA8
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 004FACCC
SetBkColor.GDI32(00000000,?), ref: 004FACD6
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00330008), ref: 004FACF2
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 004FAD12
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 004FAD2E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,008800C6), ref: 004FAD4F
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00EE0086), ref: 004FAD70
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 004FAD90
SelectObject.GDI32(?,?), ref: 004FAD9D
DeleteObject.GDI32(00000000), ref: 004FADA3
SelectObject.GDI32(?,?), ref: 004FADB0
DeleteObject.GDI32(00000000), ref: 004FADB6
SelectObject.GDI32(?,?), ref: 004FADC3
DeleteObject.GDI32(00000000), ref: 004FADC9
SelectObject.GDI32(00000000,?), ref: 004FADD3
DeleteObject.GDI32(00000000), ref: 004FADD9
DeleteDC.GDI32(?), ref: 004FADE2
DeleteDC.GDI32(?), ref: 004FADEB
DeleteDC.GDI32(?), ref: 004FADF4
DeleteDC.GDI32(00000000), ref: 004FADFA

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteSelect$Compatible$Bitmap$Stretch$Color
String ID:
API String ID: 881050057-0
Opcode ID: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction ID: 825b2a03bc1370e51723bfade82acbff92c39003225e20d7aaefe19e3380dd92
Opcode Fuzzy Hash: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction Fuzzy Hash: 82815BB2E40218BADB10DEE9CD85FDFBBBCAB09715F104459F604FB241D675AE408BA4

Function 0042EF9C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 0042EFA5

Part of subcall function 0042EF70: GetProcAddress.KERNEL32(00000000), ref: 0042EF89

Strings

VarDateFromStr, xrefs: 0042F113
VarXor, xrefs: 0042F0A5
VarR4FromStr, xrefs: 0042F0E7
VarBstrFromCy, xrefs: 0042F155
VarBstrFromBool, xrefs: 0042F181
VarMod, xrefs: 0042F063
VarDiv, xrefs: 0042F037
VarIdiv, xrefs: 0042F04D
VarBoolFromStr, xrefs: 0042F13F
VarCmp, xrefs: 0042F0BB
VarBstrFromDate, xrefs: 0042F16B
VarNot, xrefs: 0042EFDF
VarMul, xrefs: 0042F021
VarSub, xrefs: 0042F00B
VarAnd, xrefs: 0042F079
VarI4FromStr, xrefs: 0042F0D1
VarR8FromStr, xrefs: 0042F0FD
VarOr, xrefs: 0042F08F
VarCyFromStr, xrefs: 0042F129
VarNeg, xrefs: 0042EFC9
VarAdd, xrefs: 0042EFF5
VariantChangeTypeEx, xrefs: 0042EFB3
oleaut32.dll, xrefs: 0042EFA0

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 51ba0cccc0257aa61a896f7588f8220aaff411b585e609356873e0dfdd144972
Instruction ID: 4d8a8b603ccf47e63391c59ab7cad31be334c78caf3acb6b5dd0fd78b8a56fbb
Opcode Fuzzy Hash: 51ba0cccc0257aa61a896f7588f8220aaff411b585e609356873e0dfdd144972
Instruction Fuzzy Hash: 15412761708239AA53046B6FBE0146677F8EA567103E1C4BBB404CBA69DB3CBC89573D

Function 004E5CEC Relevance: 37.7, APIs: 25, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 004E5D2F
SelectObject.GDI32(?,?), ref: 004E5D44
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029,00000000,004E5DB4,?,?), ref: 004E5D88
SelectObject.GDI32(?,?), ref: 004E5DA2
DeleteObject.GDI32(?), ref: 004E5DAE
CreateCompatibleDC.GDI32(00000000), ref: 004E5DC2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 004E5DE3
SelectObject.GDI32(?,?), ref: 004E5DF8
SelectPalette.GDI32(?,04080DA1,00000000), ref: 004E5E0C
SelectPalette.GDI32(?,?,00000000), ref: 004E5E1E
SelectPalette.GDI32(?,00000000,000000FF), ref: 004E5E33
SelectPalette.GDI32(?,04080DA1,000000FF), ref: 004E5E49
RealizePalette.GDI32(?), ref: 004E5E55
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 004E5E77
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 004E5E99
SetTextColor.GDI32(?,00000000), ref: 004E5EA1
SetBkColor.GDI32(?,00FFFFFF), ref: 004E5EAF
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 004E5EDB
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 004E5F00
SetTextColor.GDI32(?,?), ref: 004E5F0A
SetBkColor.GDI32(?,?), ref: 004E5F14
SelectObject.GDI32(?,00000000), ref: 004E5F27
DeleteObject.GDI32(?), ref: 004E5F30
SelectPalette.GDI32(?,00000000,00000000), ref: 004E5F52
DeleteDC.GDI32(?), ref: 004E5F5B

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: 633453bf2c48ce03e247ec2b81a48ec99632c9476f598eb0465a6c910d4e93b0
Instruction ID: 7e34b47df675e310dc5c431b833758e8618fd829fb4f05e09537ec8c552b7f3b
Opcode Fuzzy Hash: 633453bf2c48ce03e247ec2b81a48ec99632c9476f598eb0465a6c910d4e93b0
Instruction Fuzzy Hash: 298192B2A00209AFDB50DEA9CC85EEF7BEDAB0D715F100559F618E7240C238AE408B65

Function 004EB140 Relevance: 31.7, APIs: 21, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 004EB163
GetDC.USER32(00000000), ref: 004EB191
CreateCompatibleDC.GDI32(?), ref: 004EB1A2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004EB1BD
SelectObject.GDI32(?,00000000), ref: 004EB1D7
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 004EB1F9
CreateCompatibleDC.GDI32(?), ref: 004EB207
SelectObject.GDI32(00000000,00000000), ref: 004EB24F
SelectPalette.GDI32(00000000,?,00000000), ref: 004EB262
RealizePalette.GDI32(00000000), ref: 004EB26B
SelectPalette.GDI32(?,?,00000000), ref: 004EB277
RealizePalette.GDI32(?), ref: 004EB280
SetBkColor.GDI32(00000000,00000000), ref: 004EB28A
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 004EB2AE
SetBkColor.GDI32(00000000,00000000), ref: 004EB2B8
SelectObject.GDI32(00000000,00000000), ref: 004EB2CB
DeleteObject.GDI32(00000000), ref: 004EB2D7
DeleteDC.GDI32(00000000), ref: 004EB2ED
SelectObject.GDI32(?,00000000), ref: 004EB308
DeleteDC.GDI32(00000000), ref: 004EB324
ReleaseDC.USER32(00000000,00000000), ref: 004EB335

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 12377b0042ab6e2186f72ca2209710d3867943cee396a54fa97a17432a339029
Instruction ID: a297371bd76699a261ad6334b1a26cfdb4486747052644e0b66a5fa1a439e62f
Opcode Fuzzy Hash: 12377b0042ab6e2186f72ca2209710d3867943cee396a54fa97a17432a339029
Instruction Fuzzy Hash: 1E51FF72E00355BBDB10DAEACC56FEFB7BCEF09705F10445AB614E7281D6789A408B94

Function 004EC71C Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 357windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EC9A4
CreateCompatibleDC.GDI32(00000001), ref: 004ECA09
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 004ECA1E
SelectObject.GDI32(?,00000000), ref: 004ECA28
SelectPalette.GDI32(?,?,00000000), ref: 004ECA58
RealizePalette.GDI32(?), ref: 004ECA64
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 004ECA88
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,004ECAE1,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 004ECA96
SelectPalette.GDI32(?,00000000,000000FF), ref: 004ECAC8
SelectObject.GDI32(?,?), ref: 004ECAD5
DeleteObject.GDI32(00000000), ref: 004ECADB

Strings

BM, xrefs: 004EC83D
(, xrefs: 004EC8D2

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: 06172eab94f90816d8fcea74208310c2f8031239db771bfbf657de5ecc066925
Instruction ID: 8f5e701118070d7f3b811339cbba0b7200461a88ecde5f835bf7e79e6a4a5d8f
Opcode Fuzzy Hash: 06172eab94f90816d8fcea74208310c2f8031239db771bfbf657de5ecc066925
Instruction Fuzzy Hash: 29E16E70A002589FDF04DFAAC885BAEBBF5FF49305F10856AF904A7391D7389941CB58

Function 004EB698 Relevance: 24.3, APIs: 16, Instructions: 265windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

SelectPalette.GDI32(?,?,000000FF), ref: 004EB6DB
RealizePalette.GDI32(?), ref: 004EB6EA
GetStretchBltMode.GDI32(00000000), ref: 004EB6FC
GetDeviceCaps.GDI32(?,0000000C), ref: 004EB70D
GetDeviceCaps.GDI32(?,0000000E), ref: 004EB71C
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C,00000000), ref: 004EB74F
SetStretchBltMode.GDI32(?,00000004), ref: 004EB75D
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C,00000000), ref: 004EB775
SetStretchBltMode.GDI32(00000000,00000003), ref: 004EB792
CreateCompatibleDC.GDI32(00000000), ref: 004EB7F3
SelectObject.GDI32(?,?), ref: 004EB808
SelectObject.GDI32(?,00000000), ref: 004EB867
DeleteDC.GDI32(00000000), ref: 004EB876

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$ModePaletteSelectStretch$BrushCreateObject$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 28117789-0
Opcode ID: 230a5d8b8307ea4118e7af7672871789c69a95fa8ce89b2824e3c90030dde8aa
Instruction ID: 489584e9c4cd725b990482e09af51c0bca80148c9d3d35cd6fb0d49a7a8e8351
Opcode Fuzzy Hash: 230a5d8b8307ea4118e7af7672871789c69a95fa8ce89b2824e3c90030dde8aa
Instruction Fuzzy Hash: 76A1D8B1600245AFDB40EFAAC985F9AB7E8EF08305F504559F605E7652D738ED40CBA4

Function 00508BF4 Relevance: 21.2, APIs: 6, Strings: 8, Instructions: 217COMMON

Download Yara Rule

Strings

BTMemoryLoadLibary: dll dos header is not valid, xrefs: 00508C3C
MZ, xrefs: 00508C2F
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid, xrefs: 00508C81
BTMemoryLoadLibary: VirtualAlloc failed, xrefs: 00508CD8
BTMemoryLoadLibary: BuildImportTable failed, xrefs: 00508DC0
BTMemoryLoadLibary: Can't attach library, xrefs: 00508E38
BTMemoryLoadLibary: Get DLLEntyPoint failed, xrefs: 00508E0D
PE, xrefs: 00508C70

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: BTMemoryLoadLibary: BuildImportTable failed$BTMemoryLoadLibary: Can't attach library$BTMemoryLoadLibary: Get DLLEntyPoint failed$BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid$BTMemoryLoadLibary: VirtualAlloc failed$BTMemoryLoadLibary: dll dos header is not valid$MZ$PE
API String ID: 0-3631919656
Opcode ID: 6e4d513ac01d812deda07d42d4f0bb60a9222b2efc96a019af35ad9d5aec9819
Instruction ID: 9c6bc1d11ade60998108279bb5ea5792c0716e04395656ce4e0180a3e49dbbe4
Opcode Fuzzy Hash: 6e4d513ac01d812deda07d42d4f0bb60a9222b2efc96a019af35ad9d5aec9819
Instruction Fuzzy Hash: EA718C71B08205AFEB10DB69DC81FAEBBF9FB88310F0084A9F544E72C1DA7499458B65

Function 004E5B58 Relevance: 21.1, APIs: 14, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004E5B6F
CreateCompatibleDC.GDI32(00000000), ref: 004E5B79
GetObjectW.GDI32(?,00000018,?), ref: 004E5B99
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004E5BB0
GetDC.USER32(00000000), ref: 004E5BBC
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004E5BE9
ReleaseDC.USER32(00000000,00000000), ref: 004E5C0F
SelectObject.GDI32(?,?), ref: 004E5C2A
SelectObject.GDI32(?,00000000), ref: 004E5C39
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 004E5C65
SelectObject.GDI32(?,00000000), ref: 004E5C73
SelectObject.GDI32(?,00000000), ref: 004E5C81
DeleteDC.GDI32(?), ref: 004E5C97
DeleteDC.GDI32(?), ref: 004E5CA0

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: aef1841c4e128ff32c9b36ede18983638337cbd9838766df907cc8eb69374be7
Instruction ID: 17c9c49937640a7ee63a15ab90711d013368aaab887e413720973401a1c3c297
Opcode Fuzzy Hash: aef1841c4e128ff32c9b36ede18983638337cbd9838766df907cc8eb69374be7
Instruction Fuzzy Hash: 3D410C72E40754BFDB10EAE9C952FAFB7BCAB09705F50045AB600E7281D6789A4087A4

Function 0040C520 Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C525
GetVersion.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C533
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C55A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C560
GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C574
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C57A
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C58E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C594

Strings

GetThreadPreferredUILanguages, xrefs: 0040C550
SetThreadPreferredUILanguages, xrefs: 0040C56A
GetThreadUILanguage, xrefs: 0040C584
kernel32.dll, xrefs: 0040C555, 0040C56F, 0040C589

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$CriticalInitializeSectionVersion
String ID: GetThreadPreferredUILanguages$GetThreadUILanguage$SetThreadPreferredUILanguages$kernel32.dll
API String ID: 74573329-1403180336
Opcode ID: 3eb0d1b683875d0a4e7ed686173063676bd5968c29d9e357da0c930b2f0c2479
Instruction ID: 8edfc10a46b7400df28ad4f2c85025a5e0675a444164cbed82ad90a550fe5e83
Opcode Fuzzy Hash: 3eb0d1b683875d0a4e7ed686173063676bd5968c29d9e357da0c930b2f0c2479
Instruction Fuzzy Hash: 15F05EB8951B10BADA023772AD8375F3680DA1070CB20853BB100790D2DEBC19549E9E

Function 004EB964 Relevance: 19.8, APIs: 13, Instructions: 255windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

SelectPalette.GDI32(?,?,000000FF), ref: 004EB9A7
RealizePalette.GDI32(?), ref: 004EB9B6
GetDeviceCaps.GDI32(?,0000000C), ref: 004EB9C8
GetDeviceCaps.GDI32(?,0000000E), ref: 004EB9D7
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 004EBA0A
SetStretchBltMode.GDI32(?,00000004), ref: 004EBA18
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 004EBA30
SetStretchBltMode.GDI32(00000000,00000003), ref: 004EBA4D
CreateCompatibleDC.GDI32(00000000), ref: 004EBAAE
SelectObject.GDI32(?,?), ref: 004EBAC3
SelectObject.GDI32(?,00000000), ref: 004EBB22
DeleteDC.GDI32(00000000), ref: 004EBB31

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: cd1fa1e0ecb1de98fa74186667cffcb93663ecd76ac09dee35a8bf4f5781b3c6
Instruction ID: 7ad90294f0dfa4864f0bea30e35c96d4e1fa41525923fe95d334a894f78dac22
Opcode Fuzzy Hash: cd1fa1e0ecb1de98fa74186667cffcb93663ecd76ac09dee35a8bf4f5781b3c6
Instruction Fuzzy Hash: 54912971604245AFDB50DFAAC981F9FBBE8AB08305F10455AF505E7651D738ED40CBA4

Function 004EE9A8 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsEqualGUID.OLE32(?,?), ref: 004EE9B4
IsEqualGUID.OLE32(?,00512700), ref: 004EE9D5
IsEqualGUID.OLE32(?,00512710), ref: 004EE9EB

Strings

'Q, xrefs: 004EE9FA
0'Q, xrefs: 004EEA10
@'Q, xrefs: 004EEA26
P'Q, xrefs: 004EEA3C

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Equal
String ID: 'Q$0'Q$@'Q$P'Q
API String ID: 4016716531-2080303212
Opcode ID: 007965bd84731ced0e30fb3b550bc28211e7d694a603a06419af7a6eb232b05a
Instruction ID: c6863bf32aed3cc6d178efe28d16b0f1739fe57731d8461fab35a45826482c07
Opcode Fuzzy Hash: 007965bd84731ced0e30fb3b550bc28211e7d694a603a06419af7a6eb232b05a
Instruction Fuzzy Hash: A21175710085849ADB61DB2BAD80AB72B9D6F5A305F04609BFD854F243D39D884A876E

Function 00425DC8 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 199threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408850: GetTickCount.KERNEL32 ref: 00408887
Part of subcall function 00408850: GetTickCount.KERNEL32 ref: 0040889F

Part of subcall function 00425334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

GetThreadLocale.KERNEL32(00000000,00000004), ref: 00425E60
EnumCalendarInfoW.KERNEL32(00425C8C,00000000,00000000,00000004), ref: 00425E6B
GetThreadLocale.KERNEL32(00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425EA6
EnumCalendarInfoW.KERNEL32(00425D30,00000000,00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425EB1
GetThreadLocale.KERNEL32(00000000,00000004), ref: 00425F42
EnumCalendarInfoW.KERNEL32(00425C8C,00000000,00000000,00000004), ref: 00425F4D
GetThreadLocale.KERNEL32(00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425F8A
EnumCalendarInfoW.KERNEL32(00425D30,00000000,00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425F95

Strings

B.C., xrefs: 00425EF0
[B, xrefs: 00425E21, 00425EDD, 00426014

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.$[B
API String ID: 1601775584-1960173975
Opcode ID: f2dd90239b7de721a8a68e07053e84b89978a8917de83ad03976cfd37db5961f
Instruction ID: 696a8cbb88cbf135683503293481ae752516e7a6c47e6b4c93b3b9376ce1ac3d
Opcode Fuzzy Hash: f2dd90239b7de721a8a68e07053e84b89978a8917de83ad03976cfd37db5961f
Instruction Fuzzy Hash: 9761F570B006129FE710EF69E885AAA77E5EF44724B51857EF400EB3E1C738AD41DB98

Function 004ED7A0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 258windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004ED0C0: DeleteObject.GDI32(00000000), ref: 004ED206

DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004ED865
GetDIBits.GDI32(00000000,00000000,00000000,00000000,?,?), ref: 004ED8E3
GetIconInfo.USER32(00000000,?), ref: 004ED947
GetDIBits.GDI32(00000000,?,00000000,00000000,?,00000000,?), ref: 004ED980
SetDIBits.GDI32(00000000,00000000,?,00000000,?,00000000,004EDA2B), ref: 004ED9E9
DeleteObject.GDI32(?), ref: 004ED9FF
DeleteObject.GDI32(?), ref: 004EDA08

Strings

, xrefs: 004ED890
,, xrefs: 004ED86A

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: BitsDeleteObject$Icon$DrawInfo
String ID: $,
API String ID: 1810795657-71045815
Opcode ID: 0c5187b6c173e4ec8a62df78b25059c000a8f0dee15bd527dab433ee5dea9988
Instruction ID: 3b15df45811348dce314f71d9fb3896dfd83895a50164542f8512fd99f32aa23
Opcode Fuzzy Hash: 0c5187b6c173e4ec8a62df78b25059c000a8f0dee15bd527dab433ee5dea9988
Instruction Fuzzy Hash: F4913871B00145AFD700EFAAC885A9EBBF9FF48305F6041AAF505EB251DA34ED45CB94

Function 004253AC Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,00425691,?,?,?,?,00000000,00000000), ref: 004253D3
GetThreadLocale.KERNEL32(?,00000001,00000000,00425691,?,?,?,?,00000000,00000000), ref: 004253DC

Part of subcall function 00425380: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,00425482,?,00000001,00000000,00425691), ref: 00425393

Part of subcall function 00425334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

Strings

:mm:ss, xrefs: 00425644
m/d/yy, xrefs: 004254DD
:mm, xrefs: 00425629
2, xrefs: 0042566D
AMPM , xrefs: 00425619
mmmm d, yyyy, xrefs: 00425502
AMPM, xrefs: 0042560A

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: ecbc7d69b4f11c979955816f9b11cd38cc839c94d643873308f8a088d78fbf3d
Instruction ID: ae11f37f10c7c7cc2ece4aa2851bd9592c5e3db29736d4fa45ff2483457f4832
Opcode Fuzzy Hash: ecbc7d69b4f11c979955816f9b11cd38cc839c94d643873308f8a088d78fbf3d
Instruction Fuzzy Hash: 597122307005699BDB01EBA5E881ADE72A6DF84344FD0807BF904EB646DB3CDE16879D

Function 004266A0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004264A8: VirtualQuery.KERNEL32(?,?,0000001C,00000000,00426654), ref: 004264DB
Part of subcall function 004264A8: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004264FF
Part of subcall function 004264A8: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0042651A
Part of subcall function 004264A8: LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 004265B5

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,004267C5), ref: 00426701
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00426734
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00426746
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0042674C
GetStdHandle.KERNEL32(000000F4,004267E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 00426760
WriteFile.KERNEL32(00000000,000000F4,004267E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00426766
LoadStringW.USER32(00000000,0000FFEC,?,00000040), ref: 0042678A
MessageBoxW.USER32(00000000,?,?,00002010), ref: 004267A4

Strings

tfB, xrefs: 00426711, 004267B9

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: tfB
API String ID: 135118572-130872579
Opcode ID: 3dc69bbbad4423d8116cc954f91589938586fb7d2a9201699b68ed620bc6b023
Instruction ID: 4675e2f228e3fe44f78412d4bae6f2d2f5cb188f2df6465d8c680709d84dbd1c
Opcode Fuzzy Hash: 3dc69bbbad4423d8116cc954f91589938586fb7d2a9201699b68ed620bc6b023
Instruction Fuzzy Hash: 6F318475744218BFEB10EB65DC83FDA73BCEB04704F9041A6B604E61D2DA78AE84876C

Function 004E4AC0 Relevance: 15.2, APIs: 10, Instructions: 228windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E4780
Part of subcall function 004E4778: LeaveCriticalSection.KERNEL32(0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E478D
Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(?,0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870), ref: 004E4796

CreateCompatibleDC.GDI32(00000000), ref: 004E4B64
SelectObject.GDI32(?,?), ref: 004E4B74
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00CC0020), ref: 004E4C70
SetTextColor.GDI32(?,00000000), ref: 004E4C7E
SetBkColor.GDI32(?,00FFFFFF), ref: 004E4C92
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00E20746), ref: 004E4CC5
SetTextColor.GDI32(?,?), ref: 004E4CD5
SetBkColor.GDI32(?,?), ref: 004E4CE5
SelectObject.GDI32(?,00000000), ref: 004E4D15
DeleteDC.GDI32(?), ref: 004E4D1E

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Color$CriticalSection$EnterObjectSelectStretchText$CompatibleCreateDeleteLeave
String ID:
API String ID: 675119849-0
Opcode ID: 17a9f5c396fd801cce45f3af1a2c03a7e908330b3a1013798d2b0e4747143bd7
Instruction ID: 71bf14b9f78042d93af0d274de238ac5bd12102c0260bb26fb2fcf8b95af7db9
Opcode Fuzzy Hash: 17a9f5c396fd801cce45f3af1a2c03a7e908330b3a1013798d2b0e4747143bd7
Instruction Fuzzy Hash: EE919375A00248AFCB40DFAAC981E9EBBF9EF4D315B10449AF505EB661C734EE41CB64

Function 004085C8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 004085DD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004085E3
GetLogicalProcessorInformation.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 004085F6
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 004085FF
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,00408676,?,00000000,?,GetLogicalProcessorInformation), ref: 0040862A

Strings

kernel32.dll, xrefs: 004085D8
@, xrefs: 0040867D
GetLogicalProcessorInformation, xrefs: 004085D3

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: 9b6de5aca907aff7f49779a1cb565253b723d78320fe21404139914b83ab067e
Instruction ID: 500c6e41f31b7fdb6d34238680861789b78f08bdeabe16a24c436e355b3d89bb
Opcode Fuzzy Hash: 9b6de5aca907aff7f49779a1cb565253b723d78320fe21404139914b83ab067e
Instruction Fuzzy Hash: E0116370D00208AADB10EBA5CA05B5EB7A4DF04304F1288BFE854B72C1DA7E8E508E59

Function 00410594 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0041064C

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 01433c88fba5b4f775e71df606895a677a3445a2bc368d898035e78ffffcbf29
Instruction ID: 0ce41ded5bccfca64fbac36b7d610e41f84856dd8e2a7bbc42b78d3b128abe8f
Opcode Fuzzy Hash: 01433c88fba5b4f775e71df606895a677a3445a2bc368d898035e78ffffcbf29
Instruction Fuzzy Hash: 0CA19075A013099FDB20DFA8D881BEEB7B5FF58310F14812AE915A7390DBB4A9C4CB54

Function 005090EC Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00509351,?,00000000,?,00000000), ref: 0050916E
IsBadReadPtr.KERNEL32(?,00000014), ref: 00509322

Strings

BuildImportTable: GetProcAddress failed, xrefs: 005092F5
BuildImportTable: ReallocMemory failed, xrefs: 00509200
BuildImportTable: can't load library: , xrefs: 005091B5

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: LibraryLoadRead
String ID: BuildImportTable: GetProcAddress failed$BuildImportTable: ReallocMemory failed$BuildImportTable: can't load library:
API String ID: 1452896035-1384308123
Opcode ID: fec72f428e9e5fd8645979bd42ab091f130e43ea622af32e7275661ee3c46161
Instruction ID: 02cc94906a68124a9370f8ceecbd919fc37109b6d976b31db0f28863f67d752b
Opcode Fuzzy Hash: fec72f428e9e5fd8645979bd42ab091f130e43ea622af32e7275661ee3c46161
Instruction Fuzzy Hash: F1715E70A00206AFDB10DB69C885BEEBBF9FF89310F408869B055E72D6D774AD85CB50

Function 00430A54 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00430AED
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00430B09
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 00430B42
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00430BBF
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 00430BD8
VariantCopy.OLEAUT32(?), ref: 00430C0D

Strings

, xrefs: 00430A6E

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction ID: c5ac3e0bb315912875ce6d6a8b12eb4200af54bb65bf5f77a9b42e84e07fd96b
Opcode Fuzzy Hash: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction Fuzzy Hash: 2C51227590022D9BCB25DB59CC91BDAB3BCAF4C304F0052DAF548E7252D634AF848F65

Function 004E9A04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 004E9AA6
MulDiv.KERNEL32(?,000009EC,00000000), ref: 004E9AC3
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004E9AEF
GetEnhMetaFileHeader.GDI32(00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004E9B0F
DeleteEnhMetaFile.GDI32(00000016), ref: 004E9B30
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 004E9B43

Strings

`, xrefs: 004E9A8B

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: 1bc734305bfd0bdb724ca875092e956d4852018e6443de175511f346f92c27bf
Instruction ID: e4881d64baec76ee9eafe246b21c5bc9d5a9281d976d74d65e8b275913b0d6f5
Opcode Fuzzy Hash: 1bc734305bfd0bdb724ca875092e956d4852018e6443de175511f346f92c27bf
Instruction Fuzzy Hash: 8A412275D00248AFDB40DFA9C881AAEB7F9FF48711F50816AF904EB241E7389E40CB64

Function 004061E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 00406206
WriteFile.KERNEL32(00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 0040620C
GetStdHandle.KERNEL32(000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 0040622B
WriteFile.KERNEL32(00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 00406231
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?), ref: 00406248
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000), ref: 0040624E

Strings

TS@, xrefs: 00406218, 00406223

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: TS@
API String ID: 3320372497-1941835897
Opcode ID: 773f2b01c096205ed1640b90909cb80b96b374e64d656fdce13fcbbb072e403a
Instruction ID: 82cfcf8d63e4733cb96d407babe502fa205990dff362196b090b8b3cf9cfd937
Opcode Fuzzy Hash: 773f2b01c096205ed1640b90909cb80b96b374e64d656fdce13fcbbb072e403a
Instruction Fuzzy Hash: 9D0162A16486147DE110F2BA9C8AF6F368CDB18724F10077E7618F60D2C5785C449B7A

Function 0040591C Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 004059D3
Sleep.KERNEL32(0000000A,00000000), ref: 004059E9
Sleep.KERNEL32(00000000), ref: 00405A17
Sleep.KERNEL32(0000000A,00000000), ref: 00405A2D

Strings

@., xrefs: 00405AB4, 00405AD6, 00405BEC, 00405C02

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: @.
API String ID: 3472027048-4201455939
Opcode ID: ada7fe0ad1e969fa1615a2ce2c1f205a77d44d1215cb1e65cc2c198de2b16ae9
Instruction ID: a95b6186faaf28ee99436786a323c89c11953a43e3af36f3f78c15d8c677067a
Opcode Fuzzy Hash: ada7fe0ad1e969fa1615a2ce2c1f205a77d44d1215cb1e65cc2c198de2b16ae9
Instruction Fuzzy Hash: 0DC16972601B118FD725CF28D884367BBA1EB95320F1882BFD4059B3D5C778A849DF88

Function 00405CA0 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00405912), ref: 00405D36
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00405912), ref: 00405D50

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b3bac45a803a588073ab35a9efb47af0939235da5b92122c96ba95b50cef7661
Instruction ID: 4f935fbc936f4d5eb3d08406d1a455a3bc696dbd4939a17767f2164eefdcc051
Opcode Fuzzy Hash: b3bac45a803a588073ab35a9efb47af0939235da5b92122c96ba95b50cef7661
Instruction Fuzzy Hash: 1371D231604B008FE725DB28D888B67BBD4EF95314F14C2BFD844AB3D2D67888459F59

Function 004E6084 Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004E60B2
GetDeviceCaps.GDI32(?,00000068), ref: 004E60CE
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 004E60ED
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 004E6111
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 004E612F
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 004E6143
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 004E6163
ReleaseDC.USER32(00000000,?), ref: 004E617B

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 76daa9d26c080c564ad9041f13802c656f185a4c8ec9210214833560b50aa864
Instruction ID: 253042d8ae561a030da4b25cfcc59df415f83bc43ecdec077c49d488911ed581
Opcode Fuzzy Hash: 76daa9d26c080c564ad9041f13802c656f185a4c8ec9210214833560b50aa864
Instruction Fuzzy Hash: 8F2156B1A40218BADB50DFA5DD86F9EB3BCEB08705F510496F704E71C1D679AF408B28

Function 00405E98 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6090a39ba4113efe279c4ce94d3a27bfd3a3f347abc7f88e99f6aa2524520e12
Instruction ID: 14c4d9104ddc23c6b9370c21b65e9a421d4bec3d23930416dd05d6dcb6f7df23
Opcode Fuzzy Hash: 6090a39ba4113efe279c4ce94d3a27bfd3a3f347abc7f88e99f6aa2524520e12
Instruction Fuzzy Hash: 01C12262710A014BD714AA7D9C8836FB286DBC4325F68823FE645EB3C6DA7CCC458B58

Function 00501CB0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 00501CF9
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 00501D28
SelectObject.GDI32(?,?), ref: 00501D38
DeleteObject.GDI32(?), ref: 00501F51
DeleteDC.GDI32(?), ref: 00501F5D

Strings

|O, xrefs: 00501FB6

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CreateDeleteObject$CompatibleSectionSelect
String ID: |O
API String ID: 2986811175-2178481767
Opcode ID: 90a3cc67d434286f67fd4dae33db832c94767437528e578728866bffd496196e
Instruction ID: 722e5782cc48f2868c955082fb14a0a6b33fd5c4a7d92c9959df0d53121e1401
Opcode Fuzzy Hash: 90a3cc67d434286f67fd4dae33db832c94767437528e578728866bffd496196e
Instruction Fuzzy Hash: 73B1C575E0060A9FCB04DF99C985AAEBBF5FF48300F2181A6E914A73A1D734AD41CF55

Function 004FC798 Relevance: 10.7, APIs: 7, Instructions: 198windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004FC400: DeleteObject.GDI32(?), ref: 004FC40B
Part of subcall function 004FC400: DeleteDC.GDI32(?), ref: 004FC418
Part of subcall function 004FC400: DeleteObject.GDI32(?), ref: 004FC434

CreateCompatibleDC.GDI32(00000000), ref: 004FC903
CreateHalftonePalette.GDI32(?,00000000), ref: 004FC93E
ResizePalette.GDI32(?,00000001), ref: 004FC973
SelectPalette.GDI32(?,?,00000000), ref: 004FC998
RealizePalette.GDI32(?), ref: 004FC9A3
CreateDIBSection.GDI32(?,-00000474,00000000,-00000450,00000000,00000000), ref: 004FC9CE
SelectObject.GDI32(?,00000000), ref: 004FC9E1

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Palette$CreateDeleteObject$Select$CompatibleHalftoneRealizeResizeSection
String ID:
API String ID: 2525607832-0
Opcode ID: 3b39bf79a773d9044507b5f4a6ba50a4e1458e9f25aaa5a6f7355112836dca1f
Instruction ID: 4ba82757873bb3c143a4d1742f8b993ef62ffc4f5942cec004fa87537f0c0421
Opcode Fuzzy Hash: 3b39bf79a773d9044507b5f4a6ba50a4e1458e9f25aaa5a6f7355112836dca1f
Instruction Fuzzy Hash: E67137756005289FDB04EF19C4D5F6637E5EF0A305F0541E6F2048F3AAC678E84ACB9A

Function 00408850 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408CDC: GetCurrentThreadId.KERNEL32 ref: 00408CDF

GetTickCount.KERNEL32 ref: 00408887
GetTickCount.KERNEL32 ref: 0040889F
GetCurrentThreadId.KERNEL32 ref: 004088CE
GetTickCount.KERNEL32 ref: 004088F9
GetTickCount.KERNEL32 ref: 00408930
GetTickCount.KERNEL32 ref: 0040895A
GetCurrentThreadId.KERNEL32 ref: 004089CA

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 7d0f63ae373317c5f21e857476dc24018feec28cf215cb5a173da7a4db92fdee
Instruction ID: 59fdbd664e4c2a787114e1462c869c0698e504600effbf6fb817d1e717bb5ab3
Opcode Fuzzy Hash: 7d0f63ae373317c5f21e857476dc24018feec28cf215cb5a173da7a4db92fdee
Instruction Fuzzy Hash: BB415E716083419EDB21BE79CA4032BBAD1AB91354F14893FD4D8A73C2EE798881D75B

Function 004EA090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 004EA0E2
MulDiv.KERNEL32(?,?,000009EC), ref: 004EA0F9
GetDC.USER32(00000000), ref: 004EA110
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,004EA1CB,?,00000000,?,?,000009EC,?,?,000009EC), ref: 004EA134
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,004EA1AB,?,?,00000000,00000000,00000008,?,00000000,004EA1CB), ref: 004EA167

Strings

`, xrefs: 004EA0C8

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: b7f937434eb2587f847978740abbd8c81bb9dfc3e5197959b54ccdff63f1a7cc
Instruction ID: 560aeff5e142fb22fc32d70ae3aa060d7ef4d96bf65ee7c2df06f2301dcbdb9f
Opcode Fuzzy Hash: b7f937434eb2587f847978740abbd8c81bb9dfc3e5197959b54ccdff63f1a7cc
Instruction Fuzzy Hash: AD318775A00248ABDB00DFD5C882BEEF7B8EF0D705F514496F904EB281D678AE50D7A9

Function 004EA974 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 004E62F0: GetObjectW.GDI32(00000000,00000004), ref: 004E6307
Part of subcall function 004E62F0: GetPaletteEntries.GDI32(00000000,00000000,?,00000028), ref: 004E632A

GetDC.USER32(00000000), ref: 004EA9B2
CreateCompatibleDC.GDI32(?), ref: 004EA9BE
SelectObject.GDI32(?), ref: 004EA9CB
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,004EAA23,?,?,?,?,00000000), ref: 004EA9EF
SelectObject.GDI32(?,?), ref: 004EAA09
DeleteDC.GDI32(?), ref: 004EAA12
ReleaseDC.USER32(00000000,?), ref: 004EAA1D

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: ec8649657c05e97b9ba1c19bfcd01e8d0b09a6ae33e64875ffb60a9979b168a2
Instruction ID: a90b19bdd86dec3490e2a43e61abe2758ba6d863edaf7bda9a2135b5bf853f90
Opcode Fuzzy Hash: ec8649657c05e97b9ba1c19bfcd01e8d0b09a6ae33e64875ffb60a9979b168a2
Instruction Fuzzy Hash: 54115172E00359BFDB10EFE9C851AEEB7BCEB09705F4044AAF504E7241E6789E5087A4

Function 004098D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?,?,00409AA2,00406F13,00406F5A,?,?), ref: 00409909
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?,?,00409AA2,00406F13,00406F5A,?), ref: 0040990F
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?), ref: 0040992A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E), ref: 00409930

Strings

Runtime error at 00000000, xrefs: 00409902, 00409947
Error, xrefs: 00409942

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 1f536b54c0f7e54d54e2ef4696db32368710aa63d846f2239d9123bcbb9aa4c9
Instruction ID: 1cafd5f0b55deffaaa1a260c41e3c473f996b032a313f4f96ee96a2a81eb749b
Opcode Fuzzy Hash: 1f536b54c0f7e54d54e2ef4696db32368710aa63d846f2239d9123bcbb9aa4c9
Instruction Fuzzy Hash: FBF04491A4134479FA3077A55C56F6F2B589704B18F18893FB650782D3CAB84C889766

Function 004E65E0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 004E662E
GetSystemMetrics.USER32(0000000C), ref: 004E663A
GetDC.USER32(00000000), ref: 004E6656
GetDeviceCaps.GDI32(00000000,0000000E), ref: 004E667D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004E668A
ReleaseDC.USER32(00000000,00000000), ref: 004E66C3

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 514544e9451769a20b0d63ec12d45414229ecaa25948937d2ba282ff4bb2ffa2
Instruction ID: 4016dc568379c8c19e12672c107d27f7e339e6f7b848dc7462e147759cb92e24
Opcode Fuzzy Hash: 514544e9451769a20b0d63ec12d45414229ecaa25948937d2ba282ff4bb2ffa2
Instruction Fuzzy Hash: BA318474E00244EFEB00DFA6C841AAEBBB5FF49751F11856AF414AB384C6749D41CB65

Function 004E6234 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004E6252
SelectObject.GDI32(00000000,00000000), ref: 004E625B
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,?,00000000,?,?,004EC367), ref: 004E626F
SelectObject.GDI32(00000000,00000000), ref: 004E627B
DeleteDC.GDI32(00000000), ref: 004E6281
CreatePalette.GDI32 ref: 004E62DC

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: c23c5a97d5111a113b75aab70fc9247ba4d6293bf42c91ab6919fe7628b5da46
Instruction ID: 606bc0411a418828bb19e24d666e4bac27dc473e5e9fa35946380d90c98f6425
Opcode Fuzzy Hash: c23c5a97d5111a113b75aab70fc9247ba4d6293bf42c91ab6919fe7628b5da46
Instruction Fuzzy Hash: C011E33120434022E210BB679C43BAB72A89FD575AF01842FB64997382E67C8D4943DA

Function 004E6A9C Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E6950: GetObjectW.GDI32(?,00000054), ref: 004E6964

CreateCompatibleDC.GDI32(00000000), ref: 004E6ABE
SelectPalette.GDI32(?,?,00000000), ref: 004E6ADF
RealizePalette.GDI32(?), ref: 004E6AEB
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 004E6B02
SelectPalette.GDI32(?,00000000,00000000), ref: 004E6B2A
DeleteDC.GDI32(?), ref: 004E6B33

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: 9dbd0a09d7bff179ba26f2c840b696ab711f6e12a27d33c9ec649e9677f75141
Instruction ID: ce5ef7bc2b447eaaf5ad7ea58a7014afe3a29db5ee430c20c38cefb41b0ea7be
Opcode Fuzzy Hash: 9dbd0a09d7bff179ba26f2c840b696ab711f6e12a27d33c9ec649e9677f75141
Instruction Fuzzy Hash: EF114275E403047FDB10DFAA8C42F9EBBEDDB49701F51806AB514E7281D678AE408768

Function 004EEBA4 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

SetDIBits.GDI32(00000000,00000000), ref: 004EECF4

Strings

,, xrefs: 004EEC6A
, xrefs: 004EEC8B
pN, xrefs: 004EEC15, 004EED49
p'Q, xrefs: 004EEC33

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,$p'Q$pN
API String ID: 3573556081-239200797
Opcode ID: 92d071d68894910214369fd3333e17d9c624acff6734dc0fd83610df643d249f
Instruction ID: aee27c67a3071bc99e10faf75e1ede7cbfe8391e6b252bb2006cd3d3c3fe1532
Opcode Fuzzy Hash: 92d071d68894910214369fd3333e17d9c624acff6734dc0fd83610df643d249f
Instruction Fuzzy Hash: 7951C174A00208AFDB40DF9AD881E9EB7F9FB48314F5181A6F914EB362D735AE44CB54

Function 004EE3C8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

GetDIBits.GDI32(00000000,00000000,00000000,?,?,0000002C,00000000), ref: 004EE4B2

Strings

`'Q, xrefs: 004EE40A
,, xrefs: 004EE468
, xrefs: 004EE483
p'Q, xrefs: 004EE3FB

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,$`'Q$p'Q
API String ID: 3573556081-2603654308
Opcode ID: 5885ce34b41956b036a5ed13aa5cd9d7f69e49882d4fdc40b94335f282800fa9
Instruction ID: 045cbab1fe539c9be70203d05d25693d615e17105bd83f70b06e9f73d5340b52
Opcode Fuzzy Hash: 5885ce34b41956b036a5ed13aa5cd9d7f69e49882d4fdc40b94335f282800fa9
Instruction Fuzzy Hash: C54155B1A00104AFDB40DF6AC885A9A77F9FF09314B2101A6FC04EB356D775ED45CB94

Function 004264A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00426654), ref: 004264DB
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004264FF
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0042651A
LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 004265B5

Strings

MZP, xrefs: 00426519

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: 3ba8896000a972874597a3038ce2d51abf08254031deb0194f3f93d209645a27
Instruction ID: 1929f4b34107894ca7d66f9f3b4df39ec91217cfe300c9f83b0dec032e05ff6b
Opcode Fuzzy Hash: 3ba8896000a972874597a3038ce2d51abf08254031deb0194f3f93d209645a27
Instruction Fuzzy Hash: 01415170A002289FDB20DF65DC81BC9B7F9AB59304F8140EAE508E7241D7799E94CF59

Function 004ED0C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004ED17C
CreateHalftonePalette.GDI32(00000000,00000000), ref: 004ED189
ReleaseDC.USER32(00000000,00000000), ref: 004ED198
DeleteObject.GDI32(00000000), ref: 004ED206

Strings

(, xrefs: 004ED133

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CreateDeleteHalftoneObjectPaletteRelease
String ID: (
API String ID: 577518360-3887548279
Opcode ID: 6c7982e3dbeddf5829e6b35da8ae4e0b0e41a67c43c65158d1fbaf7cd514d5ee
Instruction ID: 82237c15e2120aaa14e4263fef51d48de57575ac84f7840cc6ebe71d931eecb0
Opcode Fuzzy Hash: 6c7982e3dbeddf5829e6b35da8ae4e0b0e41a67c43c65158d1fbaf7cd514d5ee
Instruction Fuzzy Hash: 0241AE70E04248EFCB10DFA6C885ADEFBB5EF49305F1480AAE404AB351D7789A45DB99

Function 004B7154 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004B722A,?,?,004B5444,00000001), ref: 004B71CC
GetCurrentThread.KERNEL32 ref: 004B7204
GetCurrentThreadId.KERNEL32 ref: 004B720C

Strings

pDA, xrefs: 004B71EB
BnK, xrefs: 004B7221, 004B71D1, 004B71DB

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CurrentThread$ErrorLast
String ID: BnK$pDA
API String ID: 4172138867-3175749474
Opcode ID: 41b6f9ce17f55120e1f85082be51f3eef28a51ba5067762cb248ae6b92c81fe8
Instruction ID: 9e0351540b3ca22bd38f9d985428608e25a0f3706ce3bc0111696712c1f879e3
Opcode Fuzzy Hash: 41b6f9ce17f55120e1f85082be51f3eef28a51ba5067762cb248ae6b92c81fe8
Instruction Fuzzy Hash: 85212B709086456ED701DFB5CC817EABBE4BF89304F4485BBE42497782DB389815C7B9

Function 0043690C Relevance: 7.8, APIs: 5, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b1296c92a046bb743362478882edb4bed3443ecb9e909bca9af9b7118eca8f6
Instruction ID: 8d3459a469465bc4371695b4e367a65a38b978d34797e4c4e50731b7cb5a1aca
Opcode Fuzzy Hash: 9b1296c92a046bb743362478882edb4bed3443ecb9e909bca9af9b7118eca8f6
Instruction Fuzzy Hash: AFD1C235A00209AFCF00EF95C4918EEFBB9EF0D310F5590A6E840A7251D638AE46DB79

Function 004F0894 Relevance: 7.6, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000038), ref: 004F08C0
memcpy.MSVCRT(00000000,00000000,000016C4), ref: 004F08F3
memcpy.MSVCRT(00000000,?,?), ref: 004F0989
memcpy.MSVCRT(00000000,?,?), ref: 004F099F
memcpy.MSVCRT(00000000,?,?), ref: 004F09B5
memcpy.MSVCRT(00000000,?,?), ref: 004F09C9

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction ID: bcd7db05d191351e9405a97d2655ef30d3ed96d280d6279a09f2b3dd0a47b8f8
Opcode Fuzzy Hash: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction Fuzzy Hash: 965175B1600200AFDB14CF69CCC5E6677A8BF88314F08827AEE098F346E735E944CB94

Function 00509DA8 Relevance: 7.6, APIs: 5, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,005096E1,?,?,?,?,?,00000000,00000000), ref: 00509E18
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00000000,005096E1,?,?,?,?,?,00000000,00000000), ref: 00509E47
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00000000,005096E1,?,?,?,?,?,00000000,00000000), ref: 00509E52
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,005096E1,?,?,?,?,?,00000000,00000000), ref: 00509E58
VirtualFree.KERNEL32(?,?,00008000,?,?,?,?,00000000,005096E1,?,?,?,?,?,00000000,00000000), ref: 00509E98

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Free$HeapVirtual$LibraryProcess
String ID:
API String ID: 565514093-0
Opcode ID: b96c8d312113b587b0da4b640e6da879f4d936ce04747ac87997d27eafa00769
Instruction ID: a868714980b54be37640f3021f9aecc8e15798b84dfbcb3b39658f8fc39ab43b
Opcode Fuzzy Hash: b96c8d312113b587b0da4b640e6da879f4d936ce04747ac87997d27eafa00769
Instruction Fuzzy Hash: 07316D71204605AFD720EF69CC84F6ABBACFF88710F148619F564CB2A6C770EC4587A0

Function 004EC31C Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EC372
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction ID: 76c421ad3c698b7ff88da0f61c3aa7df07cb2880bcd4f869b6d47c825d99da29
Opcode Fuzzy Hash: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction Fuzzy Hash: 3D11D3315012D9AEEB20AF27C481BEF3B94AF55357F04505BFC005A281D7BC8DA2C7A9

Function 004E619C Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004E61B4
GetDeviceCaps.GDI32(?,00000068), ref: 004E61D0
GetPaletteEntries.GDI32(04080DA1,00000000,00000008,?), ref: 004E61E8
GetPaletteEntries.GDI32(04080DA1,00000008,00000008,?), ref: 004E6200
ReleaseDC.USER32(00000000,?), ref: 004E621C

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: e2e0119970b46360f4dbaca9755fcc1ef81ad606db22181b8a12d53334abd375
Instruction ID: fb62e25858754de89261d63ddcf899fc845c4e56b322bcc1c3ebe9d0414cdd2c
Opcode Fuzzy Hash: e2e0119970b46360f4dbaca9755fcc1ef81ad606db22181b8a12d53334abd375
Instruction Fuzzy Hash: 191108716483447EEB00DFA6EC42FA97FACE719706F40849BF204DA1C1DABA5544C324

Function 0040904A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(?,00000000), ref: 0040911E

Strings

,qB, xrefs: 0040906B
hsB, xrefs: 004090F7

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: ,qB$hsB
API String ID: 3192549508-2187915683
Opcode ID: 1700f64120af452dff93675b6e54fdb508242944783359e32faae08426496f92
Instruction ID: 7df4318895a31e83b2a36aa030ba475ccd5b90e95bae95c0b52881597b1f7c6e
Opcode Fuzzy Hash: 1700f64120af452dff93675b6e54fdb508242944783359e32faae08426496f92
Instruction Fuzzy Hash: 834196717042029FE720DF14C888B6BB7E5EB85314F15857AE448AB393C739EC45CB59

Function 00423C28 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,00423D0B), ref: 00423CAE
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,00423D0B), ref: 00423CB4

Strings

, xrefs: 00423C7A
yyyy, xrefs: 00423C89

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 0809fa2659c157af8da77a48e90bfea0ac0ad0ed8c95e6ae3a57ad6ba9429efe
Instruction ID: 4198a1d351d31b9a86c79895a928489856ad1452b39a35c365c2990c697424f4
Opcode Fuzzy Hash: 0809fa2659c157af8da77a48e90bfea0ac0ad0ed8c95e6ae3a57ad6ba9429efe
Instruction Fuzzy Hash: F4217F35A046289BDB10EF95D842AAEB3F8EF08701F91406BF905F7281D63C9F00C76A

Function 0042D69C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(0041F85C,00000001), ref: 0042D6B8
GetCPInfo.KERNEL32(0042D79C,0042C1C5,0041F85C,00000001), ref: 0042D6D9

Strings

$CA, xrefs: 0042D6E2
\A, xrefs: 0042D6EA

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Info
String ID: $CA$\A
API String ID: 1807457897-218779800
Opcode ID: d22c0443655ea6f8c9c10f41638c9beba88e1178d8f14e01ec56dfd4ff822553
Instruction ID: e58e767229b98ed7dfc1e8f7d930c1f7323aea84fb3f98ea7063dbec338e24c3
Opcode Fuzzy Hash: d22c0443655ea6f8c9c10f41638c9beba88e1178d8f14e01ec56dfd4ff822553
Instruction Fuzzy Hash: D801D671B00A158FC720EF69E981997B7E4AF05364700853FFC99C7351EB39D9048BA9

Function 004E3964 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,004E3BCC), ref: 004E39AC
LeaveCriticalSection.KERNEL32(?,004E3BA3,?,00000000,004E3BCC), ref: 004E3B96

Strings

Default, xrefs: 004E3A5A
-Q, xrefs: 004E3A80

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Default$-Q
API String ID: 3168844106-3821686248
Opcode ID: 1a1d0b3d7fef57fbd369e5ba3f48b81e015b8509224f28914d8de7d590d176ed
Instruction ID: 19d7f923896caa44bc4d2895c7d959a39db7ed687c0c5984d3f2fc8e9670fb4e
Opcode Fuzzy Hash: 1a1d0b3d7fef57fbd369e5ba3f48b81e015b8509224f28914d8de7d590d176ed
Instruction Fuzzy Hash: BA519470A083589FDB02DFA9C845AEEBBF5FF48305F51446AE404A7352D778AE44CB14

Function 004E3ED0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000000,00000000), ref: 004E3EF7
GetObjectW.GDI32(?,00000010,?), ref: 004E3F0A
GetObjectW.GDI32(?,00000000,?), ref: 004E3F63

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Object
String ID:
API String ID: 2936123098-0
Opcode ID: a40579d9f90c76d0c9fca4423f8c07d8447b4155338eb9add3561dc35ea178ad
Instruction ID: b9ca84249461113418995685c1b411e63f59ddf32e5f5f2b3ba05ad8a3118a75
Opcode Fuzzy Hash: a40579d9f90c76d0c9fca4423f8c07d8447b4155338eb9add3561dc35ea178ad
Instruction Fuzzy Hash: 09319471A047849FD711CF5AC885EAABBF9EF49311F14846EF854DB741D234E9008B64

Function 0040C998 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040C9A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040CA07
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040CA64
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040CA97

Part of subcall function 0040C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040CA15), ref: 0040C96B
Part of subcall function 0040C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040CA15), ref: 0040C988

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: ab0a3fc87b5d274f299d69668d3c9eef21079eaeea860c77a07499101e2d6c50
Instruction ID: 8d1cb3547ee4b9364daa38f1b6dc697d03ddbece5e120c74778344a30482e11a
Opcode Fuzzy Hash: ab0a3fc87b5d274f299d69668d3c9eef21079eaeea860c77a07499101e2d6c50
Instruction Fuzzy Hash: DF313D70A0021E9BDB10DBA9C8C57AFB7B5EF04304F00427AE555E7291DB789A04CB95

Function 004EA788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E4780
Part of subcall function 004E4778: LeaveCriticalSection.KERNEL32(0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E478D
Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(?,0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870), ref: 004E4796

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

CreateCompatibleDC.GDI32(00000000), ref: 004EA7DD
SelectObject.GDI32(00000000,?), ref: 004EA7F6
SelectPalette.GDI32(00000000,?,000000FF), ref: 004EA81F
RealizePalette.GDI32(00000000), ref: 004EA82B

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: e4708b13d4162338c8fa8d9abf0c706dab058b01908a5adb0ec73a38d2e26af5
Instruction ID: 70351cf6032dbd0939f732d494bf93bb1b6777d92977e90662745986a4f58f41
Opcode Fuzzy Hash: e4708b13d4162338c8fa8d9abf0c706dab058b01908a5adb0ec73a38d2e26af5
Instruction Fuzzy Hash: E8310634A00684EFD704EF5AD981D5EB7F5FF48315B6241A6E804AB322C738EE82DB54

Function 004EDF8C Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 004EDFAD
GetObjectW.GDI32(?,00000018,?), ref: 004EDFCE
DeleteObject.GDI32(?), ref: 004EDFFA
DeleteObject.GDI32(?), ref: 004EE003

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: 7a1785c32ae41643537aa2786bfbdbae53e7e625d4899cd26e3bbc34933ba4e6
Instruction ID: 1a97c13f3edbda2b3c1502a7d4827854aa80e6db8bf7018fb0a338cf34cd0894
Opcode Fuzzy Hash: 7a1785c32ae41643537aa2786bfbdbae53e7e625d4899cd26e3bbc34933ba4e6
Instruction Fuzzy Hash: 32119175A00208AFDB00DFABC982C9EB7F9EB48311B1085AAF904D7351DB75EE00DA94

Function 004AA910 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA927
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA941
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA95B
LockResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000), ref: 004AA965

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction ID: cb9b2a388fffd021e353bf4cf2117ea65373932cb549638ab777629fd56d0805
Opcode Fuzzy Hash: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction Fuzzy Hash: 96F062B26042047F5744EE5EA841D5B7BECDE5A264310011FF908D7207DA38ED51837D

Function 004EEDD0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EEDD9
SelectObject.GDI32(00000000,058A00B4), ref: 004EEDEB
GetTextMetricsW.GDI32(00000000), ref: 004EEDF6
ReleaseDC.USER32(00000000,00000000), ref: 004EEE07

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: 69fa914ca851ee74fc1149395581ca18b64c37d6fa6240ddf4510f1bbda6b75f
Instruction ID: a86a7c8164184303e7b2e3849245c9a5924fc7d8bd12fc902a680fb7c4b12911
Opcode Fuzzy Hash: 69fa914ca851ee74fc1149395581ca18b64c37d6fa6240ddf4510f1bbda6b75f
Instruction Fuzzy Hash: 94E04F626027B032D551666B5D86BDB2A4C4F026ABF480116FD44997D1DA0DCE5083FA

Function 00427150 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00427356), ref: 004271F0
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,0000001C,00000000,00427356), ref: 0042721C

Part of subcall function 0040EDD0: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 0040EE15

Strings

T@A, xrefs: 00427307

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: T@A
API String ID: 902310565-1700159869
Opcode ID: aa735fdf95c1b3c55c6c122af355b3fb9be49ebc3a65d438ae1f7f7c78d559a5
Instruction ID: ac0d8ba74f78c4cef5ca1ccd6cc97b0835bedae67cd68f08fc364424d8198a64
Opcode Fuzzy Hash: aa735fdf95c1b3c55c6c122af355b3fb9be49ebc3a65d438ae1f7f7c78d559a5
Instruction Fuzzy Hash: 69512934A08269DFCB10DF29DC88AD9B7F4EF48304F4045EAA808A7351D778AE84CF59

Function 0050989C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 005098E9
VirtualProtect.KERNEL32(?,?,?,?,?), ref: 0050996E

Strings

FinalizeSections: VirtualProtect failed, xrefs: 0050997C

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID: FinalizeSections: VirtualProtect failed
API String ID: 2581862158-3584865983
Opcode ID: 0c630efd0ea9f41a4566bdca1b893d1d62bddc6a6306c11b113493c156563ad3
Instruction ID: 8961f81e0d8d1ddfe8dd598e091a63059a15cfd2f653fb3e05fc5479ad1c157e
Opcode Fuzzy Hash: 0c630efd0ea9f41a4566bdca1b893d1d62bddc6a6306c11b113493c156563ad3
Instruction Fuzzy Hash: 163112746002069FD710CF59C885F9ABBE8BF49790F544898FA68DB3E6C330ED408B90

Function 00428748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,0042BB77,00000000,0042BCB7), ref: 00428707

Strings

A, xrefs: 0042875E
Z, xrefs: 00428763

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CharUpper
String ID: A$Z
API String ID: 9403516-4098844585
Opcode ID: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction ID: b9253ecd29e492176c38fe4a03f9f14fb6b287faa95297cdab911eb37b575cf8
Opcode Fuzzy Hash: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction Fuzzy Hash: 431136127466200BE720643FAC817FF958A87C63A4F99023FF505D73C1DC5C8C0142D9

Function 00408F1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00408F8A
UnhandledExceptionFilter.KERNEL32(?,?,?,Function_00008F20), ref: 00408FC7

Strings

hsB, xrefs: 00408F45

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: hsB
API String ID: 3192549508-625297667
Opcode ID: 71af4e390d5abfd6d2040d1b975c0e968029a7204a6687ef051946c3d04c1d81
Instruction ID: a3b05377a8d17e60e07457b386e13646049d2c6927d33ce14a72d1f6f32e6c37
Opcode Fuzzy Hash: 71af4e390d5abfd6d2040d1b975c0e968029a7204a6687ef051946c3d04c1d81
Instruction Fuzzy Hash: 1A3180B0604301AFD720DB24C984F2BB7EAEB88714F14857EF548972A2CB38EC45D719

Function 004D8F38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,004D9018), ref: 004D8FBC
RegCloseKey.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,004D9018), ref: 004D8FD4

Strings

0DA, xrefs: 004D8FEB

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: CloseCreate
String ID: 0DA
API String ID: 2932200918-1323616133
Opcode ID: c1395ddd16f013e2c5c054cb8322a7ab77ff38ff3c2df0808901ac99e9a7a567
Instruction ID: 25d3ef1a80ef9a2a582609d95ea177c46257b89597391ae0df933a0c0a64fb74
Opcode Fuzzy Hash: c1395ddd16f013e2c5c054cb8322a7ab77ff38ff3c2df0808901ac99e9a7a567
Instruction Fuzzy Hash: FC215171B04208ABDB11EFA5CC52BAE77F9EB48704F10407BB504E7381EA789E059659

Function 0040945E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006), ref: 0040947F

Strings

ptB, xrefs: 004094DA
hsB, xrefs: 004094B8

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: hsB$ptB
API String ID: 3192549508-579888589
Opcode ID: 6040466f00e2c8a053fbe7c5040ef9d1dac393dd0ce99f32a3ea5679555daf94
Instruction ID: 1c15842ca407df81533eab869cf356bb1e86fa8830085c109665a44f2841b22d
Opcode Fuzzy Hash: 6040466f00e2c8a053fbe7c5040ef9d1dac393dd0ce99f32a3ea5679555daf94
Instruction Fuzzy Hash: 722187742082059BDB24DF29D884B2B7391AB98710F14C53AA845973D7C73CEC46DB59

Function 004E9928 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetEnhMetaFileBits.GDI32(0000006C,?,00000000,004E99F3), ref: 004E99AB

Strings

l, xrefs: 004E9959
EMF, xrefs: 004E994B

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: EMF$l
API String ID: 858000408-2398670571
Opcode ID: 2125be9d16ec2bfb2bdecbf8caab0e32fe6e64787139bcb456d53b20160a11d7
Instruction ID: d8b59ccd57732e94ff2d5b122cdf495c560b21a665579054683b94a632da62f7
Opcode Fuzzy Hash: 2125be9d16ec2bfb2bdecbf8caab0e32fe6e64787139bcb456d53b20160a11d7
Instruction Fuzzy Hash: 84217F71A00244DFCB10EFAAC881A6EB7F5FF49714F55426EE405AB786DB38AD01CB58

Function 00433380 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0043338D

Strings

U8C, xrefs: 004333D0
U8C, xrefs: 0043339E

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: U8C$U8C
API String ID: 1927566239-2794899156
Opcode ID: 73a04f75f4700c27e70e31815718745acee388901ba2828ac7ff439f3077f0af
Instruction ID: 368a7727e46ca0c7d7ebfa57d99fa57cf2f65fd8b63f73f36e9c6d0abe0fbb77
Opcode Fuzzy Hash: 73a04f75f4700c27e70e31815718745acee388901ba2828ac7ff439f3077f0af
Instruction Fuzzy Hash: EFF09C75E0421DEBCB40DF99D881AEEBBF8FB09710F008196EA54E7350E774AA44CB95

Function 004339A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004339AD

Strings

>C, xrefs: 004339F0
>C, xrefs: 004339BE

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: >C$>C
API String ID: 1927566239-3959820462
Opcode ID: 02c51ec01ace36e417658ce1fa847b1e7a2b0282f19b3b65912a0e25badec3a0
Instruction ID: 3305d6a348a4a9db1480d5955075c1e731a70c0028d1528758b8b245a88f1934
Opcode Fuzzy Hash: 02c51ec01ace36e417658ce1fa847b1e7a2b0282f19b3b65912a0e25badec3a0
Instruction Fuzzy Hash: 69F0C975A0020DABCB00DF99C881ADEB7F8FB08310F008196AA14E7340E774AA44CB95

Function 004289EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,0050E4DB,00000000,0050E512), ref: 004289F2

Part of subcall function 004139B0: GetProcAddress.KERNEL32(0043C998,?), ref: 004139DA

Strings

kernel32.dll, xrefs: 004289ED
GetDiskFreeSpaceExW, xrefs: 004289FD

Memory Dump Source

Source File: 00000028.00000002.1489148930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.1489129129.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489315966.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489355306.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489390100.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489453853.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489484085.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489505900.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489580608.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489607093.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000028.00000002.1489632802.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: c7edea2ffbbda9fdc0d07ee16b935c76c2adbbdc0e38b75f3dfa78325f9fbb0d
Instruction ID: 8ccd786351900723a36e45e0a3bb3a683afe0fdfe4abf5b7f5dbba0d790a7421
Opcode Fuzzy Hash: c7edea2ffbbda9fdc0d07ee16b935c76c2adbbdc0e38b75f3dfa78325f9fbb0d
Instruction Fuzzy Hash: 24D05EB07123624AD760ABA1B882B1E2288A320F06F80013FB20145B26CFFD8848534C

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KfHeFsr9Ce.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c5d089c8cf748e1b13ba2105216189e689b02e_7522e4b5_13afcf82-ac04-4d3d-a715-aa7139a6a92a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7334.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER73C2.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER73F2.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Statistics

Windows Analysis Report
KfHeFsr9Ce.dll