Edit tour

Windows Analysis Report
T681Aj3oN9.dll

Overview

General Information

Sample name:	T681Aj3oN9.dll renamed because original name is a hash value
Original sample name:	111d2849e97391a16ad33ad6c7cd4157b35bbda80f07a691f339f8f678eb1d04.dll
Analysis ID:	1544814
MD5:	5f9cd1ca927bcfd120658bd913aa5b00
SHA1:	469949600eb14f9f1e9c35b73424ad9bbb3c3455
SHA256:	111d2849e97391a16ad33ad6c7cd4157b35bbda80f07a691f339f8f678eb1d04
Tags:	2024bankerdllgolangloadermekotiouser-johnk3r
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7520 cmdline: loaddll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7576 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7600 cmdline: rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 7760 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 840 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 7584 cmdline: rundll32.exe C:\Users\user\Desktop\T681Aj3oN9.dll,BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 7748 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7584 -s 820 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 7836 cmdline: rundll32.exe C:\Users\user\Desktop\T681Aj3oN9.dll,BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7884 cmdline: rundll32.exe C:\Users\user\Desktop\T681Aj3oN9.dll,BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7944 cmdline: rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 8164 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7944 -s 760 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 7972 cmdline: rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7980 cmdline: rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8060 cmdline: rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",_cgo_dummy_export MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8076 cmdline: rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SpellSpell MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8172 cmdline: rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SpellInit MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7204 cmdline: rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SpellFree MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7312 cmdline: rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SignalInitializeCrashReporting MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1184 cmdline: rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",GetInstallDetailsPayload MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2916 cmdline: rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarRecognize MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.9% probability

Bitcoin Miner

Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF1830	3_2_6CBF1830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE81830	12_2_6CE81830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE81830	15_2_6CE81830

Source: T681Aj3oN9.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL

Source: T681Aj3oN9.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	3_2_6CBC2CA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	3_2_6CBC2CA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp], edx	3_2_6CBDCEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then shr ebp, 0Dh	3_2_6CBE9030
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then shr ecx, 0Dh	3_2_6CBEA360
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	12_2_6CE52CA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	12_2_6CE52CA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp], edx	12_2_6CE6CEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then shr ebp, 0Dh	12_2_6CE79030
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then shr ecx, 0Dh	12_2_6CE7A360
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	15_2_6CE52CA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	15_2_6CE52CA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp], edx	15_2_6CE6CEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then shr ebp, 0Dh	15_2_6CE79030
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then shr ecx, 0Dh	15_2_6CE7A360

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF2A90 NtCreateWaitCompletionPacket,	3_2_6CBF2A90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF1A70 NtCreateWaitCompletionPacket,	3_2_6CBF1A70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF1570 NtCreateWaitCompletionPacket,NtAssociateWaitCompletionPacket,NtCancelWaitCompletionPacket,RtlGetCurrentPeb,RtlGetVersion,	3_2_6CBF1570
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF11F0 NtCancelWaitCompletionPacket,NtAssociateWaitCompletionPacket,	3_2_6CBF11F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE82A90 NtCreateWaitCompletionPacket,	12_2_6CE82A90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE81A70 NtCreateWaitCompletionPacket,	12_2_6CE81A70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE81570 NtCreateWaitCompletionPacket,NtAssociateWaitCompletionPacket,NtCancelWaitCompletionPacket,RtlGetCurrentPeb,RtlGetVersion,	12_2_6CE81570
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE811F0 NtCancelWaitCompletionPacket,NtAssociateWaitCompletionPacket,	12_2_6CE811F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE82A90 NtCreateWaitCompletionPacket,	15_2_6CE82A90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE81A70 NtCreateWaitCompletionPacket,	15_2_6CE81A70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE81570 NtCreateWaitCompletionPacket,NtAssociateWaitCompletionPacket,NtCancelWaitCompletionPacket,RtlGetCurrentPeb,RtlGetVersion,	15_2_6CE81570
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE811F0 NtCancelWaitCompletionPacket,NtAssociateWaitCompletionPacket,	15_2_6CE811F0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBC2CA6	3_2_6CBC2CA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBC2CA0	3_2_6CBC2CA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC1BC20	3_2_6CC1BC20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBEAD50	3_2_6CBEAD50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC15ED0	3_2_6CC15ED0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBCBE90	3_2_6CBCBE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBFCF90	3_2_6CBFCF90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC2A872	3_2_6CC2A872
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBD59F0	3_2_6CBD59F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBED9C5	3_2_6CBED9C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBD0AF0	3_2_6CBD0AF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBECA30	3_2_6CBECA30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBCFBC0	3_2_6CBCFBC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBEBB10	3_2_6CBEBB10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC06470	3_2_6CC06470
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBE3400	3_2_6CBE3400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBE1440	3_2_6CBE1440
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC18570	3_2_6CC18570
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC1D6E0	3_2_6CC1D6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBEC6D0	3_2_6CBEC6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBE6630	3_2_6CBE6630
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBD80A0	3_2_6CBD80A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBEC080	3_2_6CBEC080
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBC90F0	3_2_6CBC90F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF6010	3_2_6CBF6010
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBED040	3_2_6CBED040
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBC32A0	3_2_6CBC32A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC27280	3_2_6CC27280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBEB2D0	3_2_6CBEB2D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBFE240	3_2_6CBFE240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBE93F0	3_2_6CBE93F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBFA320	3_2_6CBFA320
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC2332F	3_2_6CC2332F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE52CA6	12_2_6CE52CA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE52CA0	12_2_6CE52CA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CEABC20	12_2_6CEABC20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE7AD50	12_2_6CE7AD50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CEA5ED0	12_2_6CEA5ED0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE5BE90	12_2_6CE5BE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE8CF90	12_2_6CE8CF90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CEBA872	12_2_6CEBA872
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE659F0	12_2_6CE659F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE7D9C5	12_2_6CE7D9C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE60AF0	12_2_6CE60AF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE7CA30	12_2_6CE7CA30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE5FBC0	12_2_6CE5FBC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE7BB10	12_2_6CE7BB10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE96470	12_2_6CE96470
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE71440	12_2_6CE71440
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE73400	12_2_6CE73400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CEA8570	12_2_6CEA8570
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CEAD6E0	12_2_6CEAD6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE7C6D0	12_2_6CE7C6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE76630	12_2_6CE76630
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE590F0	12_2_6CE590F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE680A0	12_2_6CE680A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE7C080	12_2_6CE7C080
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE7D040	12_2_6CE7D040
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE86010	12_2_6CE86010
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE7B2D0	12_2_6CE7B2D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE532A0	12_2_6CE532A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CEB7280	12_2_6CEB7280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE8E240	12_2_6CE8E240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE793F0	12_2_6CE793F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CEB332F	12_2_6CEB332F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CE8A320	12_2_6CE8A320
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE52CA6	15_2_6CE52CA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE52CA0	15_2_6CE52CA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CEABC20	15_2_6CEABC20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE7AD50	15_2_6CE7AD50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CEA5ED0	15_2_6CEA5ED0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE5BE90	15_2_6CE5BE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE8CF90	15_2_6CE8CF90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CEBA872	15_2_6CEBA872
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE659F0	15_2_6CE659F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE7D9C5	15_2_6CE7D9C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE60AF0	15_2_6CE60AF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE7CA30	15_2_6CE7CA30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE5FBC0	15_2_6CE5FBC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE7BB10	15_2_6CE7BB10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE96470	15_2_6CE96470
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE71440	15_2_6CE71440
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE73400	15_2_6CE73400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CEA8570	15_2_6CEA8570
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CEAD6E0	15_2_6CEAD6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE7C6D0	15_2_6CE7C6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE76630	15_2_6CE76630
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE590F0	15_2_6CE590F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE680A0	15_2_6CE680A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE7C080	15_2_6CE7C080
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE7D040	15_2_6CE7D040
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE86010	15_2_6CE86010
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE7B2D0	15_2_6CE7B2D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE532A0	15_2_6CE532A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CEB7280	15_2_6CEB7280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE8E240	15_2_6CE8E240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE793F0	15_2_6CE793F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CEB332F	15_2_6CEB332F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CE8A320	15_2_6CE8A320

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CC26A90 appears 462 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CBF7410 appears 680 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CE85080 appears 46 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CE87410 appears 1360 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CEB6A90 appears 924 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CE83B30 appears 32 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7584 -s 820

Source: T681Aj3oN9.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL

Source: classification engine

Classification label: mal48.mine.winDLL@35/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\fd463745-8624-42d2-b1a6-db12fabfba81

Jump to behavior

Source: T681Aj3oN9.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T681Aj3oN9.dll,BarCreate

Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: rundll32.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: rundll32.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: rundll32.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: rundll32.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: rundll32.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: rundll32.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: rundll32.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: rundll32.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: rundll32.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: rundll32.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: rundll32.exe	String found in binary or memory: brarylfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrun
Source: rundll32.exe	String found in binary or memory: brarylfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrun
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: rundll32.exe	String found in binary or memory: hed/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spa
Source: rundll32.exe	String found in binary or memory: hed/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spa
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: rundll32.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: rundll32.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: rundll32.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: rundll32.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: rundll32.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: rundll32.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: rundll32.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: rundll32.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: rundll32.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: rundll32.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: rundll32.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: rundll32.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: rundll32.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: rundll32.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: rundll32.exe	String found in binary or memory: brarylfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrun
Source: rundll32.exe	String found in binary or memory: brarylfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrun
Source: rundll32.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: rundll32.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: rundll32.exe	String found in binary or memory: hed/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spa
Source: rundll32.exe	String found in binary or memory: hed/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spa
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: rundll32.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: rundll32.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: rundll32.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: rundll32.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: rundll32.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: rundll32.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: rundll32.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: rundll32.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: rundll32.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: rundll32.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: rundll32.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: rundll32.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: rundll32.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: rundll32.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: rundll32.exe	String found in binary or memory: brarylfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrun
Source: rundll32.exe	String found in binary or memory: brarylfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrun
Source: rundll32.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: rundll32.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: rundll32.exe	String found in binary or memory: hed/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spa
Source: rundll32.exe	String found in binary or memory: hed/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spa
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: rundll32.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: rundll32.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: rundll32.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: rundll32.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: rundll32.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: rundll32.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T681Aj3oN9.dll,BarCreate
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7584 -s 820
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 840
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T681Aj3oN9.dll,BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T681Aj3oN9.dll,BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarCreate
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",_cgo_dummy_export
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SpellSpell
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7944 -s 760
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SpellInit
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SpellFree
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SignalInitializeCrashReporting
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",GetInstallDetailsPayload
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarRecognize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T681Aj3oN9.dll,BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T681Aj3oN9.dll,BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\T681Aj3oN9.dll,BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",_cgo_dummy_export	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SpellSpell	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SpellInit	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SpellFree	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SignalInitializeCrashReporting	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",GetInstallDetailsPayload	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarRecognize	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: T681Aj3oN9.dll

Static PE information: Image base 0x6d8c0000 > 0x60000000

Source: T681Aj3oN9.dll

Static file information: File size 1368576 > 1048576

Source: T681Aj3oN9.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CBC13E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_6CBC13E0

Source: T681Aj3oN9.dll

Static PE information: real checksum: 0x15ce2a should be: 0x14e942

Source: T681Aj3oN9.dll

Static PE information: section name: .eh_fram

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0103AF34 push eax; retf	0_2_0103AF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_0483AF34 push eax; retf	13_2_0483AF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0503C88C pushad ; retf	14_2_0503C89C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0503AF62 push eax; retf	14_2_0503AF61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0503AF34 push eax; retf	14_2_0503AF61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0503AFB8 push eax; retf	14_2_0503AF61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_0483AF34 push eax; retf	17_2_0483AF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_0483D854 push edx; retf	17_2_0483D856
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_0483C89B push ecx; ret	17_2_0483C89C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_0503DCE3 pushad ; iretd	19_2_0503DCE4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_0503DCAF push ED35AE50h; retf	19_2_0503DC66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_0503DCED push edi; iretd	19_2_0503DD02
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_0503DC33 push ED35AE50h; retf	19_2_0503DC66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_0503AF34 push eax; retf	19_2_0503AF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_05080381 push ecx; ret	19_2_05080395
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_0503CD87 push ecx; ret	20_2_0503CD8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_0503AF34 push eax; retf	20_2_0503AF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_05080857 push esi; ret	20_2_05080858
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 21_2_0503C3F2 pushad ; retf	21_2_0503C428
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 21_2_0503AF34 push eax; retf	21_2_0503AF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 22_2_0543AF34 push eax; retf	22_2_0543AF61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 22_2_054803DE push cs; ret	22_2_054803E7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_04C3AF34 push eax; retf	23_2_04C3AF39

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CC2C0C0 rdtscp

3_2_6CC2C0C0

Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 1.4 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 1.4 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 1.4 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CC2C0C0 rdtscp

3_2_6CC2C0C0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CBC13E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_6CBC13E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC56300 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	3_2_6CC56300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_6CEE6300 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	12_2_6CEE6300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_6CEE6300 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_6CEE6300

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CC56250 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_6CC56250

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CBF1C90 RtlGetVersion,RtlGetCurrentPeb,

3_2_6CBF1C90

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
T681Aj3oN9.dll	5%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544814
Start date and time:	2024-10-29 19:27:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	T681Aj3oN9.dll renamed because original name is a hash value
Original Sample Name:	111d2849e97391a16ad33ad6c7cd4157b35bbda80f07a691f339f8f678eb1d04.dll
Detection:	MAL
Classification:	mal48.mine.winDLL@35/0@0/0
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target loaddll32.exe, PID 7520 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 1184 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 2916 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7204 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7312 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7600 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7836 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7884 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7972 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7980 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 8076 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 8172 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: T681Aj3oN9.dll

Simulations

Behavior and APIs

Time	Type	Description
14:28:13	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.2712483836578174
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	T681Aj3oN9.dll
File size:	1'368'576 bytes
MD5:	5f9cd1ca927bcfd120658bd913aa5b00
SHA1:	469949600eb14f9f1e9c35b73424ad9bbb3c3455
SHA256:	111d2849e97391a16ad33ad6c7cd4157b35bbda80f07a691f339f8f678eb1d04
SHA512:	477d9cf7f1c5ba0cf4aab807901d2eab694e5ddb87c015e78901097eb66ffd2863f3eacde35032e24c3f95fe8d37e83b750c8e87fcca51ffe3fcb62a3031e86e
SSDEEP:	24576:ZmrVZtevjrWnfLmMQmfjFRIhrKuHjVznls+MXcS8DQ02nMYm:ZzjrKrh/8fkL
TLSH:	B4551800FDC784F1E403263285AB62AB6325AD195F31CBC7FB44BB79FA776950836285
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....d.......H.................m................................*.....@... .........................-..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x6d8c1380
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x6d8c0000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x6d9563e0, 0x6d956390
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	47d9e8363ec498a9360ee0a7da269805

Entrypoint Preview

Instruction
sub esp, 1Ch
mov dword ptr [6DA2C730h], 00000000h
mov edx, dword ptr [esp+24h]
cmp edx, 01h
je 00007F0828E16B8Ch
mov ecx, dword ptr [esp+28h]
mov eax, dword ptr [esp+20h]
call 00007F0828E169F2h
add esp, 1Ch
retn 000Ch
lea esi, dword ptr [esi+00000000h]
mov dword ptr [esp+0Ch], edx
call 00007F0828EABA0Ch
mov edx, dword ptr [esp+0Ch]
jmp 00007F0828E16B49h
nop
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], 6DA08000h
mov dword ptr [esp+04h], eax
call 00007F0828EAC85Eh
add esp, 1Ch
ret
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 1Ch
mov dword ptr [esp], 6D95F000h
call dword ptr [6DA2E21Ch]
sub esp, 04h
test eax, eax
je 00007F0828E16BE5h
mov ebx, eax
mov dword ptr [esp], 6D95F000h
call dword ptr [6DA2E264h]
mov edi, dword ptr [6DA2E224h]
sub esp, 04h
mov dword ptr [6DA2C764h], eax
mov dword ptr [esp+04h], 6D95F013h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 6D95F029h
mov dword ptr [esp], ebx
call edi
mov dword ptr [6D958000h], eax
sub esp, 08h
test esi, esi
je 00007F0828E16B83h
mov dword ptr [esp+00h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x16d000	0x12d	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16e000	0xb78	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x171000	0x868c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x144fb0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x16e1cc	0x190	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x962a8	0x96400	c71d43de37ad2b1076cdeb172301c54c	False	0.4698094321963394	data	6.282349708256424	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x98000	0x67c8	0x6800	358b8a7767e700a9bb5723298ae4b2d5	False	0.42041015625	data	4.443097552653927	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x9f000	0xa6380	0xa6400	0ee42fb6cd396238d8ac6d9eb157b15a	False	0.43181390977443607	data	5.591347872659806	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.eh_fram	0x146000	0x1274	0x1400	85e22b3e84813337ea1a67b904c6bbcd	False	0.3369140625	data	4.565839626312234	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x148000	0x2477c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x16d000	0x12d	0x200	67859e1c9d81f1d2bdf6b531a2016f52	False	0.44921875	data	3.400613123216997	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x16e000	0xb78	0xc00	cb8eb4a241279d6fed66c3ea8ecac795	False	0.3961588541666667	data	5.12056831676781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x16f000	0x2c	0x200	db151290603a2662b590a75b7e0b0988	False	0.0546875	data	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x170000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x171000	0x868c	0x8800	79ed408bbe5c4bbb01c59442165783ed	False	0.6667911305147058	data	6.630417318575256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateIoCompletionPort, CreateThread, CreateWaitableTimerExW, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FormatMessageA, FreeEnvironmentStringsW, FreeLibrary, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetLastError, GetModuleHandleA, GetNativeSystemInfo, GetProcAddress, GetProcessAffinityMask, GetProcessHeap, GetQueuedCompletionStatusEx, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadLocale, GetTickCount, HeapAlloc, HeapFree, InitializeCriticalSection, IsBadReadPtr, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LoadLibraryW, LocalFree, PostQueuedCompletionStatus, QueryPerformanceCounter, RaiseFailFastException, ResumeThread, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessPriorityBoost, SetThreadContext, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TerminateProcess, TlsAlloc, TlsGetValue, UnhandledExceptionFilter, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WriteConsoleW, WriteFile, lstrlenA

msvcrt.dll

_amsg_exit, _beginthread, _errno, _initterm, _iob, _lock, _unlock, _wcsnicmp, abort, bsearch, calloc, fprintf, free, fwrite, malloc, mbstowcs, memcpy, memset, qsort, realloc, strcmp, strlen, strncmp, strtol, vfprintf, wcstombs

Exports

Name	Ordinal	Address
BarCreate	1	0x6d9545d0
BarDestroy	2	0x6d954850
BarFreeRec	3	0x6d954800
BarRecognize	4	0x6d9547b0
GetInstallDetailsPayload	5	0x6d954710
SignalInitializeCrashReporting	6	0x6d954760
SpellFree	7	0x6d954620
SpellInit	8	0x6d954670
SpellSpell	9	0x6d9546c0
_cgo_dummy_export	10	0x6da2c768

Target ID:	0
Start time:	14:28:03
Start date:	29/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll"
Imagebase:	0xe0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:28:03
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:28:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:28:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\T681Aj3oN9.dll,BarCreate
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:28:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",#1
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:28:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7584 -s 820
Imagebase:	0xd20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:28:04
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 840
Imagebase:	0xd20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:28:06
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\T681Aj3oN9.dll,BarDestroy
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:28:09
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\T681Aj3oN9.dll,BarFreeRec
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:28:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarCreate
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:28:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarDestroy
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:28:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarFreeRec
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:28:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",_cgo_dummy_export
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:28:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SpellSpell
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:28:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7944 -s 760
Imagebase:	0xd20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:28:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SpellInit
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:28:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SpellFree
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:28:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",SignalInitializeCrashReporting
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:28:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",GetInstallDetailsPayload
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:28:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\T681Aj3oN9.dll",BarRecognize
Imagebase:	0xea0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 6CC2CEA0 Relevance: 1.5, APIs: 1, Instructions: 21
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 6CC2CEC8

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction ID: 0201a53585980ab47dbe76e007d5695c19c32326a49169a7a9353ac179f8a8c3
Opcode Fuzzy Hash: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction Fuzzy Hash: 1EE0E571505700CFDB15DF18C2C1306BBE1EB48A00F0485A8DE098FB4AE738EE10CB92

Non-executed Functions

Function 6CBD59F0 Relevance: 18.5, Strings: 14, Instructions: 1019
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

gcing MB, got= ... max=scav ptr ] = (usagefalseinit ms, fault and tab= top=[...], fp:MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localsse41sse42ssse3int16int32int64uint8arraysliceGreeklistensocketsysmontimersefenceselect, not object next= , xrefs: 6CBD5ABA
5, xrefs: 6CBD6C27
gc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14StdDltadxaesshaavxfmaintma, xrefs: 6CBD629A
., xrefs: 6CBD61FE
gc done but gcphase != _GCoffruntime: p.gcMarkWorkerMode= scanobject of a noscan objectruntime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket, xrefs: 6CBD6C4A
MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, xrefs: 6CBD6A06
ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = , tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)traceback} stack=[ gp.goid, xrefs: 6CBD68DC
MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc=, xrefs: 6CBD699C
+:(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08, xrefs: 6CBD64A4, 6CBD678B
failed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPre, xrefs: 6CBD6C34
ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACE, xrefs: 6CBD64EC
, xrefs: 6CBD606A
non-concurrent sweep failed to drain all sweep queuesruntime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS threadcompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class bo, xrefs: 6CBD6C1E
@s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12, xrefs: 6CBD62C7

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: $ @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12$ MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:$ MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc=$ ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACE$ ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = , tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)traceback} stack=[ gp.goid$+:(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08$.$5$failed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPre$gc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14StdDltadxaesshaavxfmaintma$gc done but gcphase != _GCoffruntime: p.gcMarkWorkerMode= scanobject of a noscan objectruntime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket$gcing MB, got= ... max=scav ptr ] = (usagefalseinit ms, fault and tab= top=[...], fp:MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localsse41sse42ssse3int16int32int64uint8arraysliceGreeklistensocketsysmontimersefenceselect, not object next= $non-concurrent sweep failed to drain all sweep queuesruntime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS threadcompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class bo
API String ID: 0-2575422049
Opcode ID: c32927b2202ba063a2f13d25948740b720b1077261d4daae7cb512104897301c
Instruction ID: 40e4ed9a2cd32d9d62ee2c456e3b231f7131bea6ba60cd80d36a78bcee9ba2ce
Opcode Fuzzy Hash: c32927b2202ba063a2f13d25948740b720b1077261d4daae7cb512104897301c
Instruction Fuzzy Hash: 73B214746097848FD724DF68C490B9EBBF5FB8A304F01892ED98987750EB74A849CF52

Function 6CBE93F0 Relevance: 16.9, Strings: 13, Instructions: 643
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13C, xrefs: 6CBE96A4, 6CBE9AED
, [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST, xrefs: 6CBE96F7, 6CBE9721, 6CBE9B44, 6CBE9B6E
, levelBits[level] = runtime: searchIdx = panic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime:, xrefs: 6CBE9D15
] = pc=true+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheapt, xrefs: 6CBE9B1A
, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type float32float64\\.\UNCTuesdayJanuaryOctoberMUI_StdMUI_Dltavx512finvaliduintptros/execruntimetls3desno anodeCancelIoReadFileAcceptExWSAIoctlshu, xrefs: 6CBE9C04
runtime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard , xrefs: 6CBE9C5B
, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by short writeProcessPrngMoveFileExWNetShar, xrefs: 6CBE9BD7
, i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base stringGetACPSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13rdtscppopcntuint16uint32uint64structcmd/gonetdnsCommonCopySidWSARecvWSASendconnectconsoleforcegcallocmWc, xrefs: 6CBE9C88
runtime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupQuerySer, xrefs: 6CBE976B
runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket, xrefs: 6CBE9CE8
runtime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb, xrefs: 6CBE967A, 6CBE9AB3
] = (usagefalseinit ms, fault and tab= top=[...], fp:MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localsse41sse42ssse3int16int32int64uint8arraysliceGreeklistensocketsysmontimersefenceselect, not object next= jobs= goid sweep B -> % util alloc, xrefs: 6CBE96CD
bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 6CBE97A2, 6CBE9F68

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST$, i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base stringGetACPSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13rdtscppopcntuint16uint32uint64structcmd/gonetdnsCommonCopySidWSARecvWSASendconnectconsoleforcegcallocmWc$, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type float32float64\\.\UNCTuesdayJanuaryOctoberMUI_StdMUI_Dltavx512finvaliduintptros/execruntimetls3desno anodeCancelIoReadFileAcceptExWSAIoctlshu$, levelBits[level] = runtime: searchIdx = panic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime:$, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by short writeProcessPrngMoveFileExWNetShar$] = pc=true+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheapt$] = (usagefalseinit ms, fault and tab= top=[...], fp:MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localsse41sse42ssse3int16int32int64uint8arraysliceGreeklistensocketsysmontimersefenceselect, not object next= jobs= goid sweep B -> % util alloc$][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13C$bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod$runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket$runtime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupQuerySer$runtime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard $runtime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb
API String ID: 0-566501290
Opcode ID: 38f5fc34107cae36c5fde04a1623186e5259d73cef8cad1746d65cab61398fd5
Instruction ID: 183563e54c0c9da04fd17dbd8c0d7f044f86a4a9ad6e7f034998880f89138912
Opcode Fuzzy Hash: 38f5fc34107cae36c5fde04a1623186e5259d73cef8cad1746d65cab61398fd5
Instruction Fuzzy Hash: 32526A75A087948FD720DF68C48079EBBF1FF89748F01892DE99897740DB74A849CB92

Function 6CBF1570 Relevance: 16.4, Strings: 13, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

bcryptprimitives.dll, xrefs: 6CBF158D
NtCancelWaitCompletionPacket, xrefs: 6CBF16E2
bcryptprimitives.dll not foundpanic called with nil argumentcheckdead: inconsistent countsrunqputslow: queue is not fullruntime: bad pointer in frame invalid pointer found on stack locals stack map entries for abi mismatch detected between runtime: impossible , xrefs: 6CBF1807
RtlGetCurrentPeb, xrefs: 6CBF1734
NtCreateWaitCompletionPacket, xrefs: 6CBF163E
ProcessPrng, xrefs: 6CBF15BF
NtCreateWaitCompletionPacket exists but NtCancelWaitCompletionPacket does notcannot convert slice with length %y to array or pointer to array with length %xNtCreateWaitCompletionPacket exists but NtAssociateWaitCompletionPacket does notcgocheck > 1 mode is no , xrefs: 6CBF17C5
ntdll.dll, xrefs: 6CBF1608
, xrefs: 6CBF169A
NtAssociateWaitCompletionPacket, xrefs: 6CBF1690
P, xrefs: 6CBF17E4
RtlGetVersion, xrefs: 6CBF177E
, xrefs: 6CBF16A2

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: $ $NtAssociateWaitCompletionPacket$NtCancelWaitCompletionPacket$NtCreateWaitCompletionPacket$NtCreateWaitCompletionPacket exists but NtCancelWaitCompletionPacket does notcannot convert slice with length %y to array or pointer to array with length %xNtCreateWaitCompletionPacket exists but NtAssociateWaitCompletionPacket does notcgocheck > 1 mode is no $P$ProcessPrng$RtlGetCurrentPeb$RtlGetVersion$bcryptprimitives.dll$bcryptprimitives.dll not foundpanic called with nil argumentcheckdead: inconsistent countsrunqputslow: queue is not fullruntime: bad pointer in frame invalid pointer found on stack locals stack map entries for abi mismatch detected between runtime: impossible $ntdll.dll
API String ID: 0-2332038095
Opcode ID: da1f35fcbe1bf20a4bf8b0bb062487aecb5d4fb298b83349d4675dcf484f9d72
Instruction ID: 956b046bfa98465087c5d59c5bef812ecb06ba8df411a6e0ea47578973afd84a
Opcode Fuzzy Hash: da1f35fcbe1bf20a4bf8b0bb062487aecb5d4fb298b83349d4675dcf484f9d72
Instruction Fuzzy Hash: 3771C5B420A742DFEB04DF28C59065ABBF4FB86748F10882DE5A987740E774D859CF62

Function 6CBE3400 Relevance: 14.6, Strings: 11, Instructions: 876COMMON

Download Yara Rule

Strings

swept cached spanmarkBits overflowruntime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb, xrefs: 6CBE3C65
, xrefs: 6CBE3E12
sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine LockFileExWSASocketWunixpacket, xrefs: 6CBE3CB8, 6CBE412C
nalloc= nfreed=runtime.[signal reflect. newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes status= etypes wsaioctlThursdaySaturdayFebruaryNovemberDecember%!Month(avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberx509sha1FindCloseLocalFreeMo, xrefs: 6CBE3D81
mspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdea, xrefs: 6CBE418A
sweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket, xrefs: 6CBE3E09
sweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireSudog: found s.elem != nil in cachefatal error: cgo callback before cgo callon a locked thread with no template threadunexpected signal during runtime executiontraceSto, xrefs: 6CBE3C4F
mspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResumeNotification, xrefs: 6CBE3D16
mspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1, xrefs: 6CBE41A9
previous allocCount=, levelBits[level] = runtime: searchIdx = panic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime:, xrefs: 6CBE3DAB
mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 6CBE3CE2, 6CBE4156

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: $ mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod$ nalloc= nfreed=runtime.[signal reflect. newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes status= etypes wsaioctlThursdaySaturdayFebruaryNovemberDecember%!Month(avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberx509sha1FindCloseLocalFreeMo$ previous allocCount=, levelBits[level] = runtime: searchIdx = panic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime:$ sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine LockFileExWSASocketWunixpacket$mspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResumeNotification$mspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdea$mspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1$sweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket$sweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireSudog: found s.elem != nil in cachefatal error: cgo callback before cgo callon a locked thread with no template threadunexpected signal during runtime executiontraceSto$swept cached spanmarkBits overflowruntime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb
API String ID: 0-893999930
Opcode ID: 4241a571faf0815fd0a6f302d17ed06be641bdf5d0dd3bc38dcc558ca4805b3a
Instruction ID: 966d37531eb36fd2502d906db68d68ff8f7dc1268a4323892c1c563ac46a5708
Opcode Fuzzy Hash: 4241a571faf0815fd0a6f302d17ed06be641bdf5d0dd3bc38dcc558ca4805b3a
Instruction Fuzzy Hash: 3F82367460D3948FC351DF29C080A9ABBF1BF89B48F40896DE8D88B751E774D949CB92

Function 6CBF2A90 Relevance: 14.0, Strings: 11, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notunexpected runtime.netpoll error: network dropped connec, xrefs: 6CBF2DC9
runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerociphertext is not a multiple of the block sizeslice bounds out of range [:%x] wi, xrefs: 6CBF2EFD
%, xrefs: 6CBF2F3A
CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=invalid or incomplet, xrefs: 6CBF2E7B, 6CBF2ED6
bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFi, xrefs: 6CBF2D6E
,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12, xrefs: 6CBF2D29
runtime: NtCreateWaitCompletionPacket failed; errno=casfrom_Gscanstatus: gp->status is not in scan statenon-concurrent sweep failed to drain all sweep queuesruntime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS thr, xrefs: 6CBF2DEC
runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:, xrefs: 6CBF2D95
runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!internal error: unknown network type godebug: unexpected IncNonDefault of b, xrefs: 6CBF2F31
NtCreateWaitCompletionPacket failedfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadline2006-01-02T15:04:05.999999999Z07:00accessing a cor, xrefs: 6CBF2E20
runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerociphertext is not a multiple of the block sizeslice bounds out of range [:%x] with length %ypanicwrap: unexpected string afte, xrefs: 6CBF2E47, 6CBF2EA2

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: %$,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12$CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=invalid or incomplet$NtCreateWaitCompletionPacket failedfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadline2006-01-02T15:04:05.999999999Z07:00accessing a cor$VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notunexpected runtime.netpoll error: network dropped connec$bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFi$runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerociphertext is not a multiple of the block sizeslice bounds out of range [:%x] wi$runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!internal error: unknown network type godebug: unexpected IncNonDefault of b$runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerociphertext is not a multiple of the block sizeslice bounds out of range [:%x] with length %ypanicwrap: unexpected string afte$runtime: NtCreateWaitCompletionPacket failed; errno=casfrom_Gscanstatus: gp->status is not in scan statenon-concurrent sweep failed to drain all sweep queuesruntime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS thr$runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:
API String ID: 0-2809656213
Opcode ID: b22c8ad05980cdcce4f4cc142b6ce66d176f78b3b82350facc46f7a9aedd3721
Instruction ID: 47398be098a18ffb0886e821779e7f10e3ed62feed19894d0d9ae8d7ca07dd66
Opcode Fuzzy Hash: b22c8ad05980cdcce4f4cc142b6ce66d176f78b3b82350facc46f7a9aedd3721
Instruction Fuzzy Hash: F5C1B3B42097818FD701EF68C19479EBBF4EF89708F00896DE89887740D775994ECB62

Function 6CBC13E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6CBC13F0
LoadLibraryA.KERNEL32 ref: 6CBC1406
GetProcAddress.KERNEL32 ref: 6CBC1425
GetProcAddress.KERNEL32 ref: 6CBC1437

Strings

__register_frame_info, xrefs: 6CBC141A
libgcc_s_dw2-1.dll, xrefs: 6CBC13E9, 6CBC13FF
__deregister_frame_info, xrefs: 6CBC142C

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: ec9d5bab6cbca56410bf2d0b677558a6117e60143e37f9e7dce635ab89e543d7
Instruction ID: eb528891cae927306784dde17d2b2b3d3603212aabdc2e85e2c353c8d42de776
Opcode Fuzzy Hash: ec9d5bab6cbca56410bf2d0b677558a6117e60143e37f9e7dce635ab89e543d7
Instruction Fuzzy Hash: 610192B2A053008FDB007F78950631F7EF8EB82245F45452DD98597A10E7349425CB93

Function 6CC2332F Relevance: 12.0, Strings: 9, Instructions: 757COMMON

Download Yara Rule

Strings

mallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= , xrefs: 6CC23D05
!"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC, xrefs: 6CC236FF
mallocgc called with gcphase == _GCmarkterminationrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCallback: function argument frame too largelimiterEvent.stop: invalid limiter event type foundpotential, xrefs: 6CC23D47
3-, xrefs: 6CC23D58
p, xrefs: 6CC23D5E
4, xrefs: 6CC23D0E
2, xrefs: 6CC23D50
malloc during signalclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not empty, xrefs: 6CC23D1B
malloc deadlockruntime error: with GC progscan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]mo, xrefs: 6CC23D31

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC$2$4$malloc deadlockruntime error: with GC progscan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]mo$malloc during signalclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not empty$mallocgc called with gcphase == _GCmarkterminationrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCallback: function argument frame too largelimiterEvent.stop: invalid limiter event type foundpotential$mallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= $3-$p
API String ID: 0-234616912
Opcode ID: 4dd247dd1fef9d8523aa01ec25d81d2dc6188e42c39e3e6c4dae52d702f79893
Instruction ID: ad374787555a0efd090d0607a1fd6a0c9af72dff288f41f2a806b73e68d38d60
Opcode Fuzzy Hash: 4dd247dd1fef9d8523aa01ec25d81d2dc6188e42c39e3e6c4dae52d702f79893
Instruction Fuzzy Hash: 4C62DF746093448FC704CF29C090A6ABBF5FF89718F18896DE9988B792E739D945CF42

Function 6CC15ED0 Relevance: 10.5, Strings: 8, Instructions: 512COMMON

Download Yara Rule

Strings

, xrefs: 6CC16031
:(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08I, xrefs: 6CC163FD
, xrefs: 6CC16039
sp= sp: lr: fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptracepanicsleepgcing MB, got= ... max=scav ptr ] = (us, xrefs: 6CC16566
(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08ID, xrefs: 6CC16320
pc=true+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptrace, xrefs: 6CC16593
non-Go function at pc=RtlLookupFunctionEntryCreateEnvironmentBlockWSAGetOverlappedResultSao Tome Standard TimeAleutian Standard TimeParaguay Standard TimeMountain Standard TimeAtlantic Standard TimePakistan Standard TimeSakhalin Standard TimeGeorgian Standard , xrefs: 6CC166C5
fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptracepanicsleepgcing MB, got= ... max=scav ptr ] = (usagefalseinit, xrefs: 6CC16539

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: $ $ fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptracepanicsleepgcing MB, got= ... max=scav ptr ] = (usagefalseinit$ pc=true+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptrace$ sp= sp: lr: fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptracepanicsleepgcing MB, got= ... max=scav ptr ] = (us$(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08ID$:(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08I$non-Go function at pc=RtlLookupFunctionEntryCreateEnvironmentBlockWSAGetOverlappedResultSao Tome Standard TimeAleutian Standard TimeParaguay Standard TimeMountain Standard TimeAtlantic Standard TimePakistan Standard TimeSakhalin Standard TimeGeorgian Standard
API String ID: 0-3830612415
Opcode ID: 43690b04a5c2e122e847bd847711b2b3d0d1023ded0caaef5131d3b306bb033c
Instruction ID: 39662e63bed877b3eee87af2df0c7d6503cd877c31a737f0b29da091a8a4c82b
Opcode Fuzzy Hash: 43690b04a5c2e122e847bd847711b2b3d0d1023ded0caaef5131d3b306bb033c
Instruction Fuzzy Hash: 0C32F37460D7818FC361DF66C18079EBBE1EF89308F05896DE8D897B41EB309849DB92

Function 6CBF1A70 Relevance: 8.9, Strings: 7, Instructions: 116COMMON

Download Yara Rule

Strings

runtime: LoadLibraryExW failed; errno=runtime: GetProcAddress failed; errno=runtime: sudog with non-false isSelectarg size to reflect.call more than 1GBv could not fit in traceBytesPerNumbertime: missing Location in call to Datetransport endpoint is already co, xrefs: 6CBF1C34
&, xrefs: 6CBF1C3D
runtime: GetProcAddress failed; errno=runtime: sudog with non-false isSelectarg size to reflect.call more than 1GBv could not fit in traceBytesPerNumbertime: missing Location in call to Datetransport endpoint is already connectedmismatched count during itab ta, xrefs: 6CBF1BD9
winmm.dll, xrefs: 6CBF1AF3
timeBeginPeriod, xrefs: 6CBF1B29
timeBegin/EndPeriod not foundruntime: sudog with non-nil centersyscall inconsistent bp entersyscall inconsistent sp gfput: bad status (not Gdead)LockOSThread nesting overflowsemacquire not on the G stackruntime: split stack overflowstring concatenation too lon, xrefs: 6CBF1C0D
timeEndPeriod, xrefs: 6CBF1B73

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: &$runtime: GetProcAddress failed; errno=runtime: sudog with non-false isSelectarg size to reflect.call more than 1GBv could not fit in traceBytesPerNumbertime: missing Location in call to Datetransport endpoint is already connectedmismatched count during itab ta$runtime: LoadLibraryExW failed; errno=runtime: GetProcAddress failed; errno=runtime: sudog with non-false isSelectarg size to reflect.call more than 1GBv could not fit in traceBytesPerNumbertime: missing Location in call to Datetransport endpoint is already co$timeBegin/EndPeriod not foundruntime: sudog with non-nil centersyscall inconsistent bp entersyscall inconsistent sp gfput: bad status (not Gdead)LockOSThread nesting overflowsemacquire not on the G stackruntime: split stack overflowstring concatenation too lon$timeBeginPeriod$timeEndPeriod$winmm.dll
API String ID: 0-424793872
Opcode ID: 1e1d5e5d7b6d873c1e1998e3795975e957e0aed0212fef3a2c2c4097413cd19d
Instruction ID: a23a91f316128082e532d290dba9dd1429e181f60bad956139de07ce907f9fbf
Opcode Fuzzy Hash: 1e1d5e5d7b6d873c1e1998e3795975e957e0aed0212fef3a2c2c4097413cd19d
Instruction Fuzzy Hash: 9851B3B06097418FEB04EF68C19466EBBF4EB89308F00881DE5A987B40E774D44DCB62

Function 6CBFCF90 Relevance: 8.6, Strings: 6, Instructions: 1093COMMON

Download Yara Rule

Strings

findrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of r, xrefs: 6CBFE0D5
findrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for [origina, xrefs: 6CBFE0BF
global runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2runtime: typeBitsBulkBarrier without type/memory/classes/metadata/mspan/free:bytesruntime.SetFinaliz, xrefs: 6CBFE093
findrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadline2006-01-02T15:04:05.999999999Z07:00accessing a corrupted shared librarylfstack node a, xrefs: 6CBFE0A9
!, xrefs: 6CBFE0DE
findrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionAdjustTokenPrivilegesLookupPrivilegeValueWNetUserGetLocalGroupsGetProfi, xrefs: 6CBFE0EB

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: !$findrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of r$findrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for [origina$findrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadline2006-01-02T15:04:05.999999999Z07:00accessing a corrupted shared librarylfstack node a$findrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionAdjustTokenPrivilegesLookupPrivilegeValueWNetUserGetLocalGroupsGetProfi$global runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2runtime: typeBitsBulkBarrier without type/memory/classes/metadata/mspan/free:bytesruntime.SetFinaliz
API String ID: 0-3518981815
Opcode ID: f4943ab7348debe6940e9cd2b52c1324ed12ebe2d99b288e8965edc040eb0b91
Instruction ID: d65165081af9903f9906d1a4100f7d97bc4c47c5ba82d94312b8ad524b62f8e1
Opcode Fuzzy Hash: f4943ab7348debe6940e9cd2b52c1324ed12ebe2d99b288e8965edc040eb0b91
Instruction Fuzzy Hash: AEA2D0746093818FE724DF69D090B9EBBF4BF89748F04892DE9D887780E7359849CB52

Function 6CBF11F0 Relevance: 7.6, Strings: 6, Instructions: 133COMMON

Download Yara Rule

Strings

runtime: SetWaitableTimer failed; errno= stopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt basehash mismatch: data integrity check failedpersistentalloc: align is not a power of 2out of memory allocating checkmarks bitmap/cpu/classe, xrefs: 6CBF13C4
5, xrefs: 6CBF1420
runtime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallDestroy, xrefs: 6CBF139D, 6CBF13F8, 6CBF144B
runtime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS threadcompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class boundarygcControllerState.findRunnable: blackening not , xrefs: 6CBF1417
runtime: NtAssociateWaitCompletionPacket failed; errno= runtime: checkmarks found unexpected unmarked object obj=tried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-manually-managed typeaddr range base and limit ar, xrefs: 6CBF1369
d, xrefs: 6CBF1276

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: 5$d$runtime: NtAssociateWaitCompletionPacket failed; errno= runtime: checkmarks found unexpected unmarked object obj=tried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-manually-managed typeaddr range base and limit ar$runtime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS threadcompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class boundarygcControllerState.findRunnable: blackening not $runtime: SetWaitableTimer failed; errno= stopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt basehash mismatch: data integrity check failedpersistentalloc: align is not a power of 2out of memory allocating checkmarks bitmap/cpu/classe$runtime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallDestroy
API String ID: 0-2414937731
Opcode ID: 935d4cd8ca3b5a9012e3a56ac175d8a215c43bc2a5f5baff2145a1e8fc4b62a0
Instruction ID: d6976b4485c58bc0f0e56822aa78c7ffa9666effb22affa7bf4ef619bffce85f
Opcode Fuzzy Hash: 935d4cd8ca3b5a9012e3a56ac175d8a215c43bc2a5f5baff2145a1e8fc4b62a0
Instruction Fuzzy Hash: DB51BDB42097809FD740DF68C19479EBBF4AF88708F008C2DE8A887B50E77499498B63

Function 6CC56250 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 6CC56289
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CBC13B9), ref: 6CC5629A
GetCurrentThreadId.KERNEL32 ref: 6CC562A2
GetTickCount.KERNEL32 ref: 6CC562AA
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CBC13B9), ref: 6CC562B9

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 78746d9e3b7637f5435700f4dcfd6a3ab2c204478f0f756392823b27862b4f66
Instruction ID: 12cc088b5216fb46c8f718d22f4c96261efc341676c746b0c2bf170be359283a
Opcode Fuzzy Hash: 78746d9e3b7637f5435700f4dcfd6a3ab2c204478f0f756392823b27862b4f66
Instruction Fuzzy Hash: 4D115EB56053008FDB00DF79E88868BBBF8FB89255F450D39E549C6700EA39D4698BD2

Function 6CC56300 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6CC5634F
UnhandledExceptionFilter.KERNEL32 ref: 6CC5635F
GetCurrentProcess.KERNEL32 ref: 6CC56368
TerminateProcess.KERNEL32 ref: 6CC56379
abort.MSVCRT ref: 6CC56382

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 7b194e1097102f48267c21cd72dbb919a2873ab6cdf0c27a3de6efdab7e3192b
Instruction ID: fbd5d914c4f8300b1782e81e08fb2852efdec43ab90ee3d18723f0947771aa9d
Opcode Fuzzy Hash: 7b194e1097102f48267c21cd72dbb919a2873ab6cdf0c27a3de6efdab7e3192b
Instruction Fuzzy Hash: 031116B5A05200CFEB00EF78C14965A7BF4BB95305F40896DEA89C7360E738D9648F92

Function 6CBE1440 Relevance: 5.5, Strings: 4, Instructions: 494COMMON

Download Yara Rule

Strings

runtime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]morebuf={pc:: no frame (sp=runtime: frame ts set in timertraceback stuckrunti, xrefs: 6CBE198C, 6CBE19DB
min must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exce, xrefs: 6CBE1A0F
!, xrefs: 6CBE1A18
min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=dalTLDpSugct?GetTempPath2WModule32NextW, xrefs: 6CBE19C0

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: !$min must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exce$min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=dalTLDpSugct?GetTempPath2WModule32NextW$runtime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]morebuf={pc:: no frame (sp=runtime: frame ts set in timertraceback stuckrunti
API String ID: 0-967014423
Opcode ID: ae9ee019eb49785c56ddf12186f32094d2ebee0f2c5dc29d96ab431e299fb739
Instruction ID: 0e696307a3f8e93947d2c7575181dcdda70896026ac00ef4a31c1b6285cab363
Opcode Fuzzy Hash: ae9ee019eb49785c56ddf12186f32094d2ebee0f2c5dc29d96ab431e299fb739
Instruction Fuzzy Hash: 7DF1E4766093654FD301DF99C4C064EB7E2EBC8788F288A3CD89597782EB75D849C6C2

Function 6CBFA320 Relevance: 5.4, Strings: 4, Instructions: 352COMMON

Download Yara Rule

Strings

stopTheWorld: not stopped (status != _Pgcstop)signal arrived during external code executionruntime: name offset base pointer out of rangeruntime: type offset base pointer out of rangeruntime: text offset base pointer out of rangeattempting to link in too many, xrefs: 6CBFA7B0
stopTheWorld: broken CPU time accountingglobal runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2runtime: typeBitsBulkBarrier without type/memory/classes/met, xrefs: 6CBFA7EB
stopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a , xrefs: 6CBFA843
stopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt basehash mismatch: data integrity check failedpersistentalloc: align is not a power of 2out of memory allocating checkmarks bitmap/cpu/classes/gc/mark/dedicated:cpu-seconds/memory/cl, xrefs: 6CBFA690

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: stopTheWorld: broken CPU time accountingglobal runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2runtime: typeBitsBulkBarrier without type/memory/classes/met$stopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a $stopTheWorld: not stopped (status != _Pgcstop)signal arrived during external code executionruntime: name offset base pointer out of rangeruntime: type offset base pointer out of rangeruntime: text offset base pointer out of rangeattempting to link in too many$stopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt basehash mismatch: data integrity check failedpersistentalloc: align is not a power of 2out of memory allocating checkmarks bitmap/cpu/classes/gc/mark/dedicated:cpu-seconds/memory/cl
API String ID: 0-2039697367
Opcode ID: 5b0aa2a58c15842ecad6bcdf60e7a6913745212f803c518d240e9a298938ce68
Instruction ID: 192a7ac3e385d4cc1db12f3933035f963494c842ae3ff18dc66e3f8401e9d43a
Opcode Fuzzy Hash: 5b0aa2a58c15842ecad6bcdf60e7a6913745212f803c518d240e9a298938ce68
Instruction Fuzzy Hash: 4EF1C0746093808FD308DF69C190A9AFBF1BF89704F54892EE9A887751D774E94ACF42

Function 6CBF1830 Relevance: 5.1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

Strings

powrprof.dll, xrefs: 6CBF184D
', xrefs: 6CBF1889
PowerRegisterSuspendResumeNotification, xrefs: 6CBF187F
', xrefs: 6CBF1891

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: '$'$PowerRegisterSuspendResumeNotification$powrprof.dll
API String ID: 0-4026319467
Opcode ID: 7898b2620bccb62690e5a97e27f12789bc6f5779f7b78d90cc9496f57cfdc517
Instruction ID: 38dd52a4ace4d16ea8acb9af7816e5f9d8dc6a39490491d61e62c5b8bc85f571
Opcode Fuzzy Hash: 7898b2620bccb62690e5a97e27f12789bc6f5779f7b78d90cc9496f57cfdc517
Instruction Fuzzy Hash: 5E21E3B46093428FD704CF25C190A5ABBF0BB89708F44881DE4D997750E779DA49CF93

Function 6CC06470 Relevance: 4.2, Strings: 3, Instructions: 451COMMON

Download Yara Rule

Strings

runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=invalid or incomplete multibyte or wide characterslice bounds out of range [::%x] with capacity %yinvalid memory add, xrefs: 6CC069D7
runtime: malformed profBuf buffer - tag and data out of syncabiRegArgsType needs GC Prog, update methodValueCallFrameObjsfound bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.stop: found wrong event in p's limiter event slotruntime: intern, xrefs: 6CC06A04
<, xrefs: 6CC06A0D

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: <$runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=invalid or incomplete multibyte or wide characterslice bounds out of range [::%x] with capacity %yinvalid memory add$runtime: malformed profBuf buffer - tag and data out of syncabiRegArgsType needs GC Prog, update methodValueCallFrameObjsfound bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.stop: found wrong event in p's limiter event slotruntime: intern
API String ID: 0-450027851
Opcode ID: ac4bfccd25c89c27d5d4ddc6e8459338e6e3b9f22b352f51969465332afebbde
Instruction ID: e2f22d056ceece15816348be4282a3f2bb17d229e9f25ed0387d0454da5afd84
Opcode Fuzzy Hash: ac4bfccd25c89c27d5d4ddc6e8459338e6e3b9f22b352f51969465332afebbde
Instruction Fuzzy Hash: 83026C70B08B058FD714DF69C19065EBBE1BFC8704F14892DE99987B50EB76E885CB82

Function 6CBF6010 Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

suspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function traceRegion: alloc with concurrent drop2006-01-02 15:04:05.999999999 -0700 MSTaddress family not support, xrefs: 6CBF64A3
', xrefs: 6CBF64AC
invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:DuplicateTokenExGetCurrentThreadRtlVirtualUnwindGODEBUG: value "[bisect-match 0xpermission deniedwro, xrefs: 6CBF648D

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: '$invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:DuplicateTokenExGetCurrentThreadRtlVirtualUnwindGODEBUG: value "[bisect-match 0xpermission deniedwro$suspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function traceRegion: alloc with concurrent drop2006-01-02 15:04:05.999999999 -0700 MSTaddress family not support
API String ID: 0-3278438963
Opcode ID: 023258067ef08bd9c750f4a5260507993877b40f6af42c9473327f2677f647ff
Instruction ID: 0916ad2fd117c5d1b6d43e84d615c0a68cd79c17f95c416e4adb036495d5d5c5
Opcode Fuzzy Hash: 023258067ef08bd9c750f4a5260507993877b40f6af42c9473327f2677f647ff
Instruction Fuzzy Hash: 04D1207460D3908FC704DF29C09065BBBF2AF8A708F54886DE8E587B51D735E94ACB82

Function 6CBE6630 Relevance: 3.0, Strings: 2, Instructions: 499COMMON

Download Yara Rule

Strings

+, xrefs: 6CBE6D57
grew heap, but no adequate free space foundroot level max pages doesn't fit in summaryruntime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=runtime:stoplockedm: lockedg (atomicstatus=me, xrefs: 6CBE6D4E

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: +$grew heap, but no adequate free space foundroot level max pages doesn't fit in summaryruntime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=runtime:stoplockedm: lockedg (atomicstatus=me
API String ID: 0-3347251187
Opcode ID: 0360194db3780e3d07e0e5944f3a422aba3fe560a61f53f0e3db63ac2cdf2931
Instruction ID: 2d0ff8d0da5ee99d5cd638d6f967aca3c773318ea81ec987188ebcb84f07dd95
Opcode Fuzzy Hash: 0360194db3780e3d07e0e5944f3a422aba3fe560a61f53f0e3db63ac2cdf2931
Instruction Fuzzy Hash: BB22EE746093858FD354DF29C090A5EBBF1BF89B84F14892DEAD987750EB34E848CB42

Function 6CBEB2D0 Relevance: 2.8, Strings: 2, Instructions: 264COMMON

Download Yara Rule

Strings

@, xrefs: 6CBEB4FB
bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 6CBEB60F

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: @$bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod
API String ID: 0-1191861649
Opcode ID: 9019dd8149adbf5636abecfa4b129fc6db8cc82ad4a28198e1062eb226ebc897
Instruction ID: e4afdb86a79703251cc0f84828c5e2aac9d875d94696626971f27b4696d727db
Opcode Fuzzy Hash: 9019dd8149adbf5636abecfa4b129fc6db8cc82ad4a28198e1062eb226ebc897
Instruction Fuzzy Hash: F5A1D17560871A8FD304DF18C88015EB7E1FFC8358F488A2DE9959B751EB34E95ACB82

Function 6CC2A872 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

, xrefs: 6CC2A898
@, xrefs: 6CC2A89D

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: $@
API String ID: 0-1077428164
Opcode ID: c4411b23eccc7b1ddc3486aa9724f1a918e0d7523ab9dfa00bea8f07cb01a124
Instruction ID: 828f1a2a7d12c387e2bcd04f5881e59c416774bfa19f9e273a2c3458c4b5e97d
Opcode Fuzzy Hash: c4411b23eccc7b1ddc3486aa9724f1a918e0d7523ab9dfa00bea8f07cb01a124
Instruction Fuzzy Hash: 5B51B910C1DF9B65EA33077EC4026263B206EB7144B01D76FFEC6B58B2E7176940BA22

Function 6CBDCEC0 Relevance: 2.6, Strings: 2, Instructions: 88COMMON

Download Yara Rule

Strings

gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackcannot send after transport endpoint shu, xrefs: 6CBDCFA1
,, xrefs: 6CBDCFAA

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: ,$gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackcannot send after transport endpoint shu
API String ID: 0-27675022
Opcode ID: ca60b8957a7b89e67835e7e9399708c42f5b24b11b910f0fe4470d18ac28e406
Instruction ID: dd879522bd6fe56200d3e54d4071d553ce0e2cc3348fc2e70a226628e04d6f06
Opcode Fuzzy Hash: ca60b8957a7b89e67835e7e9399708c42f5b24b11b910f0fe4470d18ac28e406
Instruction Fuzzy Hash: 66319175A493A68FD305DF14C480A99B7F1FB86608F0981BDCD884F383DB35A84ACB85

Function 6CC18570 Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

4, xrefs: 6CC188DB

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: ce9e0416bba0d52d6c8fa6360f3020b671c2649b5370e2968d1df84a03f53972
Instruction ID: c69c363ddd88e272cccdafdeaeda20600de1127ca259fae7de21b05a1775ff2f
Opcode Fuzzy Hash: ce9e0416bba0d52d6c8fa6360f3020b671c2649b5370e2968d1df84a03f53972
Instruction Fuzzy Hash: 8C22E27560D3468FD730DE19C4C4A9EB7E1BFC5304F158A2ED9998BB81EB30A905DB82

Function 6CBD0AF0 Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incor, xrefs: 6CBD0D52

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incor
API String ID: 0-1712010102
Opcode ID: b1f8b181cec8175884e61613d19907cfd9d2e4e45982acfff33c64efa96587a0
Instruction ID: 41dc84c11531fa02f75d0a2ec78d33ef42a7a8bbf4e10566efae9b7f20f7c689
Opcode Fuzzy Hash: b1f8b181cec8175884e61613d19907cfd9d2e4e45982acfff33c64efa96587a0
Instruction Fuzzy Hash: 21D1307460D3858FC704DF28D09066EBBE0AF89748F41892EE8D987B50E735E949CB42

Function 6CBED040 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinnin, xrefs: 6CBED3CB

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinnin
API String ID: 0-429552053
Opcode ID: 4013b54feaa6a5069f7dd78edcef4b54281d0649e5c69cb0f8974b82ef2831f7
Instruction ID: 345fc6ef4936ab63ebb83d3c0696c6f181dcc64d312128849df1cc0d7568bff6
Opcode Fuzzy Hash: 4013b54feaa6a5069f7dd78edcef4b54281d0649e5c69cb0f8974b82ef2831f7
Instruction Fuzzy Hash: 08B1F3786093858FC704DF68D08085ABBF1FBCAB88F51592DE99987710E774E949CF82

Function 6CBEA360 Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

@, xrefs: 6CBEA588

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 5fbf1cc58a88f309f6c65d497214c3d36b41247917c7867155a742ef1b933efc
Instruction ID: 90e8ee5bfe89d91f0b389eb237e724b01bd59acce634d559ff066c4912820b7b
Opcode Fuzzy Hash: 5fbf1cc58a88f309f6c65d497214c3d36b41247917c7867155a742ef1b933efc
Instruction Fuzzy Hash: 8D9100B5A093459FC344DF28C08065EBBF1FB88B44F549A2DE89997741E734D949CF82

Function 6CBEC080 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d94cfd1cadeab2ca5ee81f11638ed601e3999de06f4ab2b6999be7e7ee7fa5
Instruction ID: 9347a0e011e8a671428f48076b4d0d8e795f04ac0dc6c000540dc685b6d5dc8d
Opcode Fuzzy Hash: 79d94cfd1cadeab2ca5ee81f11638ed601e3999de06f4ab2b6999be7e7ee7fa5
Instruction Fuzzy Hash: DDE10533B497594BD314ADAD88C025EB6D2ABC8784F19873CDD649B780FB75DC0A86C2

Function 6CC1BC20 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94422fc7bad676a5082d9c6bcb2d908fdee04c800160c98db8d534a0c87ae310
Instruction ID: e7658258bde5e560c8e9789d492df094a2c6e34b02d2693b03d61d943732ed02
Opcode Fuzzy Hash: 94422fc7bad676a5082d9c6bcb2d908fdee04c800160c98db8d534a0c87ae310
Instruction Fuzzy Hash: 44028E7560C3568FD324DE69C08065EF7E1BF89308F148A7DE9998BB51E734E809DB82

Function 6CBEBB10 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1fc01af86e82c24a2690c313f2cf0e61fde9b689937a46cef61efd93bbb306
Instruction ID: ecab201dd9234ca4ff25fef790b49df72af5fad4058b1285c88cdb80ad7a2aab
Opcode Fuzzy Hash: 0a1fc01af86e82c24a2690c313f2cf0e61fde9b689937a46cef61efd93bbb306
Instruction Fuzzy Hash: 8CE1C433E2472507D3149E58CC80249B6D3ABC8670F4EC72DED95AB781EAB4ED5987C2

Function 6CBD80A0 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a94e35f6593c6ea2464ef82fd9b8d73f4eb9927b67b59de7de52f938ff1888d
Instruction ID: 521a31ccb77ca08c7efb6cd0fd882d8643841604d48786562dfe1b7c4122d99a
Opcode Fuzzy Hash: 1a94e35f6593c6ea2464ef82fd9b8d73f4eb9927b67b59de7de52f938ff1888d
Instruction Fuzzy Hash: 9BC1C232B093154FC709DE6DC89060EB7E2ABC8304F49863DE8599B7A5E775ED0987C2

Function 6CC1D6E0 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fd96155f0b1f66a3427e3dbbbaca7e5ed24dc19be600931b1f09302c5ed3b8
Instruction ID: 349bbad5e945498c737905cc04adfd1d08b578141223b16d6aaa90e320059a2b
Opcode Fuzzy Hash: 84fd96155f0b1f66a3427e3dbbbaca7e5ed24dc19be600931b1f09302c5ed3b8
Instruction Fuzzy Hash: F5E1D33160D3568FC315DF29C4C096EFBE1AF8A204F044A7DE8958BB92E734E945DB92

Function 6CBFE240 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceaab98dea8800dafbcbbbc29c3b601cbfd96e68b173929fb1c6df68e6306090
Instruction ID: 90725cee9885dc26dc54e9802b529cee00577a9c36016441a12b7f4ebc8215d9
Opcode Fuzzy Hash: ceaab98dea8800dafbcbbbc29c3b601cbfd96e68b173929fb1c6df68e6306090
Instruction Fuzzy Hash: 2AF1C27460D7908FD364CF29C490B5FBBE1BBC9204F54892EE9D887751EB31A849CB52

Function 6CBEC6D0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7099e13b5af9e5f19af27839411497dda8e95d2269081f0865d4ad4b6f18c959
Instruction ID: 1e37f2f7b2c81a6fbfa032c422fdc3be86428d0394e008d5a08ceb44204a5097
Opcode Fuzzy Hash: 7099e13b5af9e5f19af27839411497dda8e95d2269081f0865d4ad4b6f18c959
Instruction Fuzzy Hash: 369179326093594FC319EE9DC4D051EBBE2FBC8788F58473CD9690B780EB759909C682

Function 6CBECA30 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20660ae35d67ed051b5fe91141bd4ef6db36c639dd40e4db4de762af31e795fc
Instruction ID: 55f65b13b9dd8ed5cc6a8f22883681d2121ea912a8e0b4bb0feda23bef90989a
Opcode Fuzzy Hash: 20660ae35d67ed051b5fe91141bd4ef6db36c639dd40e4db4de762af31e795fc
Instruction Fuzzy Hash: C68124367493794FD311EDA888D024E3A92EBC8798F19473CD9748B7C5FBB5980582C2

Function 6CBEAD50 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20766ab3dc7502dab787efa6de840498fff7ddb46034e4909725741133dedf3
Instruction ID: c42c1d9e904de8c0943437cbe2ab60cac465d46b5d969d2456ef720bfcb64526
Opcode Fuzzy Hash: b20766ab3dc7502dab787efa6de840498fff7ddb46034e4909725741133dedf3
Instruction Fuzzy Hash: C191C876A147184BD304DE59CCC0259B3E2BBC8764F49C63CE8A897745E674EE49CB82

Function 6CBC32A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6df898f5583dda36bf1dec91ded43eedcdfc2e4071004e02a3734219c526d9
Instruction ID: c502f8a6d957f917e6e06b7407a734ef308ebbd9a5b4b9d52b7bffa7798444ac
Opcode Fuzzy Hash: 6e6df898f5583dda36bf1dec91ded43eedcdfc2e4071004e02a3734219c526d9
Instruction Fuzzy Hash: EC8108B2A183508FC314DF29D88095AF7E2BFC9748F46892DF988D7711E771E9158B82

Function 6CBE9030 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa8f5b1d4096bc6167df662caa78752cac598b2283f7a18071a3a5fd69bb725f
Instruction ID: d591a2b48cfba310134bf36629816df47d7d3c61c88cbb006ffba05d5caee5ff
Opcode Fuzzy Hash: fa8f5b1d4096bc6167df662caa78752cac598b2283f7a18071a3a5fd69bb725f
Instruction Fuzzy Hash: 1391AEB49093459FC308DF28C090A5ABBF1FF89748F508A6EE89997751D730E949CF46

Function 6CBC2CA6 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaac1fa95927537056fa748d1ed80cb4c36531cfe69fe86e380ee050db7f54d2
Instruction ID: 742ef73739e4ebf12590b231fb7567caf38ce85300f8d8603a0c59aef9f7be93
Opcode Fuzzy Hash: aaac1fa95927537056fa748d1ed80cb4c36531cfe69fe86e380ee050db7f54d2
Instruction Fuzzy Hash: 1A51753090C3A44AE3159F6F48D412EFFE1AFC6301F884A6EF5E443392D5B89515DBAA

Function 6CBC2CA0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 272e95a2e8b5fe4e3c1bd1ca3ed72525b176b188f2fefa5a8ad79b88aa85a3fb
Instruction ID: 7631c59b3a8980df2e90739b8d11ff7c130af9ec535f8c516fe4de7754e2529e
Opcode Fuzzy Hash: 272e95a2e8b5fe4e3c1bd1ca3ed72525b176b188f2fefa5a8ad79b88aa85a3fb
Instruction Fuzzy Hash: 7351557090C3A44AE3159F6F48D402AFFE1ABC6301F884A6EF5E443392D5B89515DBAA

Function 6CBED9C5 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85d0cd2b4268e348907ad58339b5c3bf2721623310771fec8e465966ae2bc838
Instruction ID: b4ab71fb05610ec14120b6d351fd90d932198f400d487185e61dd2d75d209661
Opcode Fuzzy Hash: 85d0cd2b4268e348907ad58339b5c3bf2721623310771fec8e465966ae2bc838
Instruction Fuzzy Hash: 40516AB56093228FD318DF69C490A1AB7E0FF88A44F05867CDD599B391E771E846CBC2

Function 6CBCBE90 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b83f628b4a2d815fea37dfb3f46b2844ce99749977855ecca530945c6bf8daf
Instruction ID: 3e1cdec6f11e7224d28a81b2a0cc4785bd8ff9d36df2e9d7d37bfc7bd47614dd
Opcode Fuzzy Hash: 1b83f628b4a2d815fea37dfb3f46b2844ce99749977855ecca530945c6bf8daf
Instruction Fuzzy Hash: E641B471A08B448FC306DF79C49021AB3E5FFCA384F54872DE94A6B752EB359846CB42

Function 6CBCFBC0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60623e1a2689efe9e02d257ee7e8f0bdb6e0ca9269f6193efd5d45937623837c
Instruction ID: b6952e644b49dd8ad9da27a4c234264bd87de194cbea3374a2a46875e6033be5
Opcode Fuzzy Hash: 60623e1a2689efe9e02d257ee7e8f0bdb6e0ca9269f6193efd5d45937623837c
Instruction Fuzzy Hash: A931547391975D8BD300AF498C40249F7E2AFD0B20F5E8A5ED99457701EBB0AA15CBC7

Function 6CBC90F0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e9f94e6b07229623e1911694295697fc55129611c4866871330fd94b03d0e5
Instruction ID: bfe6c61f0dad655d4d3247aa24dca291df25c3b4c461c0cd59da91b81b2fa038
Opcode Fuzzy Hash: 22e9f94e6b07229623e1911694295697fc55129611c4866871330fd94b03d0e5
Instruction Fuzzy Hash: 0021C531B442518BE708CF39C8D112AB7F3EBCA714B45856CD555C7B64EA34A80AC747

Function 6CBF1C90 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be2e70c7bf0aae330f00d2dcf17b518dbd595471bcd1465edc0497c742519a5c
Instruction ID: b3bf0bda73f3273ddf36b49f79995c5894263dc9cb7ea8f8c1b8cc3f17a76538
Opcode Fuzzy Hash: be2e70c7bf0aae330f00d2dcf17b518dbd595471bcd1465edc0497c742519a5c
Instruction Fuzzy Hash: 42116DB46083808FD705CF24C4A06A9BBB5EF86308F484C5CD5A95BB91D779985ECB52

Function 6CC27280 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab66757eb0852dd57cae4b81c339f91581d33917df794fc82efff6dc9bb045a7
Instruction ID: 43a714c968565d3465eafd0772ef4d6aafe20f8d9fb433fd8b7222eb15348d99
Opcode Fuzzy Hash: ab66757eb0852dd57cae4b81c339f91581d33917df794fc82efff6dc9bb045a7
Instruction Fuzzy Hash: 7311EDB4700B118FD398DF59C0D4E65B3E1FB8C200B4A81BDDB0E8B766D670A855DB85

Function 6CC2C0C0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f8059239d5ae3978bf221770c22c555b6134e53790376c1a3bb4381fddbc3e
Instruction ID: 5385253f27970c2f06557cdfe76a5fa30fd391ad1625c6639ea36b89c0d03652
Opcode Fuzzy Hash: 07f8059239d5ae3978bf221770c22c555b6134e53790376c1a3bb4381fddbc3e
Instruction Fuzzy Hash: 75C08CB080A352ADF310CB1CC10030AFEE09B81300F80C089A28842600D23CC2808704

Function 6CC564A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6CC5652D

Strings

Address %p has no image-section, xrefs: 6CC565DB
@, xrefs: 6CC56578
VirtualProtect failed with code 0x%x, xrefs: 6CC5659A
VirtualQuery failed for %d bytes at address %p, xrefs: 6CC565C7

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section
API String ID: 1804819252-1098444051
Opcode ID: 8b9cc24857357d50a010a36592756a24508d54ec3270d599ff08ad69ee3564fc
Instruction ID: fd04c84bbcc6d70f8bd9fc2cc852e626488a9bc08ed56fd09dc83d2356f01eba
Opcode Fuzzy Hash: 8b9cc24857357d50a010a36592756a24508d54ec3270d599ff08ad69ee3564fc
Instruction Fuzzy Hash: F34180B2A057018FE700EF69D48464AFBF4FF85314F958629DA888B714E734E864CB96

Function 6CC55CB0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 6CC55CD2
InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC55D89), ref: 6CC55CEB
fwrite.MSVCRT ref: 6CC55D20
abort.MSVCRT ref: 6CC55D25

Strings

=, xrefs: 6CC55D05
runtime: failed to create runtime initialization wait event., xrefs: 6CC55D19

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: CreateCriticalEventInitializeSectionabortfwrite
String ID: =$runtime: failed to create runtime initialization wait event.
API String ID: 2455830200-3519180978
Opcode ID: d802ac2bf98aa3c1dc657b51362b74c4f53417787c04e8fd4ba48706cc2a3196
Instruction ID: c15f7c8184fdb659ef75978eb8d3f992151a4ee9f21d20db96ddb60c99a44add
Opcode Fuzzy Hash: d802ac2bf98aa3c1dc657b51362b74c4f53417787c04e8fd4ba48706cc2a3196
Instruction Fuzzy Hash: C3F019B15043019FF700BF68C10931ABAF4BF81308F81885DD99886650E7BDD4A88B93

Function 6CBC1020 Relevance: 9.1, APIs: 6, Instructions: 112sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,6CBC12E0,?,?,?,?,?,?,6CBC13A3), ref: 6CBC1057
_amsg_exit.MSVCRT ref: 6CBC1085

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 9740576ceb414a539968085d64a6f2a9dbc44c4ffc288682d224dff31de7e19e
Instruction ID: 726477a6bbfef752440c11a0654211ab3e417f77c43b4e99939df7c814639bb2
Opcode Fuzzy Hash: 9740576ceb414a539968085d64a6f2a9dbc44c4ffc288682d224dff31de7e19e
Instruction Fuzzy Hash: F4418FB17092808BF700BF6DC98175AB7F8EB82348F54852ED6849BB04D779C894CB83

Function 6CC570C0 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6CC570D9
_unlock.MSVCRT ref: 6CC57101
calloc.MSVCRT ref: 6CC5714F

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: 4d3c068b07ec5fce6d9273f5b487f9c815bb7a17f2cdc34182bbc4932eb09fa6
Instruction ID: 10c9be62959cbef18b1064826691bfe1a393e1b78623210a4f235f578aeecb9d
Opcode Fuzzy Hash: 4d3c068b07ec5fce6d9273f5b487f9c815bb7a17f2cdc34182bbc4932eb09fa6
Instruction Fuzzy Hash: F2117C70124200CFE7009F28C88075A7BE0BF85314F94CA69E898CBB84FB78D8B5DB56

Function 6CC55DE0 Relevance: 7.5, APIs: 5, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 6CC55E10
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC545D9), ref: 6CC55E1C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CC545D9), ref: 6CC55E2E
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC545D9), ref: 6CC55E3E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC545D9), ref: 6CC55E50

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID:
API String ID: 1755037574-0
Opcode ID: 7c9bbb3886b85fe59f9060dec525bfdc5e313cf0b6e8d44d66b42da333a8414b
Instruction ID: 8354057257834e3e9f46b398b591050de2ac8e3cac2c2fb40d13873a00ac9274
Opcode Fuzzy Hash: 7c9bbb3886b85fe59f9060dec525bfdc5e313cf0b6e8d44d66b42da333a8414b
Instruction Fuzzy Hash: BB015271604304CFEB00BF79958551ABBB8BF86214F410969DA9047750E735E878CB93

Function 6CC57220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6CC5724F
vfprintf.MSVCRT ref: 6CC5726F
abort.MSVCRT ref: 6CC57274

Strings

Mingw-w64 runtime failure:, xrefs: 6CC57248

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: abortfwritevfprintf
String ID: Mingw-w64 runtime failure:
API String ID: 3176311984-2889761391
Opcode ID: 54634b9a39d585648a2f2b541c0dad25e95fedd872b6a8bceb16b38ed53b6ab4
Instruction ID: 842e688759cc172f8808559582d4b960c77456677456ff2de5455b7fe58609a5
Opcode Fuzzy Hash: 54634b9a39d585648a2f2b541c0dad25e95fedd872b6a8bceb16b38ed53b6ab4
Instruction Fuzzy Hash: 62E0C2B0418304DED300AF68C58529EBBE4AF85348F81CA1CE0C847B51E77984A9AB57

Function 6CC565F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBC12A5), ref: 6CC56709

Strings

Unknown pseudo relocation bit size %d., xrefs: 6CC56799
Unknown pseudo relocation protocol version %d., xrefs: 6CC56864

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 9421155623fe2b39b31341538ac9808467cae6a34e540451aae3c3c14c78e0e3
Instruction ID: 0588385f77d58738a7d8d1dc52377f799b9feca201706a4da0e2e883c614543a
Opcode Fuzzy Hash: 9421155623fe2b39b31341538ac9808467cae6a34e540451aae3c3c14c78e0e3
Instruction Fuzzy Hash: 4E61DB71B0060A8FDB04DFA8C480659B7B9FB85318BA5826DD944DBB50F730E8268B89

Function 6CC56870 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6CC5687E
TlsGetValue.KERNEL32 ref: 6CC568A5
GetLastError.KERNEL32 ref: 6CC568AC
LeaveCriticalSection.KERNEL32 ref: 6CC568CC

Memory Dump Source

Source File: 00000003.00000002.1693073604.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.1693037124.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693184432.000000006CC58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693269852.000000006CC59000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693288710.000000006CC5A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693369371.000000006CC5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693496426.000000006CD08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1693688251.000000006CD13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694097196.000000006CD26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694198985.000000006CD2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694232224.000000006CD2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1694259577.000000006CD31000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 9f79f2f9ea21018963c12a8c17e4b630f26bfb427a90b16f4876f5825573c316
Instruction ID: b8b8b83d08b75bab09dc1f299fb271c38880bbc1509bf39fa17d227ad98de952
Opcode Fuzzy Hash: 9f79f2f9ea21018963c12a8c17e4b630f26bfb427a90b16f4876f5825573c316
Instruction Fuzzy Hash: 17F0A472A006048FFB107F7DC48991B7BB8EE85258B050528DF858B715E734E828CBE3

Analysis Process: rundll32.exePID: 7944, Parent PID: 7520COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 6CEBCEA0 Relevance: 1.5, APIs: 1, Instructions: 21
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 6CEBCEC8

Memory Dump Source

Source File: 0000000C.00000002.1789793745.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000C.00000002.1789707181.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1789986192.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790056074.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790193963.000000006CEEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790400231.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790591621.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790770097.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790821486.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790957309.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1791079702.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ce50000_rundll32.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction ID: cc1fd6f89c73f8a98e1b2069f6d4417007aaf94528f940ba60e9211019e91e5c
Opcode Fuzzy Hash: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction Fuzzy Hash: 12E0E571505600CFCB15DF18C2C1316BBF1EB48A00F1485A8DE099FB4AD734ED10CB92

Non-executed Functions

Function 6CEE6300 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6CEE634F
UnhandledExceptionFilter.KERNEL32 ref: 6CEE635F
GetCurrentProcess.KERNEL32 ref: 6CEE6368
TerminateProcess.KERNEL32 ref: 6CEE6379
abort.MSVCRT ref: 6CEE6382

Memory Dump Source

Source File: 0000000C.00000002.1789793745.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000C.00000002.1789707181.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1789986192.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790056074.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790193963.000000006CEEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790400231.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790591621.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790770097.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790821486.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790957309.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1791079702.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ce50000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 3b7654b83c75ac53d661f006c5af1b88b835997dc3444485bd9f28f3e30cffc9
Instruction ID: c01115e0885c00cd184b16fc268a86b7522e78174af1159d00ae36f0470d0b4e
Opcode Fuzzy Hash: 3b7654b83c75ac53d661f006c5af1b88b835997dc3444485bd9f28f3e30cffc9
Instruction Fuzzy Hash: 291113B5E04705CFCB80EF69C18971ABBF0FB4A344F108969E988C7350E73499448F96

Function 6CE51020 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,6CE512E0,?,?,?,?,?,?,6CE513A3), ref: 6CE51057
_amsg_exit.MSVCRT ref: 6CE51085

Strings

cl, xrefs: 6CE51115

Memory Dump Source

Source File: 0000000C.00000002.1789793745.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000C.00000002.1789707181.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1789986192.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790056074.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790193963.000000006CEEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790400231.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790591621.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790770097.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790821486.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790957309.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1791079702.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ce50000_rundll32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID: cl
API String ID: 1015461914-3294154526
Opcode ID: 105f4ab4b984f6677e7ef37609b74566e95a611b511b0e55999915560b970f04
Instruction ID: 034096a6772501d96a07f07996debac76ff4f777cc6a4c15796b8aa2b2d1c7fc
Opcode Fuzzy Hash: 105f4ab4b984f6677e7ef37609b74566e95a611b511b0e55999915560b970f04
Instruction Fuzzy Hash: E141C372B18240CBEB81AFAEC58174B77F0EB82388FB0456ED9448B704D736C491CB92

Function 6CEE64A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6CEE652D

Strings

VirtualProtect failed with code 0x%x, xrefs: 6CEE659A
@, xrefs: 6CEE6578
VirtualQuery failed for %d bytes at address %p, xrefs: 6CEE65C7
Address %p has no image-section, xrefs: 6CEE65DB

Memory Dump Source

Source File: 0000000C.00000002.1789793745.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000C.00000002.1789707181.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1789986192.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790056074.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790193963.000000006CEEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790400231.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790591621.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790770097.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790821486.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790957309.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1791079702.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ce50000_rundll32.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section
API String ID: 1804819252-1098444051
Opcode ID: 5ff91f0c9b6148873dd2d671024b80ef246915b2c42c1634c3f438b3972dab32
Instruction ID: dd3f0d7ed7e687160b8016fc1e31df1c50635f46e8aa1651c8ccc606db051bf9
Opcode Fuzzy Hash: 5ff91f0c9b6148873dd2d671024b80ef246915b2c42c1634c3f438b3972dab32
Instruction Fuzzy Hash: E1418DB2A053058FDB00DF69D4C464AFBF4FB89358F258A6DD9988B714E730E409CB92

Function 6CE513E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6CE513F0
LoadLibraryA.KERNEL32 ref: 6CE51406
GetProcAddress.KERNEL32 ref: 6CE51425
GetProcAddress.KERNEL32 ref: 6CE51437

Strings

libgcc_s_dw2-1.dll, xrefs: 6CE513E9, 6CE513FF
__deregister_frame_info, xrefs: 6CE5142C
__register_frame_info, xrefs: 6CE5141A

Memory Dump Source

Source File: 0000000C.00000002.1789793745.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000C.00000002.1789707181.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1789986192.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790056074.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790193963.000000006CEEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790400231.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790591621.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790770097.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790821486.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790957309.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1791079702.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ce50000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: c3659649ce7009242c75df2d62695a6eb2535277adac0d8632141cab2de32a8c
Instruction ID: 749d889f86ff93c408eba43b8ccd5c815ce1620b9e78d04d6e7c74fc5168a41f
Opcode Fuzzy Hash: c3659649ce7009242c75df2d62695a6eb2535277adac0d8632141cab2de32a8c
Instruction Fuzzy Hash: F6019AB2D093008BDB50BFB8AA4731EBFF4AB46284F22492DD88887714D7319414CBA3

Function 6CEE5CB0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 6CEE5CD2
InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CEE5D89), ref: 6CEE5CEB
fwrite.MSVCRT ref: 6CEE5D20
abort.MSVCRT ref: 6CEE5D25

Strings

runtime: failed to create runtime initialization wait event., xrefs: 6CEE5D19
=, xrefs: 6CEE5D05

Memory Dump Source

Source File: 0000000C.00000002.1789793745.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000C.00000002.1789707181.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1789986192.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790056074.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790193963.000000006CEEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790400231.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790591621.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790770097.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790821486.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790957309.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1791079702.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ce50000_rundll32.jbxd

Similarity

API ID: CreateCriticalEventInitializeSectionabortfwrite
String ID: =$runtime: failed to create runtime initialization wait event.
API String ID: 2455830200-3519180978
Opcode ID: 34fe00138458d92a0e18d9eecd174d7b12014dcb14060c6c5c1026fb1df6c5e4
Instruction ID: 4986bece4cc691b4b1a71c31cf8788a6580613f8f90560d96e221195fc361204
Opcode Fuzzy Hash: 34fe00138458d92a0e18d9eecd174d7b12014dcb14060c6c5c1026fb1df6c5e4
Instruction Fuzzy Hash: 30F037B09053019FE780BF68C10931FBBF0BF45348FA5885CE8988B641EB7980488FA3

Function 6CEE70C0 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6CEE70D9
_unlock.MSVCRT ref: 6CEE7101
calloc.MSVCRT ref: 6CEE714F

Memory Dump Source

Source File: 0000000C.00000002.1789793745.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000C.00000002.1789707181.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1789986192.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790056074.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790193963.000000006CEEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790400231.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790591621.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790770097.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790821486.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790957309.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1791079702.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ce50000_rundll32.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: 4d3c068b07ec5fce6d9273f5b487f9c815bb7a17f2cdc34182bbc4932eb09fa6
Instruction ID: f03b32aafdbb97f0a4340052635349fa9c27d485feb15ae646d5711ce8eaa0b8
Opcode Fuzzy Hash: 4d3c068b07ec5fce6d9273f5b487f9c815bb7a17f2cdc34182bbc4932eb09fa6
Instruction Fuzzy Hash: DD110AB11053018BE7409F68D98075A7BF4FF4E398F248A6DE498CBB86EB74D845CB52

Function 6CEE6250 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 6CEE6289
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE513B9), ref: 6CEE629A
GetCurrentThreadId.KERNEL32 ref: 6CEE62A2
GetTickCount.KERNEL32 ref: 6CEE62AA
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE513B9), ref: 6CEE62B9

Memory Dump Source

Source File: 0000000C.00000002.1789793745.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000C.00000002.1789707181.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1789986192.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790056074.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790193963.000000006CEEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790400231.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790591621.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790770097.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790821486.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790957309.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1791079702.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ce50000_rundll32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 85c9013e550e1c3c051574f932a939cdabc9ad8df0fb485dbef277777bb35981
Instruction ID: 2fdcfd6ff609a7306806e8929d6327c1631fd6df9a0cafeb04d322d71649104b
Opcode Fuzzy Hash: 85c9013e550e1c3c051574f932a939cdabc9ad8df0fb485dbef277777bb35981
Instruction Fuzzy Hash: D91166B1A157008BCB40DF79E48864BBBF4FB8D2A4F040D3AE544C7300EB3494488BC2

Function 6CEE5DE0 Relevance: 7.5, APIs: 5, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 6CEE5E10
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CEE45D9), ref: 6CEE5E1C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CEE45D9), ref: 6CEE5E2E
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CEE45D9), ref: 6CEE5E3E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CEE45D9), ref: 6CEE5E50

Memory Dump Source

Source File: 0000000C.00000002.1789793745.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000C.00000002.1789707181.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1789986192.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790056074.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790193963.000000006CEEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790400231.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790591621.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790770097.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790821486.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790957309.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1791079702.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ce50000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID:
API String ID: 1755037574-0
Opcode ID: 89f2d760b6b3e3c61e758d4c95ea8142a1d38195142a944f80a0562bceb4d234
Instruction ID: d1077880f0be8df8cb907f49e7655166975a3c06af03fc2d89a3f22a4ab04403
Opcode Fuzzy Hash: 89f2d760b6b3e3c61e758d4c95ea8142a1d38195142a944f80a0562bceb4d234
Instruction Fuzzy Hash: 0A015271A14308CFDA00BF79998551FBBB4BF46354FA5052DE8D447260D731A468CBA3

Function 6CEE7220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6CEE724F
vfprintf.MSVCRT ref: 6CEE726F
abort.MSVCRT ref: 6CEE7274

Strings

Mingw-w64 runtime failure:, xrefs: 6CEE7248

Memory Dump Source

Source File: 0000000C.00000002.1789793745.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000C.00000002.1789707181.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1789986192.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790056074.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790193963.000000006CEEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790400231.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790591621.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790770097.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790821486.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790957309.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1791079702.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ce50000_rundll32.jbxd

Similarity

API ID: abortfwritevfprintf
String ID: Mingw-w64 runtime failure:
API String ID: 3176311984-2889761391
Opcode ID: db2d2f6114ded74b73d37f739c8502e8544595bf1583ba452133edaae905304d
Instruction ID: d64e8135094fc225e4d916ad623738d8736837200b3cb8f775c5e8ccfaebaf13
Opcode Fuzzy Hash: db2d2f6114ded74b73d37f739c8502e8544595bf1583ba452133edaae905304d
Instruction Fuzzy Hash: 65E0C2B000C3049FD300AF64C08529EBBF4AF89388F61891CE0C84BB56D77984898B53

Function 6CEE65F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE512A5), ref: 6CEE6709

Strings

Unknown pseudo relocation bit size %d., xrefs: 6CEE6799
Unknown pseudo relocation protocol version %d., xrefs: 6CEE6864

Memory Dump Source

Source File: 0000000C.00000002.1789793745.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000C.00000002.1789707181.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1789986192.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790056074.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790193963.000000006CEEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790400231.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790591621.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790770097.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790821486.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790957309.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1791079702.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ce50000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: b699733f6c2b48a57f39da52a8f185667d3e17522307924164891d8a921b402c
Instruction ID: bd5e82d00150ed844f1a53ff568093abfa399a0358551f36e7d1a2ab595e5716
Opcode Fuzzy Hash: b699733f6c2b48a57f39da52a8f185667d3e17522307924164891d8a921b402c
Instruction Fuzzy Hash: BD61E471E1420EDFCF48DF68C5C0A49B7BAFB89358F748629DA04DBB04D371A9468B81

Function 6CEE6870 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6CEE687E
TlsGetValue.KERNEL32 ref: 6CEE68A5
GetLastError.KERNEL32 ref: 6CEE68AC
LeaveCriticalSection.KERNEL32 ref: 6CEE68CC

Memory Dump Source

Source File: 0000000C.00000002.1789793745.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000C.00000002.1789707181.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1789986192.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790056074.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790193963.000000006CEEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790400231.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790591621.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790649870.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790770097.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790821486.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1790957309.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1791079702.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ce50000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 57572d4b1d39fdfd145aeab56f9f852edcfb0268e6818d6a2a21bda2b53b5ba3
Instruction ID: 80489019cb455db9818c951ea9861145c0516c5c39a042d66ba5a27ed17846f3
Opcode Fuzzy Hash: 57572d4b1d39fdfd145aeab56f9f852edcfb0268e6818d6a2a21bda2b53b5ba3
Instruction Fuzzy Hash: 28F0A476E006088FDB007F7DC4C9A1B7BB8EA49398B150668DE4487305E730A418CBE7

Analysis Process: rundll32.exePID: 8060, Parent PID: 7520COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 6CEBCEA0 Relevance: 1.3, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 6CEBCEC8

Memory Dump Source

Source File: 0000000F.00000002.1785682159.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000F.00000002.1785580350.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786030618.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786134351.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786232243.000000006CEED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786334506.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786939023.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787391940.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787474243.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787585495.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787684115.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6ce50000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction ID: cc1fd6f89c73f8a98e1b2069f6d4417007aaf94528f940ba60e9211019e91e5c
Opcode Fuzzy Hash: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction Fuzzy Hash: 12E0E571505600CFCB15DF18C2C1316BBF1EB48A00F1485A8DE099FB4AD734ED10CB92

Non-executed Functions

Function 6CEE6300 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6CEE634F
UnhandledExceptionFilter.KERNEL32 ref: 6CEE635F
GetCurrentProcess.KERNEL32 ref: 6CEE6368
TerminateProcess.KERNEL32 ref: 6CEE6379
abort.MSVCRT ref: 6CEE6382

Memory Dump Source

Source File: 0000000F.00000002.1785682159.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000F.00000002.1785580350.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786030618.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786134351.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786232243.000000006CEED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786334506.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786939023.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787391940.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787474243.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787585495.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787684115.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6ce50000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 3b7654b83c75ac53d661f006c5af1b88b835997dc3444485bd9f28f3e30cffc9
Instruction ID: c01115e0885c00cd184b16fc268a86b7522e78174af1159d00ae36f0470d0b4e
Opcode Fuzzy Hash: 3b7654b83c75ac53d661f006c5af1b88b835997dc3444485bd9f28f3e30cffc9
Instruction Fuzzy Hash: 291113B5E04705CFCB80EF69C18971ABBF0FB4A344F108969E988C7350E73499448F96

Function 6CE51020 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,6CE512E0,?,?,?,?,?,?,6CE513A3), ref: 6CE51057
_amsg_exit.MSVCRT ref: 6CE51085

Strings

cl, xrefs: 6CE51115

Memory Dump Source

Source File: 0000000F.00000002.1785682159.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000F.00000002.1785580350.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786030618.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786134351.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786232243.000000006CEED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786334506.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786939023.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787391940.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787474243.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787585495.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787684115.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6ce50000_rundll32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID: cl
API String ID: 1015461914-3294154526
Opcode ID: 105f4ab4b984f6677e7ef37609b74566e95a611b511b0e55999915560b970f04
Instruction ID: 034096a6772501d96a07f07996debac76ff4f777cc6a4c15796b8aa2b2d1c7fc
Opcode Fuzzy Hash: 105f4ab4b984f6677e7ef37609b74566e95a611b511b0e55999915560b970f04
Instruction Fuzzy Hash: E141C372B18240CBEB81AFAEC58174B77F0EB82388FB0456ED9448B704D736C491CB92

Function 6CEE64A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6CEE652D

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 6CEE65C7
VirtualProtect failed with code 0x%x, xrefs: 6CEE659A
@, xrefs: 6CEE6578
Address %p has no image-section, xrefs: 6CEE65DB

Memory Dump Source

Source File: 0000000F.00000002.1785682159.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000F.00000002.1785580350.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786030618.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786134351.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786232243.000000006CEED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786334506.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786939023.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787391940.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787474243.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787585495.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787684115.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6ce50000_rundll32.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section
API String ID: 1804819252-1098444051
Opcode ID: 5ff91f0c9b6148873dd2d671024b80ef246915b2c42c1634c3f438b3972dab32
Instruction ID: dd3f0d7ed7e687160b8016fc1e31df1c50635f46e8aa1651c8ccc606db051bf9
Opcode Fuzzy Hash: 5ff91f0c9b6148873dd2d671024b80ef246915b2c42c1634c3f438b3972dab32
Instruction Fuzzy Hash: E1418DB2A053058FDB00DF69D4C464AFBF4FB89358F258A6DD9988B714E730E409CB92

Function 6CE513E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6CE513F0
LoadLibraryA.KERNEL32 ref: 6CE51406
GetProcAddress.KERNEL32 ref: 6CE51425
GetProcAddress.KERNEL32 ref: 6CE51437

Strings

libgcc_s_dw2-1.dll, xrefs: 6CE513E9, 6CE513FF
__register_frame_info, xrefs: 6CE5141A
__deregister_frame_info, xrefs: 6CE5142C

Memory Dump Source

Source File: 0000000F.00000002.1785682159.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000F.00000002.1785580350.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786030618.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786134351.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786232243.000000006CEED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786334506.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786939023.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787391940.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787474243.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787585495.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787684115.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6ce50000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: c3659649ce7009242c75df2d62695a6eb2535277adac0d8632141cab2de32a8c
Instruction ID: 749d889f86ff93c408eba43b8ccd5c815ce1620b9e78d04d6e7c74fc5168a41f
Opcode Fuzzy Hash: c3659649ce7009242c75df2d62695a6eb2535277adac0d8632141cab2de32a8c
Instruction Fuzzy Hash: F6019AB2D093008BDB50BFB8AA4731EBFF4AB46284F22492DD88887714D7319414CBA3

Function 6CEE5CB0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 6CEE5CD2
InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CEE5D89), ref: 6CEE5CEB
fwrite.MSVCRT ref: 6CEE5D20
abort.MSVCRT ref: 6CEE5D25

Strings

runtime: failed to create runtime initialization wait event., xrefs: 6CEE5D19
=, xrefs: 6CEE5D05

Memory Dump Source

Source File: 0000000F.00000002.1785682159.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000F.00000002.1785580350.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786030618.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786134351.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786232243.000000006CEED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786334506.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786939023.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787391940.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787474243.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787585495.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787684115.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6ce50000_rundll32.jbxd

Similarity

API ID: CreateCriticalEventInitializeSectionabortfwrite
String ID: =$runtime: failed to create runtime initialization wait event.
API String ID: 2455830200-3519180978
Opcode ID: 34fe00138458d92a0e18d9eecd174d7b12014dcb14060c6c5c1026fb1df6c5e4
Instruction ID: 4986bece4cc691b4b1a71c31cf8788a6580613f8f90560d96e221195fc361204
Opcode Fuzzy Hash: 34fe00138458d92a0e18d9eecd174d7b12014dcb14060c6c5c1026fb1df6c5e4
Instruction Fuzzy Hash: 30F037B09053019FE780BF68C10931FBBF0BF45348FA5885CE8988B641EB7980488FA3

Function 6CEE70C0 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6CEE70D9
_unlock.MSVCRT ref: 6CEE7101
calloc.MSVCRT ref: 6CEE714F

Memory Dump Source

Source File: 0000000F.00000002.1785682159.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000F.00000002.1785580350.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786030618.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786134351.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786232243.000000006CEED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786334506.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786939023.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787391940.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787474243.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787585495.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787684115.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6ce50000_rundll32.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: 4d3c068b07ec5fce6d9273f5b487f9c815bb7a17f2cdc34182bbc4932eb09fa6
Instruction ID: f03b32aafdbb97f0a4340052635349fa9c27d485feb15ae646d5711ce8eaa0b8
Opcode Fuzzy Hash: 4d3c068b07ec5fce6d9273f5b487f9c815bb7a17f2cdc34182bbc4932eb09fa6
Instruction Fuzzy Hash: DD110AB11053018BE7409F68D98075A7BF4FF4E398F248A6DE498CBB86EB74D845CB52

Function 6CEE6250 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 6CEE6289
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE513B9), ref: 6CEE629A
GetCurrentThreadId.KERNEL32 ref: 6CEE62A2
GetTickCount.KERNEL32 ref: 6CEE62AA
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE513B9), ref: 6CEE62B9

Memory Dump Source

Source File: 0000000F.00000002.1785682159.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000F.00000002.1785580350.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786030618.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786134351.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786232243.000000006CEED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786334506.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786939023.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787391940.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787474243.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787585495.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787684115.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6ce50000_rundll32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 85c9013e550e1c3c051574f932a939cdabc9ad8df0fb485dbef277777bb35981
Instruction ID: 2fdcfd6ff609a7306806e8929d6327c1631fd6df9a0cafeb04d322d71649104b
Opcode Fuzzy Hash: 85c9013e550e1c3c051574f932a939cdabc9ad8df0fb485dbef277777bb35981
Instruction Fuzzy Hash: D91166B1A157008BCB40DF79E48864BBBF4FB8D2A4F040D3AE544C7300EB3494488BC2

Function 6CEE5DE0 Relevance: 7.5, APIs: 5, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 6CEE5E10
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CEE45D9), ref: 6CEE5E1C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CEE45D9), ref: 6CEE5E2E
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CEE45D9), ref: 6CEE5E3E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CEE45D9), ref: 6CEE5E50

Memory Dump Source

Source File: 0000000F.00000002.1785682159.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000F.00000002.1785580350.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786030618.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786134351.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786232243.000000006CEED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786334506.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786939023.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787391940.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787474243.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787585495.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787684115.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6ce50000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID:
API String ID: 1755037574-0
Opcode ID: 89f2d760b6b3e3c61e758d4c95ea8142a1d38195142a944f80a0562bceb4d234
Instruction ID: d1077880f0be8df8cb907f49e7655166975a3c06af03fc2d89a3f22a4ab04403
Opcode Fuzzy Hash: 89f2d760b6b3e3c61e758d4c95ea8142a1d38195142a944f80a0562bceb4d234
Instruction Fuzzy Hash: 0A015271A14308CFDA00BF79998551FBBB4BF46354FA5052DE8D447260D731A468CBA3

Function 6CEE7220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6CEE724F
vfprintf.MSVCRT ref: 6CEE726F
abort.MSVCRT ref: 6CEE7274

Strings

Mingw-w64 runtime failure:, xrefs: 6CEE7248

Memory Dump Source

Source File: 0000000F.00000002.1785682159.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000F.00000002.1785580350.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786030618.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786134351.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786232243.000000006CEED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786334506.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786939023.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787391940.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787474243.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787585495.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787684115.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6ce50000_rundll32.jbxd

Similarity

API ID: abortfwritevfprintf
String ID: Mingw-w64 runtime failure:
API String ID: 3176311984-2889761391
Opcode ID: db2d2f6114ded74b73d37f739c8502e8544595bf1583ba452133edaae905304d
Instruction ID: d64e8135094fc225e4d916ad623738d8736837200b3cb8f775c5e8ccfaebaf13
Opcode Fuzzy Hash: db2d2f6114ded74b73d37f739c8502e8544595bf1583ba452133edaae905304d
Instruction Fuzzy Hash: 65E0C2B000C3049FD300AF64C08529EBBF4AF89388F61891CE0C84BB56D77984898B53

Function 6CEE65F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE512A5), ref: 6CEE6709

Strings

Unknown pseudo relocation bit size %d., xrefs: 6CEE6799
Unknown pseudo relocation protocol version %d., xrefs: 6CEE6864

Memory Dump Source

Source File: 0000000F.00000002.1785682159.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000F.00000002.1785580350.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786030618.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786134351.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786232243.000000006CEED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786334506.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786939023.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787391940.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787474243.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787585495.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787684115.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6ce50000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: b699733f6c2b48a57f39da52a8f185667d3e17522307924164891d8a921b402c
Instruction ID: bd5e82d00150ed844f1a53ff568093abfa399a0358551f36e7d1a2ab595e5716
Opcode Fuzzy Hash: b699733f6c2b48a57f39da52a8f185667d3e17522307924164891d8a921b402c
Instruction Fuzzy Hash: BD61E471E1420EDFCF48DF68C5C0A49B7BAFB89358F748629DA04DBB04D371A9468B81

Function 6CEE6870 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6CEE687E
TlsGetValue.KERNEL32 ref: 6CEE68A5
GetLastError.KERNEL32 ref: 6CEE68AC
LeaveCriticalSection.KERNEL32 ref: 6CEE68CC

Memory Dump Source

Source File: 0000000F.00000002.1785682159.000000006CE51000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CE50000, based on PE: true

Associated: 0000000F.00000002.1785580350.000000006CE50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786030618.000000006CEE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786134351.000000006CEE9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786232243.000000006CEED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786334506.000000006CEEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1786939023.000000006CF98000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CF9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787128216.000000006CFA3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787391940.000000006CFB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787474243.000000006CFBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787585495.000000006CFBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1787684115.000000006CFC1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6ce50000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 57572d4b1d39fdfd145aeab56f9f852edcfb0268e6818d6a2a21bda2b53b5ba3
Instruction ID: 80489019cb455db9818c951ea9861145c0516c5c39a042d66ba5a27ed17846f3
Opcode Fuzzy Hash: 57572d4b1d39fdfd145aeab56f9f852edcfb0268e6818d6a2a21bda2b53b5ba3
Instruction Fuzzy Hash: 28F0A476E006088FDB007F7DC4C9A1B7BB8EA49398B150668DE4487305E730A418CBE7

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report T681Aj3oN9.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Software Vulnerabilities

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exePID: 7520, Parent PID: 2580

General

Chronological Activities

Analysis Process: conhost.exePID: 7528, Parent PID: 7520

General

Chronological Activities

Analysis Process: cmd.exePID: 7576, Parent PID: 7520

General

Chronological Activities

Analysis Process: rundll32.exePID: 7584, Parent PID: 7520

Windows Analysis Report
T681Aj3oN9.dll

Function 6CC2CEA0 Relevance: 1.5, APIs: 1, Instructions: 21
fileCOMMON

Function 6CBD59F0 Relevance: 18.5, Strings: 14, Instructions: 1019
COMMON

Function 6CBE93F0 Relevance: 16.9, Strings: 13, Instructions: 643
COMMON

Function 6CBF1570 Relevance: 16.4, Strings: 13, Instructions: 150
COMMON

Function 6CBF2A90 Relevance: 14.0, Strings: 11, Instructions: 253
COMMON