Edit tour

Windows Analysis Report
dllhost.exe

Overview

General Information

Sample name:	dllhost.exe
Analysis ID:	1561842
MD5:	7549250ca5b7f98a08707dea4ffb06fc
SHA1:	5cc5fa87159c1f3d49fc262318e1d473deee1908
SHA256:	d90bf2a4dda2e45cf2406dec9e3252487029347d239121a388675cd7580f2f53
Tags:	exemineruser-Niki
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

Detected VMProtect packer

Found strings related to Crypto-Mining

Hides threads from debuggers

Machine Learning detection for sample

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Sigma detected: System File Execution Location Anomaly

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction (VM detection)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential time zone aware malware

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

dllhost.exe (PID: 5480 cmdline: "C:\Users\user\Desktop\dllhost.exe" MD5: 7549250CA5B7F98A08707DEA4FFB06FC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: dllhost.exe PID: 5480	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Sigma Signatures

System Summary

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\Desktop\dllhost.exe", CommandLine: "C:\Users\user\Desktop\dllhost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\dllhost.exe, NewProcessName: C:\Users\user\Desktop\dllhost.exe, OriginalFileName: C:\Users\user\Desktop\dllhost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\Desktop\dllhost.exe", ProcessId: 5480, ProcessName: dllhost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: dllhost.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: dllhost.exe

ReversingLabs: Detection: 87%

Machine Learning detection for sample

Source: dllhost.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dllhost.exe PID: 5480, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: dllhost.exe	String found in binary or memory: new job from stratum+tcp://
Source: dllhost.exe	String found in binary or memory: new job from stratum+tcp://

Source: dllhost.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dllhost.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FDF85C FindFirstFileW,FindClose,		0_2_00FDF85C
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FDF278 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,		0_2_00FDF278

Source: dllhost.exe, dllhost.exe, 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://online.drweb.com/result/
Source: dllhost.exe, dllhost.exe, 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, dllhost.exe, 00000000.00000003.1682531825.0000000003530000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/

System Summary

Detected VMProtect packer

Source: dllhost.exe

Static PE information: .vmp0 and .vmp1 section names

Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FDD7F0		0_2_00FDD7F0
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_014AD87F		0_2_014AD87F

Source: C:\Users\user\Desktop\dllhost.exe

Code function: String function: 014A9648 appears 35 times

Source: dllhost.exe

Static PE information: Number of sections : 13 > 10

Source: dllhost.exe, 00000000.00000002.1685545668.0000000001CB7000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilename7za.exe, vs dllhost.exe

Source: dllhost.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.evad.mine.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\dllhost.exe

Code function: 0_2_00FFA10C GetDiskFreeSpaceW,

0_2_00FFA10C

Source: C:\Users\user\Desktop\dllhost.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\dllhost.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: dllhost.exe

ReversingLabs: Detection: 87%

Source: dllhost.exe	String found in binary or memory: -Installation run additional miner, changed name exename
Source: dllhost.exe	String found in binary or memory: ISO_6937-2-add
Source: dllhost.exe	String found in binary or memory: -STOPPING:
Source: dllhost.exe	String found in binary or memory: -STARTING:
Source: dllhost.exe	String found in binary or memory: NATS-SEFI-ADD
Source: dllhost.exe	String found in binary or memory: NATS-DANO-ADD
Source: dllhost.exe	String found in binary or memory: -Installed today.
Source: dllhost.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: dllhost.exe	String found in binary or memory: jp-ocr-b-add
Source: dllhost.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: dllhost.exe	String found in binary or memory: jp-ocr-hand-add

Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Section loaded: sspicli.dll	Jump to behavior

Source: dllhost.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: dllhost.exe

Static file information: File size 6231040 > 1048576

Source: dllhost.exe

Static PE information: Raw size of .vmp1 is bigger than: 0x100000 < 0x5e2c00

Source: dllhost.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\dllhost.exe

Code function: 0_2_014B079B LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_014B079B

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp1

Source: dllhost.exe	Static PE information: section name: .didata
Source: dllhost.exe	Static PE information: section name: .vmp0
Source: dllhost.exe	Static PE information: section name: .vmp1

Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_0100A000 push ecx; mov dword ptr [esp], eax	0_2_0100A001
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_0100A030 push ecx; mov dword ptr [esp], eax	0_2_0100A031
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FFC174 push ecx; mov dword ptr [esp], ecx	0_2_00FFC175
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_0105436C push ecx; mov dword ptr [esp], eax	0_2_0105436E
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FFC268 push ecx; mov dword ptr [esp], ecx	0_2_00FFC269
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_0100E248 push ecx; mov dword ptr [esp], edx	0_2_0100E24A
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_0100E28C push ecx; mov dword ptr [esp], edx	0_2_0100E28E
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FFA36C push ecx; mov dword ptr [esp], ecx	0_2_00FFA370
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_0100E2B4 push ecx; mov dword ptr [esp], eax	0_2_0100E2B5
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FFA330 push ecx; mov dword ptr [esp], ecx	0_2_00FFA333
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_0100E540 push ecx; mov dword ptr [esp], edx	0_2_0100E541
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_01031540 push ecx; mov dword ptr [esp], edx	0_2_01031541
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_0101A55C push ecx; mov dword ptr [esp], ecx	0_2_0101A55F
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_0101643C push ecx; mov dword ptr [esp], eax	0_2_0101643D
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_01016454 push ecx; mov dword ptr [esp], eax	0_2_01016455
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_010324D8 push ecx; mov dword ptr [esp], eax	0_2_010324DA
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_01013764 push ecx; mov dword ptr [esp], edx	0_2_01013767
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FE0604 push ecx; mov dword ptr [esp], eax	0_2_00FE0609
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FE18C0 push ecx; mov dword ptr [esp], edx	0_2_00FE18C1
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_01016850 push ecx; mov dword ptr [esp], eax	0_2_01016851
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FD7938 push ecx; mov dword ptr [esp], eax	0_2_00FD7939
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_0100E8D0 push ecx; mov dword ptr [esp], edx	0_2_0100E8D2
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_01023A34 push ecx; mov dword ptr [esp], edx	0_2_01023A35
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FF8B74 push ecx; mov dword ptr [esp], ecx	0_2_00FF8B78
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_01032D10 push ecx; mov dword ptr [esp], eax	0_2_01032D11
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_01032D30 push ecx; mov dword ptr [esp], eax	0_2_01032D31
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_0104FC70 push ecx; mov dword ptr [esp], ecx	0_2_0104FC74
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FF9EDC push ecx; mov dword ptr [esp], eax	0_2_00FF9EDF
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FDCE48 push ecx; mov dword ptr [esp], edx	0_2_00FDCE49
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_01054FC8 push ecx; mov dword ptr [esp], edx	0_2_01054FC9
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FFBFAC push ecx; mov dword ptr [esp], ecx	0_2_00FFBFAF

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Desktop\dllhost.exe	Memory written: PID: 5480 base: 910007 value: E9 EB DF 62 76			Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Memory written: PID: 5480 base: 76F3DFF0 value: E9 1E 20 9D 89			Jump to behavior

Source: C:\Users\user\Desktop\dllhost.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dllhost.exe, dllhost.exe, 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp

Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\dllhost.exe	RDTSC instruction interceptor: First address: 1C85E56 second address: 1C85E62 instructions: 0x00000000 rdtsc 0x00000002 pop esi 0x00000003 pop ecx 0x00000004 cwde 0x00000005 cmovb di, bx 0x00000009 xchg dh, bh 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dllhost.exe	RDTSC instruction interceptor: First address: 14F9F7D second address: 14F9F89 instructions: 0x00000000 rdtsc 0x00000002 pop esi 0x00000003 pop ecx 0x00000004 cwde 0x00000005 cmovb di, bx 0x00000009 xchg dh, bh 0x0000000b pop ebx 0x0000000c rdtsc

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Users\user\Desktop\dllhost.exe

Special instruction interceptor: First address: 1C88680 instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Source: C:\Users\user\Desktop\dllhost.exe

API coverage: 7.7 %

Source: C:\Users\user\Desktop\dllhost.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FDF85C FindFirstFileW,FindClose,		0_2_00FDF85C
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_00FDF278 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,		0_2_00FDF278

Source: C:\Users\user\Desktop\dllhost.exe

Code function: 0_2_0102FF9C GetSystemInfo,

0_2_0102FF9C

Source: dllhost.exe, 00000000.00000002.1683417497.0000000000A08000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\dllhost.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\dllhost.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\dllhost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\dllhost.exe	Process queried: DebugObjectHandle			Jump to behavior

Source: C:\Users\user\Desktop\dllhost.exe

Code function: 0_2_014A9149 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_014A9149

Source: C:\Users\user\Desktop\dllhost.exe

0_2_014B079B

Source: C:\Users\user\Desktop\dllhost.exe

Code function: 0_2_00FD7238 GetProcessHeap,HeapFree,

0_2_00FD7238

Source: C:\Users\user\Desktop\dllhost.exe

Process token adjusted: Debug

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_014A9149 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_014A9149
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_014AE696 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_014AE696
Source: C:\Users\user\Desktop\dllhost.exe	Code function: 0_2_014A7F58 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_014A7F58

Source: C:\Users\user\Desktop\dllhost.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	0_2_00FDF9B4
Source: C:\Users\user\Desktop\dllhost.exe	Code function: EnumSystemLocalesW,	0_2_010045EC
Source: C:\Users\user\Desktop\dllhost.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00FDEE14
Source: C:\Users\user\Desktop\dllhost.exe	Code function: GetLocaleInfoW,	0_2_00FFEF8C
Source: C:\Users\user\Desktop\dllhost.exe	Code function: GetLocaleInfoA,	0_2_014AFA65

Source: C:\Users\user\Desktop\dllhost.exe

Code function: 0_2_00FFC7D4 GetLocalTime,

0_2_00FFC7D4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	1 Credential API Hooking	11 System Time Discovery	Remote Services	1 Credential API Hooking	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	431 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	214 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
dllhost.exe	88%	ReversingLabs	Win32.Trojan.HSMiner
dllhost.exe	100%	Avira	TR/AD.HSMinerDlder.absza
dllhost.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://online.drweb.com/result/	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://online.drweb.com/result/	dllhost.exe, dllhost.exe, 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.indyproject.org/	dllhost.exe, dllhost.exe, 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, dllhost.exe, 00000000.00000003.1682531825.0000000003530000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561842
Start date and time:	2024-11-24 13:10:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dllhost.exe
Detection:	MAL
Classification:	mal100.evad.mine.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

VT rate limit hit for: dllhost.exe

Simulations

Behavior and APIs

Time	Type	Description
07:11:02	API Interceptor	7x Sleep call for process: dllhost.exe modified

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.937876748576129
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	dllhost.exe
File size:	6'231'040 bytes
MD5:	7549250ca5b7f98a08707dea4ffb06fc
SHA1:	5cc5fa87159c1f3d49fc262318e1d473deee1908
SHA256:	d90bf2a4dda2e45cf2406dec9e3252487029347d239121a388675cd7580f2f53
SHA512:	be36308ca522eb41871ab1d0a311645ec356bf42357c597dbd81e908173bd2edd5a1f4ccf86ebad269555248dadc5e1fe482e294ab620c5bfc527ee3d922022f
SSDEEP:	98304:5A/ORTgPAB+/oPNv5Gmj0IFcyfzQRfFNQsxjLXUkZYSCnfIAYHsPNtG9+jqgo3ma:WGMsooPNsIFVE5QgCfPYMHC3vt
TLSH:	125623E25E713148D1E9C939BA337EFD34F30F2685122839A99BF9C724B5694A613C43
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........PE..L...O..f.................rG..........F........G...@.................................h._...@......@.........................

File Icon


Icon Hash:	6869cccccce8698e

Static PE Info

General

Entrypoint:	0xdc46d5
Entrypoint Section:	.vmp1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66B8CF4F [Sun Aug 11 14:48:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	784385f4735288c948be503be851b8ef

Entrypoint Preview

Instruction
push 0AC90666h
call 00007F244CDA360Ah
add ebp, ecx
jmp ebp
cmp ch, FFFFFFBBh
sub esi, 00000002h
cmc
cmp ax, bp
stc
shl al, cl
mov word ptr [esi+04h], ax
cwde
pushfd
bsf ax, ax
add ah, 0000007Bh
pop dword ptr [esi]
add ah, FFFFFF9Bh
or ax, bx
mov eax, dword ptr [ebp+00h]
jmp 00007F244CD71A4Bh
dec eax
test bp, sp
xor ebx, eax
clc
add edi, eax
jmp 00007F244C8FEB9Ah
dec edx
jmp 00007F244CD4F0C7h
lea esi, dword ptr [esi-00000001h]
movzx ecx, byte ptr [esi]
cwd
movsx edx, sp
xor cl, bl
neg cl
add cl, 00000032h
movzx edx, bp
btc eax, FFFFFF8Ch
ror cl, 1
xchg eax, edx
mov dx, bp
inc cl
clc
ror cl, 1
test ax, bp
add cl, FFFFFFB2h
cwd
bswap dx
clc
ror cl, 1
bts edx, esi
xor cl, FFFFFFFDh
xor bl, cl
bt eax, 4Dh
jmp 00007F244CBE5F85h
bswap edx
jmp 00007F244CD98B65h
je 00007F244CB2BE8Bh
mov eax, dword ptr [ebp+ebx*4+00h]
push eax
cmp sp, ax
stc
sub ebx, 00000001h
jne 00007F244CB2BE61h
mov eax, dword ptr [ebp+00h]
jmp 00007F244CD63447h
inc ecx
inc eax
stc
inc ecx
neg eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xa3d5bc	0xc96	.vmp1
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa7a908	0x1a4	.vmp1
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcda000	0xe2f44	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xcd9000	0x584	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x9ca11c	0x70	.vmp1
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xbd8000	0xbec	.vmp1
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x9b67a4	0x1c0	.vmp1
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x473878	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x475000	0x37a8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x479000	0x25b74	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x49f000	0x1b248	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x4bb000	0x3fc2	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x4bf000	0xd34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x4c0000	0x6f	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x4c1000	0x58	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x4c2000	0x5d	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vmp0	0x4c3000	0x232c40	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp1	0x6f6000	0x5e2ab0	0x5e2c00	32b9be1317360727c8f3be3854b0bbb6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0xcd9000	0x584	0x600	2b6ab5cf411b4a310a1a85f7acfdbf13	False	0.5247395833333334	data	4.20084185014455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xcda000	0xe2f44	0xde00	616dc6aa1aab8d19dea22e9ffe53ec1d	False	0.19406320382882883	data	3.982593752272412	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xce7c38	0x134	data	English	United States	0.04220779220779221
RT_CURSOR	0xce7d6c	0x134	data	English	United States	0.08108108108108109
RT_CURSOR	0xce7ea0	0x134	empty	English	United States	0
RT_CURSOR	0xce7fd4	0x134	empty	English	United States	0
RT_CURSOR	0xce8108	0x134	empty	English	United States	0
RT_CURSOR	0xce823c	0x134	empty	English	United States	0
RT_CURSOR	0xce8370	0x134	empty	English	United States	0
RT_CURSOR	0xce84a4	0x134	empty	English	United States	0
RT_ICON	0xcdb2b8	0x1876	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9412328329607155
RT_ICON	0xcdcb30	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.04292631081719414
RT_ICON	0xce0d58	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.06006224066390042
RT_ICON	0xce3300	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.06301775147928994
RT_ICON	0xce4d68	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.08536585365853659
RT_ICON	0xce5e10	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.10491803278688525
RT_ICON	0xce6798	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.10697674418604651
RT_ICON	0xce6e50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.13120567375886524
RT_STRING	0xce85d8	0x26c	empty			0
RT_STRING	0xce8844	0x3c8	empty			0
RT_STRING	0xce8c0c	0x308	empty			0
RT_STRING	0xce8f14	0x548	empty			0
RT_STRING	0xce945c	0x45c	empty			0
RT_STRING	0xce98b8	0x284	empty			0
RT_STRING	0xce9b3c	0x4c8	empty			0
RT_STRING	0xcea004	0x574	empty			0
RT_STRING	0xcea578	0x540	empty			0
RT_STRING	0xceaab8	0x4cc	empty			0
RT_STRING	0xceaf84	0x514	empty			0
RT_STRING	0xceb498	0x898	empty			0
RT_STRING	0xcebd30	0x106c	empty			0
RT_STRING	0xcecd9c	0x9f8	empty			0
RT_STRING	0xced794	0x894	empty			0
RT_STRING	0xcee028	0x87c	empty			0
RT_STRING	0xcee8a4	0x400	empty			0
RT_STRING	0xceeca4	0x2bc	empty			0
RT_STRING	0xceef60	0x5b0	empty			0
RT_STRING	0xcef510	0x3e4	empty			0
RT_STRING	0xcef8f4	0x408	empty			0
RT_STRING	0xcefcfc	0x35c	empty			0
RT_STRING	0xcf0058	0x478	empty			0
RT_STRING	0xcf04d0	0x358	empty			0
RT_STRING	0xcf0828	0x394	empty			0
RT_STRING	0xcf0bbc	0x264	empty			0
RT_STRING	0xcf0e20	0x434	empty			0
RT_STRING	0xcf1254	0x3c0	empty			0
RT_STRING	0xcf1614	0x2cc	empty			0
RT_STRING	0xcf18e0	0x3e4	empty			0
RT_STRING	0xcf1cc4	0x260	empty			0
RT_STRING	0xcf1f24	0xbc	empty			0
RT_STRING	0xcf1fe0	0xfc	empty			0
RT_STRING	0xcf20dc	0x3e8	empty			0
RT_STRING	0xcf24c4	0x3fc	empty			0
RT_STRING	0xcf28c0	0x3ac	empty			0
RT_STRING	0xcf2c6c	0x52c	empty			0
RT_STRING	0xcf3198	0x2b0	empty			0
RT_STRING	0xcf3448	0x3a0	empty			0
RT_STRING	0xcf37e8	0x3f8	empty			0
RT_STRING	0xcf3be0	0x650	empty			0
RT_STRING	0xcf4230	0x414	empty			0
RT_STRING	0xcf4644	0x484	empty			0
RT_STRING	0xcf4ac8	0x38c	empty			0
RT_STRING	0xcf4e54	0x32c	empty			0
RT_STRING	0xcf5180	0x44c	empty			0
RT_STRING	0xcf55cc	0x21c	empty			0
RT_STRING	0xcf57e8	0xbc	empty			0
RT_STRING	0xcf58a4	0x100	empty			0
RT_STRING	0xcf59a4	0x3e8	empty			0
RT_STRING	0xcf5d8c	0x498	empty			0
RT_STRING	0xcf6224	0x2f8	empty			0
RT_STRING	0xcf651c	0x2f0	empty			0
RT_STRING	0xcf680c	0x368	empty			0
RT_RCDATA	0xcf6b74	0x10	empty			0
RT_RCDATA	0xcf6b84	0x148b	empty	English	United States	0
RT_RCDATA	0xcf8010	0x111e	empty	English	United States	0
RT_RCDATA	0xcf9130	0xd8c	empty	English	United States	0
RT_RCDATA	0xcf9ebc	0x11d4	empty			0
RT_RCDATA	0xcfb090	0x2	empty	English	United States	0
RT_RCDATA	0xcfb094	0x5e2	empty			0
RT_RCDATA	0xcfb678	0x229	empty			0
RT_RCDATA	0xcfb8a4	0xc1600	empty	English	United States	0
RT_GROUP_CURSOR	0xdbcea4	0x14	empty	English	United States	0
RT_GROUP_CURSOR	0xdbceb8	0x14	empty	English	United States	0
RT_GROUP_CURSOR	0xdbcecc	0x14	empty	English	United States	0
RT_GROUP_CURSOR	0xdbcee0	0x14	empty	English	United States	0
RT_GROUP_CURSOR	0xdbcef4	0x14	empty	English	United States	0
RT_GROUP_CURSOR	0xdbcf08	0x14	empty	English	United States	0
RT_GROUP_CURSOR	0xdbcf1c	0x14	empty	English	United States	0
RT_GROUP_CURSOR	0xdbcf30	0x14	empty	English	United States	0
RT_GROUP_ICON	0xce72b8	0x76	data	English	United States	0.7542372881355932
RT_VERSION	0xce7330	0x1fc	data	English	United States	0.5137795275590551
RT_MANIFEST	0xce752c	0x709	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.4031093836757357

Imports

DLL	Import
wininet.dll	DeleteUrlCacheEntryW
winspool.drv	DocumentPropertiesW, ClosePrinter, OpenPrinterW, GetDefaultPrinterW, EnumPrintersW
comctl32.dll	ImageList_GetImageInfo, FlatSB_SetScrollInfo, ImageList_DragMove, ImageList_Destroy, _TrackMouseEvent, ImageList_DragShowNolock, ImageList_Add, FlatSB_SetScrollProp, ImageList_GetDragImage, ImageList_Create, ImageList_EndDrag, ImageList_DrawEx, ImageList_SetImageCount, FlatSB_GetScrollPos, FlatSB_SetScrollPos, InitializeFlatSB, ImageList_Copy, FlatSB_GetScrollInfo, ImageList_Write, ImageList_DrawIndirect, ImageList_SetBkColor, ImageList_GetBkColor, ImageList_BeginDrag, ImageList_GetIcon, ImageList_Replace, ImageList_GetImageCount, ImageList_DragEnter, ImageList_GetIconSize, ImageList_SetIconSize, ImageList_Read, ImageList_DragLeave, ImageList_LoadImageW, ImageList_Draw, ImageList_Remove, ImageList_ReplaceIcon, ImageList_SetOverlayImage
shell32.dll	Shell_NotifyIconW, SHGetSpecialFolderPathW, SHAppBarMessage, ShellExecuteW, ShellExecuteExW
user32.dll	CopyImage, SetMenuItemInfoW, GetMenuItemInfoW, DefFrameProcW, GetDlgCtrlID, FrameRect, RegisterWindowMessageW, GetMenuStringW, FillRect, SendMessageA, EnumWindows, ShowOwnedPopups, GetClassInfoExW, GetClassInfoW, GetScrollRange, SetActiveWindow, GetActiveWindow, DrawEdge, GetKeyboardLayoutList, LoadBitmapW, EnumChildWindows, UnhookWindowsHookEx, SetCapture, GetCapture, ShowCaret, CreatePopupMenu, GetMenuItemID, CharLowerBuffW, PostMessageW, SetWindowLongW, IsZoomed, SetParent, DrawMenuBar, GetClientRect, IsChild, IsIconic, CallNextHookEx, ShowWindow, GetWindowTextW, SetForegroundWindow, IsDialogMessageW, DestroyWindow, RegisterClassW, EndMenu, CharNextW, GetFocus, GetDC, SetFocus, ReleaseDC, GetClassLongW, SetScrollRange, DrawTextW, PeekMessageA, MessageBeep, SetClassLongW, RemovePropW, GetSubMenu, DestroyIcon, IsWindowVisible, PtInRect, DispatchMessageA, UnregisterClassW, GetTopWindow, SendMessageW, GetComboBoxInfo, LoadStringW, CreateMenu, CharLowerW, SetWindowRgn, SetWindowPos, GetMenuItemCount, GetSysColorBrush, GetWindowDC, DrawTextExW, GetScrollInfo, SetWindowTextW, GetMessageExtraInfo, GetSysColor, EnableScrollBar, TrackPopupMenu, DrawIconEx, GetClassNameW, GetMessagePos, GetIconInfo, SetScrollInfo, GetKeyNameTextW, GetDesktopWindow, SetCursorPos, GetCursorPos, SetMenu, GetMenuState, GetMenu, SetRect, GetKeyState, IsRectEmpty, ValidateRect, GetCursor, KillTimer, WaitMessage, TranslateMDISysAccel, GetWindowPlacement, GetMenuItemRect, CreateIconIndirect, CreateWindowExW, GetMessageW, GetDCEx, PeekMessageW, MonitorFromWindow, GetUpdateRect, SetTimer, WindowFromPoint, BeginPaint, RegisterClipboardFormatW, MapVirtualKeyW, OffsetRect, IsWindowUnicode, DispatchMessageW, CreateAcceleratorTableW, DefMDIChildProcW, GetSystemMenu, SetScrollPos, GetScrollPos, InflateRect, DrawFocusRect, ReleaseCapture, LoadCursorW, ScrollWindow, GetLastActivePopup, GetSystemMetrics, CharUpperBuffW, SetClipboardData, GetClipboardData, ClientToScreen, SetWindowPlacement, GetMonitorInfoW, CheckMenuItem, CharUpperW, DefWindowProcW, GetForegroundWindow, EnableWindow, GetWindowThreadProcessId, RedrawWindow, EndPaint, MsgWaitForMultipleObjectsEx, LoadKeyboardLayoutW, ActivateKeyboardLayout, GetParent, MonitorFromRect, InsertMenuItemW, GetPropW, MessageBoxW, SetPropW, UpdateWindow, MsgWaitForMultipleObjects, OemToCharA, DestroyMenu, SetWindowsHookExW, EmptyClipboard, GetDlgItem, AdjustWindowRectEx, IsWindow, DrawIcon, EnumThreadWindows, InvalidateRect, GetKeyboardState, ScreenToClient, DrawFrameControl, SetCursor, CreateIcon, RemoveMenu, GetKeyboardLayoutNameW, OpenClipboard, TranslateMessage, MapWindowPoints, EnumDisplayMonitors, CallWindowProcW, CloseClipboard, DestroyCursor, CopyIcon, PostQuitMessage, ShowScrollBar, EnableMenuItem, HideCaret, FindWindowExW, MonitorFromPoint, LoadIconW, SystemParametersInfoW, GetWindow, GetWindowRect, GetWindowLongW, InsertMenuW, PostThreadMessageW, IsWindowEnabled, IsDialogMessageA, FindWindowW, GetKeyboardLayout, DeleteMenu
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
URLMON.DLL	URLDownloadToFileW
oleaut32.dll	SafeArrayPutElement, GetErrorInfo, VariantInit, VariantClear, SysFreeString, SafeArrayAccessData, SysReAllocStringLen, SafeArrayCreate, SafeArrayGetElement, GetActiveObject, SysAllocStringLen, SafeArrayUnaccessData, SafeArrayPtrOfIndex, SafeArrayGetElemsize, VariantCopy, SafeArrayGetUBound, SafeArrayGetLBound, VariantCopyInd, VariantChangeType
msvcrt.dll	isupper, isalpha, isalnum, toupper, memchr, memcmp, memcpy, memset, isprint, isspace, iscntrl, isxdigit, ispunct, isgraph, islower, tolower
advapi32.dll	CloseServiceHandle, RegSetValueExW, RegConnectRegistryW, CreateServiceW, StartServiceCtrlDispatcherW, DeregisterEventSource, RegQueryInfoKeyW, SetServiceStatus, RegUnLoadKeyW, RegSaveKeyW, DeleteService, RegReplaceKeyW, RegisterEventSourceW, RegCreateKeyExW, RegisterServiceCtrlHandlerW, OpenServiceW, RegLoadKeyW, RegEnumKeyExW, AdjustTokenPrivileges, RegDeleteKeyW, LookupPrivilegeValueW, OpenSCManagerW, RegOpenKeyExW, OpenProcessToken, RegDeleteValueW, ReportEventW, RegFlushKey, RegQueryValueExW, RegEnumValueW, RegCloseKey, RegRestoreKeyW, EnumServicesStatusW
kernel32.dll	SetFileAttributesW, GetFileType, SetFileTime, QueryDosDeviceW, GetACP, CloseHandle, LocalFree, GetCurrentProcessId, SizeofResource, QueryPerformanceFrequency, IsDebuggerPresent, FindNextFileW, GetFullPathNameW, VirtualFree, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, EnumSystemLocalesW, GetStdHandle, GetTimeZoneInformation, FileTimeToLocalFileTime, SystemTimeToTzSpecificLocalTime, GetModuleHandleW, FreeLibrary, TryEnterCriticalSection, HeapDestroy, FileTimeToDosDateTime, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, GlobalAlloc, GlobalUnlock, FindResourceW, CreateThread, CompareStringW, CopyFileW, MapViewOfFile, LoadLibraryA, GetVolumeInformationW, ResetEvent, MulDiv, FreeResource, GetDriveTypeW, GetVersion, RaiseException, MoveFileW, GlobalAddAtomW, FormatMessageW, OpenProcess, SwitchToThread, GetExitCodeThread, GetCurrentThread, GetLogicalDrives, Wow64DisableWow64FsRedirection, GetFileAttributesExW, GlobalMemoryStatusEx, ExpandEnvironmentStringsW, GetPriorityClass, LoadLibraryExW, TerminateProcess, SetPriorityClass, LockResource, FileTimeToSystemTime, GetCurrentThreadId, UnhandledExceptionFilter, PeekNamedPipe, GlobalFindAtomW, VirtualQuery, GlobalFree, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, ReleaseMutex, LoadResource, Wow64EnableWow64FsRedirection, SuspendThread, GetTickCount, WritePrivateProfileStringW, GetFileSize, GlobalDeleteAtom, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetThreadPriority, GetCurrentProcess, GlobalLock, SetThreadPriority, VirtualAlloc, GetTempPathW, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetLogicalDriveStringsW, GetVersionExW, VerifyVersionInfoW, HeapCreate, LCMapStringW, GetDiskFreeSpaceW, VerSetConditionMask, FindFirstFileW, GetUserDefaultUILanguage, GetConsoleOutputCP, UnmapViewOfFile, GetConsoleCP, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, CreateMutexA, LoadLibraryW, SetEvent, GetLocaleInfoW, CreateFileW, SystemTimeToFileTime, EnumResourceNamesW, DeleteFileW, IsDBCSLeadByteEx, GetEnvironmentVariableW, GetLocalTime, WaitForSingleObject, WriteFile, CreateFileMappingW, ExitThread, OpenThread, CreatePipe, DeleteCriticalSection, GetDateFormatW, TlsGetValue, SetErrorMode, GetComputerNameW, TzSpecificLocalTimeToSystemTime, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, RemoveDirectoryW, CreateEventW, GetPrivateProfileStringW, QueryFullProcessImageNameW, WaitForMultipleObjectsEx, GetThreadLocale, SetThreadLocale
SHFolder.dll	SHGetFolderPathW
wsock32.dll	gethostbyaddr, setsockopt, select, getsockopt, WSACleanup, gethostbyname, bind, gethostname, closesocket, WSAGetLastError, connect, getpeername, inet_addr, WSAAsyncSelect, WSAAsyncGetServByName, WSACancelAsyncRequest, send, accept, ntohs, htons, WSAStartup, getservbyname, getsockname, listen, socket, recv, inet_ntoa, ioctlsocket, WSAAsyncGetHostByName
ole32.dll	IsEqualGUID, ProgIDFromCLSID, OleInitialize, CLSIDFromProgID, OleUninitialize, CoInitialize, CoCreateInstance, CoUninitialize, CoTaskMemFree, CoTaskMemAlloc, StringFromCLSID
gdi32.dll	Pie, SetBkMode, CreateCompatibleBitmap, GetEnhMetaFileHeader, RectVisible, AngleArc, SetAbortProc, SetTextColor, GetTextColor, StretchBlt, RoundRect, RestoreDC, SetRectRgn, GetTextMetricsW, GetWindowOrgEx, CreatePalette, PolyBezierTo, CreateICW, CreateDCW, GetStockObject, CreateSolidBrush, GetBkMode, Polygon, MoveToEx, PlayEnhMetaFile, Ellipse, StartPage, GetBitmapBits, StartDocW, AbortDoc, GetSystemPaletteEntries, GetEnhMetaFileBits, GetEnhMetaFilePaletteEntries, CreatePenIndirect, CreateFontIndirectW, PolyBezier, EndDoc, GetObjectW, GetCurrentObject, GetWinMetaFileBits, SetROP2, GetEnhMetaFileDescriptionW, ArcTo, Arc, SelectPalette, SetGraphicsMode, ExcludeClipRect, MaskBlt, SetWindowOrgEx, EndPage, DeleteEnhMetaFile, Chord, SetDIBits, GetViewportOrgEx, SetViewportOrgEx, CreateRectRgn, RealizePalette, SetDIBColorTable, GetDIBColorTable, CreateBrushIndirect, PatBlt, SetEnhMetaFileBits, Rectangle, SaveDC, DeleteDC, BitBlt, SetWorldTransform, FrameRgn, GetDeviceCaps, GetTextExtentPoint32W, GetClipBox, IntersectClipRect, Polyline, CreateBitmap, CombineRgn, SetWinMetaFileBits, GetStretchBltMode, CreateDIBitmap, SetStretchBltMode, GetDIBits, CreateDIBSection, ExtCreateRegion, LineTo, GetRgnBox, EnumFontsW, CreateHalftonePalette, SelectObject, DeleteObject, ExtFloodFill, UnrealizeObject, CopyEnhMetaFileW, SetBkColor, CreateCompatibleDC, GetBrushOrgEx, GetCurrentPositionEx, SetDCPenColor, CreateRoundRectRgn, GetTextExtentPointW, ExtTextOutW, SetBrushOrgEx, GetPixel, GdiFlush, SetPixel, EnumFontFamiliesExW, StretchDIBits, GetPaletteEntries
WTSAPI32.dll	WTSSendMessageW
kernel32.dll	VirtualQuery, GetSystemTimeAsFileTime, GetModuleHandleA, CreateEventA, GetModuleFileNameW, LoadLibraryA, TerminateProcess, GetCurrentProcess, CreateToolhelp32Snapshot, Thread32First, GetCurrentProcessId, GetCurrentThreadId, OpenThread, Thread32Next, CloseHandle, SuspendThread, ResumeThread, WriteProcessMemory, GetSystemInfo, VirtualAlloc, VirtualProtect, VirtualFree, GetProcessAffinityMask, SetProcessAffinityMask, GetCurrentThread, SetThreadAffinityMask, Sleep, FreeLibrary, GetTickCount, SystemTimeToFileTime, FileTimeToSystemTime, GlobalFree, LocalAlloc, LocalFree, GetProcAddress, ExitProcess, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, GetModuleHandleW, LoadResource, MultiByteToWideChar, FindResourceExW, FindResourceExA, WideCharToMultiByte, GetThreadLocale, GetUserDefaultLCID, GetSystemDefaultLCID, EnumResourceNamesA, EnumResourceNamesW, EnumResourceLanguagesA, EnumResourceLanguagesW, EnumResourceTypesA, EnumResourceTypesW, CreateFileW, LoadLibraryW, GetLastError, FlushFileBuffers, CreateFileA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, GetCommandLineA, RaiseException, RtlUnwind, HeapFree, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, LCMapStringA, LCMapStringW, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, HeapCreate, HeapDestroy, QueryPerformanceCounter, HeapReAlloc, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize, WriteFile, SetFilePointer, GetConsoleCP, GetConsoleMode, InitializeCriticalSectionAndSpinCount, SetStdHandle
user32.dll	GetProcessWindowStation, GetUserObjectInformationW, CharUpperBuffW, MessageBoxW
kernel32.dll	LocalAlloc, LocalFree, GetModuleFileNameW, GetProcessAffinityMask, SetProcessAffinityMask, SetThreadAffinityMask, Sleep, ExitProcess, FreeLibrary, LoadLibraryA, GetModuleHandleA, GetProcAddress
user32.dll	GetProcessWindowStation, GetUserObjectInformationW

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x412808
dbkFCallWrapperAddr	1	0x8a2644

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	07:11:01
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\dllhost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\dllhost.exe"
Imagebase:	0xfd0000
File size:	6'231'040 bytes
MD5 hash:	7549250CA5B7F98A08707DEA4FFB06FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.2%
Total number of Nodes:	408
Total number of Limit Nodes:	32

Executed Functions

Function 00FDF9B4 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,00FDFA76,?,?), ref: 00FDF9E6
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,00FDFA76,?,?), ref: 00FDF9EF

Part of subcall function 00FDF85C: FindFirstFileW.KERNEL32(00000000,?,00000000,00FDF8BC,?,?), ref: 00FDF88F
Part of subcall function 00FDF85C: FindClose.KERNEL32(00000000,00000000,?,00000000,00FDF8BC,?,?), ref: 00FDF89F

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 72676df13c987fc88283d149046f30654a7066abe0de1f341ce5c6e9d6d5a1de
Instruction ID: 5a8c8649b0547d1a31c993d80408bde65295027e0be6bbf7a01968ae1d4f971a
Opcode Fuzzy Hash: 72676df13c987fc88283d149046f30654a7066abe0de1f341ce5c6e9d6d5a1de
Instruction Fuzzy Hash: A4116370A041099BDB01EFA4CC42AADB3BAEF49300F544477F515E7345DB789E08E766

Function 00FDF85C Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00FDF8BC,?,?), ref: 00FDF88F
FindClose.KERNEL32(00000000,00000000,?,00000000,00FDF8BC,?,?), ref: 00FDF89F

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 5dc9c964399cf85c770eaeddbb053142110d684fbb2f016a3ff5c5b5b9f360be
Instruction ID: fead8ab591f44fdd54bb00f6f44fbfc40d53e5bfa75f2cd200d3d7facdff685f
Opcode Fuzzy Hash: 5dc9c964399cf85c770eaeddbb053142110d684fbb2f016a3ff5c5b5b9f360be
Instruction Fuzzy Hash: 57F0E271900604AEC750EBB4DC52C4EB7EDEF4972076809B3F400E3791E7389E04B526

Function 00FDF478 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00FDF6A0,?,?,?), ref: 00FDF4B7
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,?,00000105,00000000,00FDF6A0,?,?,?), ref: 00FDF500
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,00FDF6A0,?,?,?), ref: 00FDF522
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000), ref: 00FDF540
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001), ref: 00FDF55E
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,00020019,?,80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002), ref: 00FDF57C
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,00020019,?,80000001,Software\Borland\Locales,00000000,00020019,?,80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001), ref: 00FDF59A
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,00000000,00FDF67C,?,80000001,Software\Borland\Delphi\Locales,00000000,00020019,?,80000001,Software\Borland\Locales), ref: 00FDF5D4
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,?,00000000,00FDF67C,?,80000001), ref: 00FDF5F9
RegCloseKey.ADVAPI32(?,00FDF683,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,00FDF67C,?,80000001,Software\Embarcadero\Locales), ref: 00FDF674

Strings

Software\Embarcadero\Locales, xrefs: 00FDF4F6, 00FDF518
Software\Borland\Locales, xrefs: 00FDF572
Software\CodeGear\Locales, xrefs: 00FDF536, 00FDF554
Software\Borland\Delphi\Locales, xrefs: 00FDF590

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 308180624c574a942aa56e36db363b4c84e2de3f2e1b80f0a90534248518340e
Instruction ID: f4e94901617b0498a00994b3e7f0b1ee94ae1359fc94fe4fe319eb2b96b6edf2
Opcode Fuzzy Hash: 308180624c574a942aa56e36db363b4c84e2de3f2e1b80f0a90534248518340e
Instruction Fuzzy Hash: B9514471A40309BAEB10DA90DC42FAEB3BEAB04B40F684467B605F6791E6B4E904E755

Function 01001CB0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 129
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,?,00000114), ref: 01001D2B
RegQueryValueExW.ADVAPI32(?,DisplayVersion,00000000,00000000,00000000,?,00000000,01001E42,?,80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,?,00000114), ref: 01001D59
RegQueryValueExW.ADVAPI32(?,DisplayVersion,00000000,00000000,00000000,00000002,?,DisplayVersion,00000000,00000000,00000000,?,00000000,01001E42,?,80000002), ref: 01001D9B
RegQueryValueExW.ADVAPI32(?,ReleaseId,00000000,00000000,00000000,?,?,DisplayVersion,00000000,00000000,00000000,?,00000000,01001E42,?,80000002), ref: 01001DB5
RegQueryValueExW.ADVAPI32(?,ReleaseId,00000000,00000000,00000000,00000002,?,ReleaseId,00000000,00000000,00000000,?,?,DisplayVersion,00000000,00000000), ref: 01001DF7
RegQueryValueExW.ADVAPI32(?,UBR,00000000,00000000,01472964,00000004,?,ReleaseId,00000000,00000000,00000000,?,?,DisplayVersion,00000000,00000000), ref: 01001E19
RegCloseKey.ADVAPI32(?,01001E49,00000000,01472964,00000004,?,ReleaseId,00000000,00000000,00000000,?,?,DisplayVersion,00000000,00000000,00000000), ref: 01001E3A

Strings

UBR, xrefs: 01001E10
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 01001D21
ReleaseId, xrefs: 01001DAC, 01001DEE
DisplayVersion, xrefs: 01001D50, 01001D92

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: DisplayVersion$ReleaseId$SOFTWARE\Microsoft\Windows NT\CurrentVersion$UBR
API String ID: 1586453840-3678894217
Opcode ID: 6ac31775b7d986a0ea32d8726003dbeb4dec4ef439a66a829f73eaf1cfe8f79c
Instruction ID: 6e013ee51dbf22bcb7eaa6a283b89ed5730980ce4fcbb3a59177018e1ecd5d19
Opcode Fuzzy Hash: 6ac31775b7d986a0ea32d8726003dbeb4dec4ef439a66a829f73eaf1cfe8f79c
Instruction Fuzzy Hash: 63419271B40348BBFB62EAA6DC42F9E77EDEB04700F140496F640E62C1D7B4EA048754

Function 00FDF130 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlLeaveCriticalSection.NTDLL(01471C18), ref: 00FDF172
RtlEnterCriticalSection.NTDLL(01471C18), ref: 00FDF1F0
RtlLeaveCriticalSection.NTDLL(01471C18), ref: 00FDF219

Strings

en-GB,en,en-US,, xrefs: 00FDF15E, 00FDF205

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter
String ID: en-GB,en,en-US,
API String ID: 2978645861-3021119265
Opcode ID: 380227578c07976934f87f97c9509415ec0c0aed733643f0f8b6b68ff8f1f9fe
Instruction ID: fe9b037cbd5125d4c12c7365b8d3366f38e6834100450f8f6ea77664a13bfd61
Opcode Fuzzy Hash: 380227578c07976934f87f97c9509415ec0c0aed733643f0f8b6b68ff8f1f9fe
Instruction Fuzzy Hash: B021D520B54604ABDB20B7E98D03A5932979B85F41BAC0437B502CB356CAB88D45B3A7

Function 00FF9588 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00FF95E3
{, xrefs: 00FF9603

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID:
String ID: ${
API String ID: 0-4046706400
Opcode ID: afc6bd2bef7d5ba224d127c1a9e5923f09f3fe74c873e5654600b7cdf7d1bc77
Instruction ID: f256694704010b44b1959c6bca2710616b7f3fc78563b58950975a650f266c4a
Opcode Fuzzy Hash: afc6bd2bef7d5ba224d127c1a9e5923f09f3fe74c873e5654600b7cdf7d1bc77
Instruction Fuzzy Hash: 3201A22661C30825EB3630792CC6B7911844F86BB8F3C0922FB52EB1F2D6CA4C8375B1

Function 0149A950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00000006,00000000), ref: 0149A96A
WriteProcessMemory.KERNELBASE(00000000,?,?,00000006,00000000), ref: 0149A971

Strings

%, xrefs: 0149A963

Memory Dump Source

Source File: 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp, Offset: 01493000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1493000_dllhost.jbxd

Similarity

API ID: Process$CurrentMemoryWrite
String ID: %
API String ID: 4081199588-2567322570
Opcode ID: 53d3041bc5c716b70f5e7ec6a0d558f4b2c1f6288837c15b7bc66f99c26fbb08
Instruction ID: f3ad7e935fab18351b119e8e88a7923c743882e46c49044aaa59ccecc6494712
Opcode Fuzzy Hash: 53d3041bc5c716b70f5e7ec6a0d558f4b2c1f6288837c15b7bc66f99c26fbb08
Instruction Fuzzy Hash: 7EE08C70A84249ABCB20DFB99C0EB59BA79AB11A12F004398B505DA1C4EA7051148361

Function 00FDAB14 Relevance: 4.6, APIs: 3, Instructions: 93
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00FDAB44
FreeLibrary.KERNEL32(00FD0000,?,?,?,00FDAC4E,00FD7183,00FD71CA,?,?,00FD71E3,?,?,?,?,?,00FDA688), ref: 00FDABEC
ExitProcess.KERNEL32(00000000,?,?,?,00FDAC4E,00FD7183,00FD71CA,?,?,00FD71E3,?,?,?,?,?,00FDA688), ref: 00FDAC25

Part of subcall function 00FDAA7C: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00FDAB34,?,?,?,00FDAC4E,00FD7183,00FD71CA,?,?,00FD71E3), ref: 00FDAAB5
Part of subcall function 00FDAA7C: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00FDAB34,?,?,?,00FDAC4E,00FD7183,00FD71CA), ref: 00FDAABB
Part of subcall function 00FDAA7C: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00FDAB34,?,?,?), ref: 00FDAAD6
Part of subcall function 00FDAA7C: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00FDAB34,?,?), ref: 00FDAADC

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 0a6cb8636c74583717e5b6ed30a93162722a1b045e5be92a83d7102e9fa3307f
Instruction ID: 9c3d118dd72f57b88b2ab3e5d41593054385f24f6d2ef2dd03c8e40632a54adc
Opcode Fuzzy Hash: 0a6cb8636c74583717e5b6ed30a93162722a1b045e5be92a83d7102e9fa3307f
Instruction Fuzzy Hash: 79318170E003418BD731AB79988875A77E35B45734F1C0A1BE48582366D7B8DCC9E75B

Function 00FFEEBC Relevance: 3.0, APIs: 2, Instructions: 50
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageW.KERNEL32(00003300,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,01003C96,00000000,01003D02), ref: 00FFEEE0
LocalFree.KERNEL32(?,00FFEF3B,00003300,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,01003C96,00000000,01003D02), ref: 00FFEF2C

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: FormatFreeLocalMessage
String ID:
API String ID: 1427518018-0
Opcode ID: a88156dd39c2d502970a9836a947bab12cecd992000ea1127167b3d705be487e
Instruction ID: ed12fd2f4aaf5993f9122c5165d3dac59f863b56edb25013620f6ffde90e7b52
Opcode Fuzzy Hash: a88156dd39c2d502970a9836a947bab12cecd992000ea1127167b3d705be487e
Instruction Fuzzy Hash: 1D014970B5435CBEE72896189C52F7A72ADDFD4B10FA04425F601D66F0DA74DD10A260

Function 0149A8E0 Relevance: 3.0, APIs: 2, Instructions: 44
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00000005,00000000), ref: 0149A922
WriteProcessMemory.KERNELBASE(00000000,?,?,00000005,00000000), ref: 0149A929

Memory Dump Source

Source File: 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp, Offset: 01493000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1493000_dllhost.jbxd

Similarity

API ID: Process$CurrentMemoryWrite
String ID:
API String ID: 4081199588-0
Opcode ID: 0785e2cb39e82b2b6a33aff26eb8acf1c5ff4563c9623c711b7e344a29577030
Instruction ID: 82b2187dfcb66ddc2c59ecaeb8a81394b334e4adfbf38e614a9d0d22fe16fdc1
Opcode Fuzzy Hash: 0785e2cb39e82b2b6a33aff26eb8acf1c5ff4563c9623c711b7e344a29577030
Instruction Fuzzy Hash: 41F0217174010927DF144DBDDC05BADBBAAEFC1621F158366B509C76E4D97588054351

Function 00FD6F3C Relevance: 2.6, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(0146FADC,00000000,00008000,?,?,?,?,00FD703C,00FE229A,00000000,00FE22BA), ref: 00FD6F5A
VirtualFree.KERNEL32(01471B80,00000000,00008000,0146FADC,00000000,00008000,?,?,?,?,00FD703C,00FE229A,00000000,00FE22BA), ref: 00FD6FD6

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f74e61bd16dc69dbeddac98a7a60c6e324f06fa5023abf369bc59a630c7e3e98
Instruction ID: 229084bde4ab8d43e64433c685081d821f7669cbed29b2724e382feb680f6beb
Opcode Fuzzy Hash: f74e61bd16dc69dbeddac98a7a60c6e324f06fa5023abf369bc59a630c7e3e98
Instruction Fuzzy Hash: DE11C471601A108FC7648F18A85071A77E6F788B24F29806FF14DCF351E774AC019B84

Function 00FD66F8 Relevance: 2.5, APIs: 2, Instructions: 30
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(0000000A,00000000,00FD67C2,?,?,?,00FD6855), ref: 00FD6728
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,0000000A,00000000,00FD67C2,?,?,?,00FD6855), ref: 00FD6757

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: AllocSleepVirtual
String ID:
API String ID: 503295252-0
Opcode ID: a2a2ec9fa26f681e3d0aeaf9ca393b86972c50bbaec19f52afad338cef3f3731
Instruction ID: 02a17aad10e66e6ee27956267943a7a9af3a00a65df5b3fa8a5747fcfea3c788
Opcode Fuzzy Hash: a2a2ec9fa26f681e3d0aeaf9ca393b86972c50bbaec19f52afad338cef3f3731
Instruction Fuzzy Hash: DBF0897050638495FF31D620A91A77526435746BADF1C0057E1459D3DBDEE914CAE342

Function 00FDFA84 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultUILanguage.KERNEL32(00000000,00FDFB9D,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00FDFC26,00000000,?,00000105), ref: 00FDFB57

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: DefaultLanguageSystem
String ID:
API String ID: 4166810957-0
Opcode ID: d5c466133534e94368e449807c28209665b8fe8abe723e0b17646c3aa9706e62
Instruction ID: 76b751095bb6764ae05b1fd98607a895b6acbc818feb3846a34828ac1973bf8e
Opcode Fuzzy Hash: d5c466133534e94368e449807c28209665b8fe8abe723e0b17646c3aa9706e62
Instruction Fuzzy Hash: 41311C70E1020A9BDB10EB94CC92EAEB7F6AF88310F584577E402A7391D7789D49EB51

Function 00FDFBAC Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00FDFC68,?,00000000,01449048), ref: 00FDFBE8

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: ada7cb86211b05fe44033ae4814557d4b01e115ce7cad06ae3505e3f65dbd6e8
Instruction ID: dbf9ba4f00a1b5dcd18eafde6c2ed004bc043d0cd8ad61f23443a3e61a017ca6
Opcode Fuzzy Hash: ada7cb86211b05fe44033ae4814557d4b01e115ce7cad06ae3505e3f65dbd6e8
Instruction Fuzzy Hash: 7C118F30A5421C9BDB10EB60CC86FDE73BAEB08700F5544B6F409A2391EB749F84EA65

Function 010076C8 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNEL32(01472714,Function_0002F100,00000000,?,00000000,?), ref: 01007734

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 5625e00ef7e2e6c57b63be73c0e1649aae1b7a48fb488a6f44868e9d752ff8c7
Instruction ID: 8b0c10fbd455d95422fe156b084aa8ea3f4653838ec039c54fbe71c8e86eea0b
Opcode Fuzzy Hash: 5625e00ef7e2e6c57b63be73c0e1649aae1b7a48fb488a6f44868e9d752ff8c7
Instruction Fuzzy Hash: 70014C366042109FE712EF1DC98191AB7E8FF89760F1545A9F9C8AB355CB34BC40DB62

Function 00FDACE0 Relevance: 1.5, APIs: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(?,?,00FDACA8,00000000,?,?), ref: 00FDAD3A

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a57c33df1956407b7e2db5eb3226b738e2e801d95b0ef385fd96bf50f66be931
Instruction ID: c3acd82e8ba2104e1810f62f666a9a966227c906ce8d0f5cbd691e5c34d29ef0
Opcode Fuzzy Hash: a57c33df1956407b7e2db5eb3226b738e2e801d95b0ef385fd96bf50f66be931
Instruction Fuzzy Hash: E001A772B04214AFC720DB9CD884A8AB7EDDB48361F184067F508DB391DA70DD0097A5

Function 00FE7288 Relevance: 1.5, APIs: 1, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 00FE72AC

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: cc5428e7d914d45a8b53958014e81bd25b5926dbc3b4baf251ed5b79eafcc369
Instruction ID: 013bcd56cfa8dbff2feb5f69d1c40237698b9b07544e60049f0f61cb212a1932
Opcode Fuzzy Hash: cc5428e7d914d45a8b53958014e81bd25b5926dbc3b4baf251ed5b79eafcc369
Instruction Fuzzy Hash: EBF06D31608348BFE711EA669C52A6AB39CDB09710F614471FA00D7341D678AE01A9A5

Function 00FDA770 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,00FDA7BE,?,01449000,01471BA0,?,?,00FDABC5,?,?,?,00FDAC4E,00FD7183,00FD71CA), ref: 00FDA7AE

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b3a601f082b589166253c7fb9476869bc72a3ca4247d62dcd3279e1ecb7ff498
Instruction ID: 57c7b283e7a85e94b2e21a609a9e1fa1412e58625428c7e31e33a1d60d49fd53
Opcode Fuzzy Hash: b3a601f082b589166253c7fb9476869bc72a3ca4247d62dcd3279e1ecb7ff498
Instruction Fuzzy Hash: 34F0B472A056059FD3314E1AA880A22FBBDFB48B70759443BD80483750D2309C11EAA6

Function 0100496C Relevance: 1.5, APIs: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,010049C2,?,00000000,010049E2,?,00008000), ref: 010049A5

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f94442b834751f9bd1e4c468561b330cfa4270f56cc3ac4296e72d28ba2e37aa
Instruction ID: 5137daf089daf1be359c950e4751e1ec567ce6122af5dff1036133abe59a31a6
Opcode Fuzzy Hash: f94442b834751f9bd1e4c468561b330cfa4270f56cc3ac4296e72d28ba2e37aa
Instruction Fuzzy Hash: CAF08970614744BFD7025F778C5281A7BACD70DB1079348B5F900E2651E67C5C109524

Function 014ABD97 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,014A77EC,?), ref: 014ABDAC

Memory Dump Source

Source File: 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp, Offset: 01493000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1493000_dllhost.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: bfcf9cabb76eef618c00b1709f28382fdf34d1cebec379b233c45a31dd80ecb4
Instruction ID: 0f9bdc6b0e107789a4f0eaa60540582c62eef80396e6f9df2a3852844d7273fc
Opcode Fuzzy Hash: bfcf9cabb76eef618c00b1709f28382fdf34d1cebec379b233c45a31dd80ecb4
Instruction Fuzzy Hash: 30D05E725903459BDB209E756888B663BDCE384395F044436F80CC6294E670C5519740

Function 00FD5834 Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,00FD5E4B,?,00FDF835,?,?,?,00FDF7CC,00000000,00FDF7F1), ref: 00FD584B

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5ce569fac94ffde6605294cbb71a006dff68c8f91cb1590ea15385905035b0e1
Instruction ID: a74a7d59211c7474552004a08307b6828a8b8b5235c45733fd1ad2f7db67b049
Opcode Fuzzy Hash: 5ce569fac94ffde6605294cbb71a006dff68c8f91cb1590ea15385905035b0e1
Instruction Fuzzy Hash: ABF0AFF2F013014FD7248F78AA517497BD5B744758F24413EE989DB7A8D7B088049780

Function 00FD6FEC Relevance: 1.3, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(01471B90,00000000,00008000,00FE229A,00000000,00FE22BA), ref: 00FD702B

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1f9f1f450c8b3df1946447430998c86b91e84a06d1c94c9bc95fdbd8819c6c67
Instruction ID: 0a503a85f86b1376298f7cbfe0bce2ab01157170066e0f07ed1c9c0b2cc1208f
Opcode Fuzzy Hash: 1f9f1f450c8b3df1946447430998c86b91e84a06d1c94c9bc95fdbd8819c6c67
Instruction Fuzzy Hash: E4E01AB0910740DAD771FBB4A85F77532AA6304B54F58081AE108CA2EAF7785489EB01

Non-executed Functions

Function 00FDF278 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 151stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 00FDF295
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 00FDF2A6
FindFirstFileW.KERNEL32(?,?,kernel32.dll,?,?,?), ref: 00FDF3B4
FindClose.KERNEL32(?,?,?,kernel32.dll,?,?,?), ref: 00FDF3C6
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,?,?,?), ref: 00FDF3D2
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,?,?,?), ref: 00FDF417

Strings

\, xrefs: 00FDF3E4
GetLongPathNameW, xrefs: 00FDF2A0
kernel32.dll, xrefs: 00FDF290

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: ba484d3b27ae398b7a246dc1fd81001759de33e4ca998a11ad55d3c07995f65d
Instruction ID: da5a8931ce37917a73f549f752a8d163ae2e519ce19d050f0332a2ca5c9db5e2
Opcode Fuzzy Hash: ba484d3b27ae398b7a246dc1fd81001759de33e4ca998a11ad55d3c07995f65d
Instruction Fuzzy Hash: E9519131E006149BCB10EFA8CC85E9EB3F6AF45311F5845B69506E7341EB78AE49AB40

Function 00FD7238 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,00FD7317,0,?,00000000,00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00FD7302
HeapFree.KERNEL32(00000000,00000000,?,00FD7317,0,?,00000000,00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00FD7308

Strings

GetLogicalProcessorInformation, xrefs: 00FD724B
kernel32.dll, xrefs: 00FD7250
0, xrefs: 00FD72A0

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID: GetLogicalProcessorInformation$kernel32.dll$0
API String ID: 3859560861-2440520447
Opcode ID: 573873bd0fe42a00498724abbcca711ad51b9eb20b183c795608788d3510ce0f
Instruction ID: 6d880781d23c410c5d025d6d950402a35b76d3061453b23a3da2f11b24fad74b
Opcode Fuzzy Hash: 573873bd0fe42a00498724abbcca711ad51b9eb20b183c795608788d3510ce0f
Instruction Fuzzy Hash: 4A219271E08704AEDB10EBA5CC41B5DB7BBEB45712F5C84A7F814DB341E678D940AB21

Function 014A7F58 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 014AD187
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 014AD19C
UnhandledExceptionFilter.KERNEL32(014B3468), ref: 014AD1A7
GetCurrentProcess.KERNEL32(C0000409), ref: 014AD1C3
TerminateProcess.KERNEL32(00000000), ref: 014AD1CA

Memory Dump Source

Source File: 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp, Offset: 01493000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1493000_dllhost.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: afcaf9e8f3a5a230e0df0e42b06b82daedb60482eaecd98ee92bed3809e20332
Instruction ID: d66a72575983617812c01df687dc06ad4d677c0d9c3a3b3e488442d1c8ff7d08
Opcode Fuzzy Hash: afcaf9e8f3a5a230e0df0e42b06b82daedb60482eaecd98ee92bed3809e20332
Instruction Fuzzy Hash: A221BBB48013089FDB30DF6AF4C96543BF8FB58315F59506AE50887378E7B199868F1A

Function 00FDEE14 Relevance: 4.6, APIs: 3, Instructions: 100COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,00FDEF7B,?,?,?,00000000), ref: 00FDEEBE
GetLocaleInfoW.KERNEL32(?,00000059,?,00000055,?,00000002,00000000,00FDEF7B,?,?,?,00000000), ref: 00FDEEDA
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,00FDEF7B,?,?,?,00000000), ref: 00FDEEEB

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: d12fee76d113e5120ce9bc902676bba961d77026c12e30bb05d1c6380cde0548
Instruction ID: 3a8cfadba1d52050f01854af4fa6c8c093ebc28186fc8c060d93f59cedb16dd2
Opcode Fuzzy Hash: d12fee76d113e5120ce9bc902676bba961d77026c12e30bb05d1c6380cde0548
Instruction Fuzzy Hash: 19319135A04618EBDF20EF54DC82BDEB7B7EB48701F59049BA108AB390D7345E80AF11

Function 00FFA10C Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(00000000,?,?,?,?), ref: 00FFA12D

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 65047a69eda55e2acb78d09f1e48af5556980e5adbce19436f76d5fe35eb9a04
Instruction ID: 5f60a88a6133622e11e623bbb12545f54405a5bffef23441c0063e55951edc7f
Opcode Fuzzy Hash: 65047a69eda55e2acb78d09f1e48af5556980e5adbce19436f76d5fe35eb9a04
Instruction Fuzzy Hash: 7C11DEB5E00209AF9B04DF99CC81DAFF7F9FFC8710B14C569A509E7255E6319A019BA0

Function 0102FF9C Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0102FFE5

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: d350ea6cf81b4c8e603a632bc10f7f12fc36fcb4eceed5c712a33f35a2fae9a8
Instruction ID: a8f1d4d23946829ec7354ec635077abc3127f8518e5ac18464af49f04a97ca7e
Opcode Fuzzy Hash: d350ea6cf81b4c8e603a632bc10f7f12fc36fcb4eceed5c712a33f35a2fae9a8
Instruction Fuzzy Hash: C3F0AF71A007058FC3A0EFACDC81ACABBE8AF09758B040675E89CC7744E62BA8044BD4

Function 010045EC Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(010043C0,00000002), ref: 01004619

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 6a8d677dd465bb5d84870983df9b86d3499a621f5b6df23170b19b34cb32768d
Instruction ID: bb3955dd94a4ed3e0743891bf6d643616e267205f88cf82180679d971a49062a
Opcode Fuzzy Hash: 6a8d677dd465bb5d84870983df9b86d3499a621f5b6df23170b19b34cb32768d
Instruction Fuzzy Hash: FBE020127016508BE11177EE2C437893A424F41B91F0C5671F688CB3C6E65D0D0023E7

Function 00FFEF8C Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,0000000F,00000003,00000003), ref: 00FFEFA1

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 53fdf073bb0f28dd537b19913bee184b8b7af89c794532774b3d9dea83c18b3b
Instruction ID: f54b356e9c0aef69ce603450661dab58b19eca8ff94be2aeadee8978f176c484
Opcode Fuzzy Hash: 53fdf073bb0f28dd537b19913bee184b8b7af89c794532774b3d9dea83c18b3b
Instruction Fuzzy Hash: 20D017663082246AE220515B6D419BBA6DCCFC57B1F240576BBA8CA2E1EA108C44A3B1

Function 00FFC7D4 Relevance: 1.5, APIs: 1, Instructions: 22timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00FFC7DC

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: e6b99a2e0e397002abd9365916e3f46dcc412b8fe2516279be00f568dd5a02f2
Instruction ID: 3656ee7ed6f7d61c6da00050ccf66bcf9dc9800560048754515563519ef7a231
Opcode Fuzzy Hash: e6b99a2e0e397002abd9365916e3f46dcc412b8fe2516279be00f568dd5a02f2
Instruction Fuzzy Hash: 5EE0AE6040C626A1C244EF56C94143EBBE5AED4B42F808D8EF9D4801A1EA38C5A8E3A3

Function 00FDD7F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17ffc1b7c175c9f3f133bcf490b3ef334a0cf6f2a578ee1034f9dfeca47056c
Instruction ID: bd269e9b9b7589e274237c620d53392abaaac0fac1c2187e89b5b85166e199fa
Opcode Fuzzy Hash: d17ffc1b7c175c9f3f133bcf490b3ef334a0cf6f2a578ee1034f9dfeca47056c
Instruction Fuzzy Hash: E1019632B057110B874CDD7ECD9962ABAD3ABD8A10F19C63E9589C77C4DD318C1AD682

Function 0100B9D4 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 0100B9DD

Part of subcall function 0100B9A8: GetProcAddress.KERNEL32(00000000), ref: 0100B9C1

Strings

VarDiv, xrefs: 0100BA6F
VarCyFromStr, xrefs: 0100BB61
VarMul, xrefs: 0100BA59
oleaut32.dll, xrefs: 0100B9D8
VarDateFromStr, xrefs: 0100BB4B
VarOr, xrefs: 0100BAC7
VarR4FromStr, xrefs: 0100BB1F
VarR8FromStr, xrefs: 0100BB35
VarSub, xrefs: 0100BA43
VarXor, xrefs: 0100BADD
VariantChangeTypeEx, xrefs: 0100B9EB
VarBoolFromStr, xrefs: 0100BB77
VarNeg, xrefs: 0100BA01
VarAdd, xrefs: 0100BA2D
VarMod, xrefs: 0100BA9B
VarCmp, xrefs: 0100BAF3
VarI4FromStr, xrefs: 0100BB09
VarIdiv, xrefs: 0100BA85
VarAnd, xrefs: 0100BAB1
VarNot, xrefs: 0100BA17
VarBstrFromBool, xrefs: 0100BBB9
VarBstrFromCy, xrefs: 0100BB8D
VarBstrFromDate, xrefs: 0100BBA3

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: ab072bea4a91b4dd73f2f10748032fcee2764623f9ffc4a5cbe4c43f944f2b02
Instruction ID: c356fb267ba22fd58e2deb23e1ccead03bef0b7cd24daf6d75dd41be924932fe
Opcode Fuzzy Hash: ab072bea4a91b4dd73f2f10748032fcee2764623f9ffc4a5cbe4c43f944f2b02
Instruction Fuzzy Hash: 3C41B76964420D5B72176BADF84087A77DDF7A4A11FA4801AF4C4CB7D8DE30AC428B6F

Function 014A8BE1 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,014B5D78,0000000C,014A8D1C,00000000,00000000,?,014A661F,014A92DE,014A956E,?,?,014A661F,?), ref: 014A8BF3
__crt_waiting_on_module_handle.LIBCMT ref: 014A8BFE

Part of subcall function 014AB32C: Sleep.KERNEL32(000003E8,?,?,014A8B44,KERNEL32.DLL,?,014A9598,?,014A9568,014A661F,?,?,014A661F,?), ref: 014AB338
Part of subcall function 014AB32C: GetModuleHandleW.KERNEL32(014A661F,?,?,014A8B44,KERNEL32.DLL,?,014A9598,?,014A9568,014A661F,?,?,014A661F,?), ref: 014AB341

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 014A8C27
GetProcAddress.KERNEL32(014A661F,DecodePointer), ref: 014A8C37
__lock.LIBCMT ref: 014A8C59
InterlockedIncrement.KERNEL32(C35DC033), ref: 014A8C66
__lock.LIBCMT ref: 014A8C7A
___addlocaleref.LIBCMT ref: 014A8C98

Strings

EncodePointer, xrefs: 014A8C1B
KERNEL32.DLL, xrefs: 014A8BED, 014A8BF2, 014A8BFD
DecodePointer, xrefs: 014A8C2F

Memory Dump Source

Source File: 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp, Offset: 01493000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1493000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 44a98ece493b26a192467ed4bea5993a4d2c32e703ba5ff8cfc3cc4190d2fbde
Instruction ID: d8f82705287c16fda0c710602e1f45c0a1ac1463c18aea803224920445789ec8
Opcode Fuzzy Hash: 44a98ece493b26a192467ed4bea5993a4d2c32e703ba5ff8cfc3cc4190d2fbde
Instruction Fuzzy Hash: 1E116AB0902B02ABD720AF6A9844B9ABBE4BF74214F51451E9499A72B0CB74A901CF24

Function 00FE8170 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 61registrywindowclipboardCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatW.USER32(MSH_WHEELSUPPORT_MSG), ref: 00FE81A3
RegisterClipboardFormatW.USER32(MSH_SCROLL_LINES_MSG), ref: 00FE81AF
SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00FE81C7
SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00FE81EB

Strings

MSH_SCROLL_LINES_MSG, xrefs: 00FE81AA
MSWHEEL_ROLLMSG, xrefs: 00FE818F
MouseZ, xrefs: 00FE8183
MSH_WHEELSUPPORT_MSG, xrefs: 00FE819E
Magellan MSWHEEL, xrefs: 00FE817E

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: ClipboardFormatMessageRegisterSend
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 1437703442-3736581797
Opcode ID: cd092aa680a88bd81d60297c70c8a1ca917a156865cc37f5b9c8ef27639202e2
Instruction ID: 67da2bc25c72181afcd04b75b78c66f412d33891d3046659d52a584314e8b6ff
Opcode Fuzzy Hash: cd092aa680a88bd81d60297c70c8a1ca917a156865cc37f5b9c8ef27639202e2
Instruction Fuzzy Hash: E6113071644385AFE310BF96DC42B6BB7A8EF45790F104425F9489F291DBB49C42ABA0

Function 00FFF2F4 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 257threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000001,00000000,00FFF655,?,?,?,?,00000000,00000000), ref: 00FFF324

Part of subcall function 00FFEF8C: GetLocaleInfoW.KERNEL32(?,0000000F,00000003,00000003), ref: 00FFEFA1

Strings

mmmm d, yyyy, xrefs: 00FFF455
AMPM, xrefs: 00FFF5C0
:mm:ss, xrefs: 00FFF606
2, xrefs: 00FFF62F
AMPM , xrefs: 00FFF5CF
:mm, xrefs: 00FFF5E5
m/d/yy, xrefs: 00FFF425

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-3379564615
Opcode ID: 2b1ce2481827c2d4e889abed09c36436fb4ac4e8e3b09c4594057e8f893b5216
Instruction ID: 06fffa1c334df48d7eb0ef68429b15b1781b2c6ea0651241f8aeac7d997d1622
Opcode Fuzzy Hash: 2b1ce2481827c2d4e889abed09c36436fb4ac4e8e3b09c4594057e8f893b5216
Instruction Fuzzy Hash: 8691033160010D9BDB01EF64DC81AAF73AAEF44700F588576F604DB366DB38DD4AA7A5

Function 00FD5ED4 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00FDE9DC,01449C20,?,00FDF818,?,?,?,00FDF7CC,00000000,00FDF7F1,?,?,?,00000000), ref: 00FD5F6A
Sleep.KERNEL32(0000000A,00000000,00FDE9DC,01449C20,?,00FDF818,?,?,?,00FDF7CC,00000000,00FDF7F1,?,?,?,00000000), ref: 00FD5F84

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e98d24e10142b422152d68e16cf7feebdf8e90f5c96f277df1f9888819a59309
Instruction ID: d05aa586783905b88e9bc0c3ea02ce942f3dbc9c5606b8870622d579dff31ca6
Opcode Fuzzy Hash: e98d24e10142b422152d68e16cf7feebdf8e90f5c96f277df1f9888819a59309
Instruction Fuzzy Hash: 33714971604B008FD721CF28D984B1ABBD6AF85B34F1C826FE4848F396D7749845EB42

Function 00FD60CC Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4028bc4cb7eef77cf2fe30cc6d3f0a8e4f6c7099ef4e2831e89ea3f4c7efa817
Instruction ID: 77604b7084e8cf19e258845878b315a89041a48399a978eb7858bc51b64784ce
Opcode Fuzzy Hash: 4028bc4cb7eef77cf2fe30cc6d3f0a8e4f6c7099ef4e2831e89ea3f4c7efa817
Instruction Fuzzy Hash: CBC12772B10A040BDB15EA7C9C8576EB7879BC4B25F2C823FE154CB39ADA68DC45A341

Function 00FE2988 Relevance: 10.8, APIs: 7, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FE2A40

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 05039f332f60166f23ea75c200beda6163cd87d45317c4162eeebe3ae71fa760
Instruction ID: fc083a846bb821d40d4e81abd7828bee997174247856ed185e2a3b3407ef6c32
Opcode Fuzzy Hash: 05039f332f60166f23ea75c200beda6163cd87d45317c4162eeebe3ae71fa760
Instruction Fuzzy Hash: CBA1B176D003499FDB64DFA9C880BEEB7F9FF88320F10412AE505A7294EB74A944DB50

Function 00FD9A2C Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD9EEC: GetCurrentThreadId.KERNEL32 ref: 00FD9EEF

GetTickCount.KERNEL32 ref: 00FD9A63
GetTickCount.KERNEL32 ref: 00FD9A7B
GetCurrentThreadId.KERNEL32 ref: 00FD9AAA
GetTickCount.KERNEL32 ref: 00FD9AD5
GetTickCount.KERNEL32 ref: 00FD9B0C
GetTickCount.KERNEL32 ref: 00FD9B36
GetCurrentThreadId.KERNEL32 ref: 00FD9BA6

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: ed554d04962a516221788e667b0607ca05a3b8a31d6d34531406828d7a3d277d
Instruction ID: d861de5885b00818845117102dda09cd660c46ccba14f8776d5efac468b3dd51
Opcode Fuzzy Hash: ed554d04962a516221788e667b0607ca05a3b8a31d6d34531406828d7a3d277d
Instruction Fuzzy Hash: BB41643160C3415ED721AEBCC88431EBBD3AB90364F1D896FD4D987382E6F9C984A752

Function 00FD9798 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00FD97AD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00FD97B3
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00FD97D3

Strings

kernel32.dll, xrefs: 00FD97A8
@, xrefs: 00FD9853
GetLogicalProcessorInformation, xrefs: 00FD97A3

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 4275029093-79381301
Opcode ID: 63a6bc7c4faae980e0e49ce7a3bc1d7410fda6ae2790e8743bfc303e811ccc53
Instruction ID: 4e67f80ee2d1b7ba364d58d32c8cbc56fa1aeef233a3827beb6b7a9fad5865b3
Opcode Fuzzy Hash: 63a6bc7c4faae980e0e49ce7a3bc1d7410fda6ae2790e8743bfc303e811ccc53
Instruction Fuzzy Hash: 4411A231D08204AEDF50EBE5DC05B5DB7BAEB06B10F9884A7E414D7381E7B88A84FB51

Function 014B18E0 Relevance: 9.3, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 014B19E1
__FindPESection.LIBCMT ref: 014B19FB

Memory Dump Source

Source File: 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp, Offset: 01493000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1493000_dllhost.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 003b439f6dcff9bd25e2534eb0414ec509fb9f725b60611cee72fab7e0114dc8
Instruction ID: 5054b74201791834a939f75b432ebd6a8b7fff64ea456a5ed3d21cd5d2dae1d5
Opcode Fuzzy Hash: 003b439f6dcff9bd25e2534eb0414ec509fb9f725b60611cee72fab7e0114dc8
Instruction Fuzzy Hash: 8991A132A002458BDB25CF59E9E07EEB7B5FB88B10F15412AD915D73B5E732E901CBA0

Function 0100DF30 Relevance: 9.1, APIs: 6, Instructions: 144COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0100DFE5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0100E001
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0100E03A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0100E0B7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0100E0D0
VariantCopy.OLEAUT32(?,?), ref: 0100E10B

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 48f9458a83960a9a089d45d2685e32004c0439aa3c30c744726355e8423e2b6e
Instruction ID: 36cc1e17376840cbb998ec15b24519de412aebc4c5ccda285568407013dc3ad8
Opcode Fuzzy Hash: 48f9458a83960a9a089d45d2685e32004c0439aa3c30c744726355e8423e2b6e
Instruction Fuzzy Hash: 7651DB7590022E9FDB63DB98CD80AD9B7FCAF5C200F4445D9E648E7251D630AF858F61

Function 014AC725 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 014AC74D

Part of subcall function 014A7E53: __getptd.LIBCMT ref: 014A7E61
Part of subcall function 014A7E53: __getptd.LIBCMT ref: 014A7E6F

__getptd.LIBCMT ref: 014AC757

Part of subcall function 014A8D41: __getptd_noexit.LIBCMT ref: 014A8D44
Part of subcall function 014A8D41: __amsg_exit.LIBCMT ref: 014A8D51

__getptd.LIBCMT ref: 014AC765
__getptd.LIBCMT ref: 014AC773
__getptd.LIBCMT ref: 014AC77E
_CallCatchBlock2.LIBCMT ref: 014AC7A4

Part of subcall function 014A7EF8: __CallSettingFrame@12.LIBCMT ref: 014A7F44

Part of subcall function 014AC84B: __getptd.LIBCMT ref: 014AC85A
Part of subcall function 014AC84B: __getptd.LIBCMT ref: 014AC868

Memory Dump Source

Source File: 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp, Offset: 01493000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1493000_dllhost.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 722e7ddd8369edbbe02d8eb618c44cc989c33511ebb0a37e1b21644843c75da1
Instruction ID: 6cdd5237754f206492f09bd43edd9f92cdf40505b588b2720976576d42942f8d
Opcode Fuzzy Hash: 722e7ddd8369edbbe02d8eb618c44cc989c33511ebb0a37e1b21644843c75da1
Instruction Fuzzy Hash: B011C9B1D0020ADFDF00EFA5C545BAD7BB0FF38315F51806EE854AB260DB389A119B50

Function 00FD5B50 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,00FDF835,?,?,?,00FDF7CC,00000000,00FDF7F1,?,?,?,00000000,?,00FDFB1A,00000000), ref: 00FD5C07
Sleep.KERNEL32(0000000A,00000000,?,00FDF835,?,?,?,00FDF7CC,00000000,00FDF7F1,?,?,?,00000000,?,00FDFB1A), ref: 00FD5C1D
Sleep.KERNEL32(00000000,?,?,?,00FDF835,?,?,?,00FDF7CC,00000000,00FDF7F1,?,?,?,00000000), ref: 00FD5C4B
Sleep.KERNEL32(0000000A,00000000,?,?,?,00FDF835,?,?,?,00FDF7CC,00000000,00FDF7F1,?,?,?,00000000), ref: 00FD5C61

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d89c5f69872deb7d061da0cb57318094a948397cb98fd8b09c960d48ee41d06a
Instruction ID: efaa84d9f5408a4ab60aeba450ab8e9eade018daa2e0b689b54e0c0f61bb0914
Opcode Fuzzy Hash: d89c5f69872deb7d061da0cb57318094a948397cb98fd8b09c960d48ee41d06a
Instruction Fuzzy Hash: 53C19C72901B118FCB25CF28E894319BBE3AB85725F1C826FD095CF3A9C3709845EB91

Function 00FDAA7C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00FDAB34,?,?,?,00FDAC4E,00FD7183,00FD71CA,?,?,00FD71E3), ref: 00FDAAB5
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00FDAB34,?,?,?,00FDAC4E,00FD7183,00FD71CA), ref: 00FDAABB
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00FDAB34,?,?,?), ref: 00FDAAD6
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00FDAB34,?,?), ref: 00FDAADC

Strings

Runtime error at 00000000, xrefs: 00FDAAAE, 00FDAAF3

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: FileHandleWrite
String ID: Runtime error at 00000000
API String ID: 3320372497-1393363852
Opcode ID: 1528dd45f2efed816fd39f1d8efefb622fbe2c7d85078a827a84843ff31253bb
Instruction ID: 64c8859070f91b053b587b0557f8d9954351db6734c1ff98d70f3cf40c0473ab
Opcode Fuzzy Hash: 1528dd45f2efed816fd39f1d8efefb622fbe2c7d85078a827a84843ff31253bb
Instruction Fuzzy Hash: 0FF0FCA0644341B9FA30B3609D07F2A325D5744F2AF5C0317F150982E5D6B858C8B327

Function 01015A54 Relevance: 7.8, APIs: 5, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee255f26ebd7f1f2e60938d6a48202a7d7b88f614c6d30d1df97bb2c328e93ed
Instruction ID: fa0ccf22a57e8335407c687fe366d92cf146dd91af6c1c737836e978c4c4e085
Opcode Fuzzy Hash: ee255f26ebd7f1f2e60938d6a48202a7d7b88f614c6d30d1df97bb2c328e93ed
Instruction Fuzzy Hash: 53D15E75E0020A9FDB11DFE8C8818FEB7F5EF4A300F5084A5E990AB255D738AA45CB71

Function 01014494 Relevance: 7.8, APIs: 5, Instructions: 274COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 010144FF
VariantInit.OLEAUT32(?), ref: 01014616

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: ac84f5dc49b9f243b4a5f54fb379acb7db6f320c9e7e4ac2cb23b3eef2d5dab6
Instruction ID: f29e46d42ee5f3395b1a6018647751954c6c63b4eb8903338445dad19156a142
Opcode Fuzzy Hash: ac84f5dc49b9f243b4a5f54fb379acb7db6f320c9e7e4ac2cb23b3eef2d5dab6
Instruction Fuzzy Hash: 93B11575A0020AEFDB41EFD4C4908EDBBF9EF09710F5444A5E984E76A4D734AE86CB60

Function 00FF9620 Relevance: 7.6, APIs: 5, Instructions: 64fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,?,?,?,?,00FF939D), ref: 00FF9636
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,02000000,00000000,00000000,?,?,?,?,?,00FF939D), ref: 00FF966E
CloseHandle.KERNEL32(00000000,00000000,80000000,00000001,00000000,00000003,02000000,00000000,00000000,?,?,?,?,?,00FF939D), ref: 00FF9679

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: File$AttributesCloseCreateHandle
String ID:
API String ID: 4216088276-0
Opcode ID: f5c4194da26e5aefb5a570b2b1bbef9da726f9aa38283d3e034e75cabe832a40
Instruction ID: 42e2281faa4b8be401a00a0bc851fe7e180fb2ecc4fa524036170639a5d6c95b
Opcode Fuzzy Hash: f5c4194da26e5aefb5a570b2b1bbef9da726f9aa38283d3e034e75cabe832a40
Instruction Fuzzy Hash: 1901BC32E8D35829F63238694C86F7A21494F41B74F2A0B35BF68FA1F1AAD85C457099

Function 00FD6418 Relevance: 7.6, APIs: 5, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,01449088,00000000,?,00000000,?,?,00000000,00FD6DC3), ref: 00FD643A
GetStdHandle.KERNEL32(000000F4,01449084,00000000,?,00000000,00000000,000000F4,01449088,00000000,?,00000000,?,?,00000000,00FD6DC3), ref: 00FD645F
WriteFile.KERNEL32(00000000,000000F4,01449084,00000000,?,00000000,00000000,000000F4,01449088,00000000,?,00000000,?,?,00000000,00FD6DC3), ref: 00FD6465
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,01449084,00000000,?,00000000,00000000,000000F4,01449088,00000000,?), ref: 00FD647C
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,01449084,00000000,?,00000000,00000000,000000F4,01449088,00000000), ref: 00FD6482

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: Handle$FileWrite
String ID:
API String ID: 2247734768-0
Opcode ID: f6b4db2d541db80c204cb2518afa5710a0a53e67562ab037d8924fddbcf8a2ad
Instruction ID: 3cee51492099b2af14beb4c4d97ffcf0e1f680c4fa4bcebc3c1b22abfa2b6e56
Opcode Fuzzy Hash: f6b4db2d541db80c204cb2518afa5710a0a53e67562ab037d8924fddbcf8a2ad
Instruction Fuzzy Hash: E701A9F12047107ED210F7A9CD86F9F3A8D8B49B21F5846177118D63D3C9689C44B372

Function 014A8298 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 014A82A4

Part of subcall function 014A8D41: __getptd_noexit.LIBCMT ref: 014A8D44
Part of subcall function 014A8D41: __amsg_exit.LIBCMT ref: 014A8D51

__amsg_exit.LIBCMT ref: 014A82C4
__lock.LIBCMT ref: 014A82D4
InterlockedDecrement.KERNEL32(?), ref: 014A82F1
InterlockedIncrement.KERNEL32(014B84B8), ref: 014A831C

Memory Dump Source

Source File: 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp, Offset: 01493000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1493000_dllhost.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 597b4db54bc23447aeea05a9ea19ba554376c83d5b8dc8827bb84f4d6c201b8e
Instruction ID: 5802d2117f1258f33e110733ed45d01e9bde3436d01b934427f1caefcde8437d
Opcode Fuzzy Hash: 597b4db54bc23447aeea05a9ea19ba554376c83d5b8dc8827bb84f4d6c201b8e
Instruction Fuzzy Hash: 7101C432D01A13DBEB31AF6A984579A7764FF74712F86000FE805672B0C7386841CBE1

Function 014A7FE4 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 014A8002

Part of subcall function 014AD34E: __mtinitlocknum.LIBCMT ref: 014AD364
Part of subcall function 014AD34E: __amsg_exit.LIBCMT ref: 014AD370
Part of subcall function 014AD34E: RtlEnterCriticalSection.NTDLL(?), ref: 014AD378

___sbh_find_block.LIBCMT ref: 014A800D
___sbh_free_block.LIBCMT ref: 014A801C
HeapFree.KERNEL32(00000000,014A661F,014B5CF8,0000000C,014AD32F,00000000,014B5FE8,0000000C,014AD369,014A661F,?,?,014B006A,00000004,014B60A8,0000000C), ref: 014A804C
GetLastError.KERNEL32(?,014B006A,00000004,014B60A8,0000000C,014AB2A8,014A661F,?,00000000,00000000,00000000,?,014A8CF3,00000001,00000214), ref: 014A805D

Memory Dump Source

Source File: 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp, Offset: 01493000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1493000_dllhost.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 7082352eb84d251a12c86ae259526c04be2f52dc68c3ac91ce740a2b9de4f551
Instruction ID: 087b4cd319ba2d886da51192201a09c848836b487c0d871bcc56ac6d31bc4324
Opcode Fuzzy Hash: 7082352eb84d251a12c86ae259526c04be2f52dc68c3ac91ce740a2b9de4f551
Instruction Fuzzy Hash: E501A2B1C89303EADB316FB6E844B8E7B64EF30266F93051FE504AA1B0DA7885418B54

Function 00FFFD90 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 221COMMON

Download Yara Rule

APIs

EnumCalendarInfoW.KERNEL32(00FFFC58,?,00000000,00000004), ref: 00FFFE4D
EnumCalendarInfoW.KERNEL32(00FFFD00,?,00000000,00000003,00FFFC58,?,00000000,00000004), ref: 00FFFE8B
EnumCalendarInfoW.KERNEL32(00FFFD00,?,00000000,00000003,00FFFC58,?,00000000,00000004), ref: 00FFFEEB

Strings

B.C., xrefs: 00FFFF5B

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: CalendarEnumInfo
String ID: B.C.
API String ID: 2925833060-621294921
Opcode ID: cbbe16cf5e38af22977b524e850e99ea288f72fd5d3227f5f0a83cc4d90e8fba
Instruction ID: e75e2ec7ef377b75fef7c5619559bd03b953a9e3f3850544bb6963835a1556b5
Opcode Fuzzy Hash: cbbe16cf5e38af22977b524e850e99ea288f72fd5d3227f5f0a83cc4d90e8fba
Instruction Fuzzy Hash: AC81BD71A0060A8FD720EF68C880AAA37E9EF44710F190375FA50DB3B9C775E805DB90

Function 00FFCBE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,00FFCCC5), ref: 00FFCC66
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,00FFCCC5), ref: 00FFCC6C

Strings

yyyy, xrefs: 00FFCC41
, xrefs: 00FFCC32

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 885fbc0325f5e2aab499c464b288cf7d241640889fa305ecf6142f4fb5d9f921
Instruction ID: 384de847a765332092bcbc176e40786ccb9fabffc6a2a97d4dd54c162ac0a745
Opcode Fuzzy Hash: 885fbc0325f5e2aab499c464b288cf7d241640889fa305ecf6142f4fb5d9f921
Instruction Fuzzy Hash: 7321B231A046AC9FCB11EFA4CD45AAEB3F9EF48310B5100A6F908E7351D7349E00E7A1

Function 00FF7750 Relevance: 6.2, APIs: 4, Instructions: 190fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000001,00000000,?,?,00000000,00FF79F6), ref: 00FF78A6
MapViewOfFile.KERNEL32(000003EE,00000004,00000000,00000000,00000001,00000000,00FF7983,?,?,00000000,00000002,00000000,00000001,00000000,?,?), ref: 00FF78D5
GetCurrentProcess.KERNEL32(00000104,00000000,00FF7963,?,000003EE,00000004,00000000,00000000,00000001,00000000,00FF7983,?,?,00000000,00000002,00000000), ref: 00FF78FA
UnmapViewOfFile.KERNEL32(00000000,00FF796A,000003EE,00000004,00000000,00000000,00000001,00000000,00FF7983,?,?,00000000,00000002,00000000,00000001,00000000), ref: 00FF795B

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: File$View$CreateCurrentMappingProcessUnmap
String ID:
API String ID: 585793813-0
Opcode ID: 147403e869c8418a0ab958b3621e0559973fb49354b80ce3121f079d85ecd3a2
Instruction ID: 75161c871400b2f59b1127c126506219cfd68f3ad671082e9e86fcfea57a3dc7
Opcode Fuzzy Hash: 147403e869c8418a0ab958b3621e0559973fb49354b80ce3121f079d85ecd3a2
Instruction Fuzzy Hash: CF712A31A0835DABDB21EFA5CC85BAEF7B5EF08310F5045A5E604A7290D7B89E80DF51

Function 014AF934 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 014AF968
__isleadbyte_l.LIBCMT ref: 014AF99C
MultiByteToWideChar.KERNEL32(00000080,00000009,014A6B44,?,00000000,00000000,?,?,?,?,014A6B44), ref: 014AF9CD
MultiByteToWideChar.KERNEL32(00000080,00000009,014A6B44,00000001,00000000,00000000,?,?,?,?,014A6B44), ref: 014AFA3B

Memory Dump Source

Source File: 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp, Offset: 01493000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1493000_dllhost.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 1bdd8510b75d0864e30811c123759f7dbaec827dbffa0040188402d417d68cc6
Instruction ID: 309b4241c804d2dd7cd2ef0cbdc7d9bc1709d2e61d5032193acf458319065da4
Opcode Fuzzy Hash: 1bdd8510b75d0864e30811c123759f7dbaec827dbffa0040188402d417d68cc6
Instruction Fuzzy Hash: 5E31C231600246FFDB21DF68C8909BE7FB9FF14210B96856AE5958B2B1D331E948DB50

Function 010006D0 Relevance: 6.1, APIs: 4, Instructions: 98fileCOMMON

Download Yara Rule

APIs

Part of subcall function 010004D8: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0100052F
Part of subcall function 010004D8: GetModuleFileNameW.KERNEL32(0147263C,?,00000105,?,?,00000105), ref: 0100054A
Part of subcall function 010004D8: LoadStringW.USER32(00000000,00FE8D54,?,00000100), ref: 010005E5

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 01000764
GetStdHandle.KERNEL32(000000F4,01000810,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 01000790
WriteFile.KERNEL32(00000000,000000F4,01000810,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 01000796
LoadStringW.USER32(00000000,00FE9504,?,00000040), ref: 010007BA

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: File$LoadModuleNameString$ByteCharHandleMultiWideWrite
String ID:
API String ID: 1413667788-0
Opcode ID: 8aafcd564ce04420478cc19a777e6c1dbc289f68bd851cb3cbb02e87f69c2291
Instruction ID: fbf8880df1f6ccfc877775fdd52fa0326d405c380b63c2f6e1ea32fc66715581
Opcode Fuzzy Hash: 8aafcd564ce04420478cc19a777e6c1dbc289f68bd851cb3cbb02e87f69c2291
Instruction Fuzzy Hash: 4B31B4B1644308BFF711FB94DC42FEA73ADEB04700F6040A2B648EA1D1DE786E409B65

Function 00FDF014 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 00FDF025
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 00FDF083
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 00FDF0E0
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 00FDF113

Part of subcall function 00FDEFD0: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,00FDF091), ref: 00FDEFE7
Part of subcall function 00FDEFD0: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,00FDF091), ref: 00FDF004

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: f174dff7fa579b959c1cd53b82158c2655fc522f03074dbb84d04c10505000b7
Instruction ID: 9daaaf732fae2e1c288ff8c1dae3b0f9dcc80227248a5e9a2deb1b7fcb207df7
Opcode Fuzzy Hash: f174dff7fa579b959c1cd53b82158c2655fc522f03074dbb84d04c10505000b7
Instruction Fuzzy Hash: D6314D70E0021A9BDB10EFE4CC85AAEB7BAFF04314F484576E511EB395DB749A089B91

Function 014A8A04 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 014A8A10

Part of subcall function 014A8D41: __getptd_noexit.LIBCMT ref: 014A8D44
Part of subcall function 014A8D41: __amsg_exit.LIBCMT ref: 014A8D51

__getptd.LIBCMT ref: 014A8A27
__amsg_exit.LIBCMT ref: 014A8A35
__lock.LIBCMT ref: 014A8A45

Memory Dump Source

Source File: 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp, Offset: 01493000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1493000_dllhost.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: f5168d4137185a985383dea790821e8c436fb992ffe854b8001d1293af9def24
Instruction ID: 9082dead783e8edcff3e8e711f99ba971c6ac50f195d99e027d4086fb451cb1c
Opcode Fuzzy Hash: f5168d4137185a985383dea790821e8c436fb992ffe854b8001d1293af9def24
Instruction Fuzzy Hash: A2F03032A407038FDB31BBAA841574972A4EF74712F97455F9544AB6B0CB345902CB51

Function 0100359C Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 330COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,010039A8,?,?,?,?,00000000,00000000), ref: 010036D4

Strings

.bpl, xrefs: 010036BE
SysInit, xrefs: 01003791

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID: .bpl$SysInit
API String ID: 4139908857-1949293470
Opcode ID: e8c3ae505ce2e9fbc2e1cfbfdc8438d9c3c9e8faf49643252f28e605c8836f85
Instruction ID: 431e97573fc7c5d6e17eae5e6b5a9d9cb15ebb239bb917a352fe71aa829e70b3
Opcode Fuzzy Hash: e8c3ae505ce2e9fbc2e1cfbfdc8438d9c3c9e8faf49643252f28e605c8836f85
Instruction Fuzzy Hash: 90E11874A0024ADFDB16DFA8C880ADEFBF6FF48304F148166E544AB355D734AA46CB90

Function 014A1D90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__wcstoui64.LIBCMT ref: 014A1DBC

Strings

#, xrefs: 014A1DAE

Memory Dump Source

Source File: 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp, Offset: 01493000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1493000_dllhost.jbxd

Similarity

API ID: __wcstoui64
String ID: #
API String ID: 3882282163-1885708031
Opcode ID: b0c23fe929f1919966ce0c978adfdedf5002aad59e1bf918f9ee568e5a813f01
Instruction ID: 578b462dddd2cb9c21971801d7469f436e82fd504f0dc3a5d6397603ae54326d
Opcode Fuzzy Hash: b0c23fe929f1919966ce0c978adfdedf5002aad59e1bf918f9ee568e5a813f01
Instruction Fuzzy Hash: 411129726012006FD7609B7DEC80BA737ADEBE8364F444566F80DCF395E672E8518790

Function 014AC84B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 014AC85A

Part of subcall function 014A8D41: __getptd_noexit.LIBCMT ref: 014A8D44
Part of subcall function 014A8D41: __amsg_exit.LIBCMT ref: 014A8D51

__getptd.LIBCMT ref: 014AC868

Strings

csm, xrefs: 014AC876

Memory Dump Source

Source File: 00000000.00000002.1684739707.0000000001493000.00000020.00000001.01000000.00000003.sdmp, Offset: 01493000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1493000_dllhost.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 19a090d337b5289cb2aa2f64d74c49aadee50cee4b888bae0250ae30ba76a082
Instruction ID: c3a1cec0bf064bbadc5792bbb23ea386e97590d8c9cd925069415205c768151c
Opcode Fuzzy Hash: 19a090d337b5289cb2aa2f64d74c49aadee50cee4b888bae0250ae30ba76a082
Instruction Fuzzy Hash: 550162358002069BDF759F29C48066EB7B5BF30323FD6442FD440563B1CB359685CB41

Function 01003D60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,01003E3C,00000000,01003E56,?,?,01003DF1), ref: 01003D66

Part of subcall function 00FE7288: GetProcAddress.KERNEL32(?,?), ref: 00FE72AC

Strings

GetDiskFreeSpaceExW, xrefs: 01003D71
kernel32.dll, xrefs: 01003D61

Memory Dump Source

Source File: 00000000.00000002.1683530650.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd1000_dllhost.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: 0ef5739b38d012917d70812c472a98c757a2bcc96ec72efc684ef89897e59d7f
Instruction ID: 7cfe13438d5527d22c08e38047605e1427f50cbc38393ec10df4505a8521be34
Opcode Fuzzy Hash: 0ef5739b38d012917d70812c472a98c757a2bcc96ec72efc684ef89897e59d7f
Instruction Fuzzy Hash: C9D05EA46043405FFB33BBE7EC8665673A4AB05618F10422BB2405E292D6A44405AF01

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dllhost.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: dllhost.exePID: 5480, Parent PID: 2580

General

Chronological Activities

Windows Analysis Report
dllhost.exe

Function 00FDF9B4 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Function 00FDF85C Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Function 00FDF478 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 178
registryCOMMON

Function 01001CB0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 129
registryCOMMON

Function 00FDF130 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77
COMMON

Function 00FF9588 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 63
COMMON

Function 0149A950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20
injectionCOMMON

Function 00FDAB14 Relevance: 4.6, APIs: 3, Instructions: 93
threadCOMMON

Function 00FFEEBC Relevance: 3.0, APIs: 2, Instructions: 50
windowCOMMON

Function 0149A8E0 Relevance: 3.0, APIs: 2, Instructions: 44
injectionCOMMON

Function 00FD6F3C Relevance: 2.6, APIs: 2, Instructions: 63
COMMON

Function 00FD66F8 Relevance: 2.5, APIs: 2, Instructions: 30
sleepmemoryCOMMON

Function 00FDFA84 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Function 00FDFBAC Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 010076C8 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON