Edit tour

Windows Analysis Report
eN0ONo7Zrw.exe

Overview

General Information

Sample Name:	eN0ONo7Zrw.exe
Original Sample Name:	9f88b9ae0fe7903ba4f24f0ed5de67c5.exe
Analysis ID:	1309438
MD5:	9f88b9ae0fe7903ba4f24f0ed5de67c5
SHA1:	ba2c2442644473bfec02e9c05abf9992e011a14e
SHA256:	56f15cf68dbe3cb2e751a5b82b206ce127695ce63c31c442773d45cdbd89b496
Tags:	exe
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Multi AV Scanner detection for dropped file

Machine Learning detection for sample

Machine Learning detection for dropped file

Uses 32bit PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Drops files with a non-matching file extension (content does not match file extension)

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

File is packed with WinRar

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

eN0ONo7Zrw.exe (PID: 7124 cmdline: C:\Users\user\Desktop\eN0ONo7Zrw.exe MD5: 9F88B9AE0FE7903BA4F24F0ED5DE67C5)

control.exe (PID: 6164 cmdline: "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\0C6L3.cPl", MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

rundll32.exe (PID: 6228 cmdline: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\0C6L3.cPl", MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6308 cmdline: C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\0C6L3.cPl", MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6328 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\user\AppData\Local\Temp\0C6L3.cPl", MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: eN0ONo7Zrw.exe

ReversingLabs: Detection: 42%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\0C6L3.cpl

ReversingLabs: Detection: 28%

Machine Learning detection for sample

Source: eN0ONo7Zrw.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\0C6L3.cpl

Joe Sandbox ML: detected

Source: eN0ONo7Zrw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: eN0ONo7Zrw.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: .PdB- source: 0C6L3.cpl
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: eN0ONo7Zrw.exe
Source:	Binary string: xLhH#tu@9B0OCZRwSC.pdb source: 0C6L3.cpl

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01352C15 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_01352C15
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01362D90 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_01362D90
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01371758 FindFirstFileExA,	0_2_01371758

Source: eN0ONo7Zrw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_0135B79D	0_2_0135B79D
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01373850	0_2_01373850
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01355AFD	0_2_01355AFD
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_0135C42B	0_2_0135C42B
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01373CFE	0_2_01373CFE
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_0136B4FD	0_2_0136B4FD
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_013554DD	0_2_013554DD
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01354F3C	0_2_01354F3C
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_0136B72C	0_2_0136B72C
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01377E04	0_2_01377E04
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_047C1F54	2_2_047C1F54
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_047C2B7C	2_2_047C2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_047C2F38	2_2_047C2F38
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_047C26E8	2_2_047C26E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_047C25D4	2_2_047C25D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_047C4511	2_2_047C4511
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_047C1000	2_2_047C1000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_048E55B0	2_2_048E55B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_048E5D33	2_2_048E5D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_048E8260	2_2_048E8260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_048E7F70	2_2_048E7F70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_048E8990	2_2_048E8990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_048E12C0	2_2_048E12C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_048E1050	2_2_048E1050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04741F54	4_2_04741F54
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04742B7C	4_2_04742B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04742F38	4_2_04742F38
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_047426E8	4_2_047426E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_047425D4	4_2_047425D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04744511	4_2_04744511
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04741000	4_2_04741000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048655B0	4_2_048655B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04865D33	4_2_04865D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04868260	4_2_04868260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04867F70	4_2_04867F70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04868990	4_2_04868990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048612C0	4_2_048612C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04861050	4_2_04861050

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Code function: String function: 01365690 appears 44 times

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_048E5D33 NtCreateThreadEx,		2_2_048E5D33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04865D33 NtCreateThreadEx,		4_2_04865D33

Source: eN0ONo7Zrw.exe, 00000000.00000003.236578796.00000000036C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCONTROL.EXEj% vs eN0ONo7Zrw.exe
Source: eN0ONo7Zrw.exe, 00000000.00000003.236606329.00000000036C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCONTROL.EXEj% vs eN0ONo7Zrw.exe
Source: eN0ONo7Zrw.exe, 00000000.00000003.236600715.0000000003701000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCONTROL.EXEj% vs eN0ONo7Zrw.exe

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Section loaded: dxgidebug.dll	Jump to behavior

Source: 0C6L3.cpl.0.dr	Static PE information: Section: 4E7 ZLIB complexity 0.9976371765136719
Source: 0C6L3.cpl.0.dr	Static PE information: Section: .crt0 ZLIB complexity 0.9994577700725655

Source: eN0ONo7Zrw.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

File read: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Jump to behavior

Source: eN0ONo7Zrw.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\eN0ONo7Zrw.exe C:\Users\user\Desktop\eN0ONo7Zrw.exe
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",	Jump to behavior

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6254406

Jump to behavior

Source: classification engine

Classification label: mal64.winEXE@9/1@0/0

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Code function: 0_2_01351891 GetLastError,FormatMessageW,

0_2_01351891

Source: C:\Windows\SysWOW64\control.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Code function: 0_2_013611D2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_013611D2

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Command line argument: sfxname	0_2_01364968
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Command line argument: sfxstime	0_2_01364968
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Command line argument: STARTDLG	0_2_01364968

Source: eN0ONo7Zrw.exe

Static file information: File size 2834755 > 1048576

Source: eN0ONo7Zrw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: eN0ONo7Zrw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: eN0ONo7Zrw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: eN0ONo7Zrw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: eN0ONo7Zrw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: eN0ONo7Zrw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: eN0ONo7Zrw.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: eN0ONo7Zrw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: .PdB- source: 0C6L3.cpl
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: eN0ONo7Zrw.exe
Source:	Binary string: xLhH#tu@9B0OCZRwSC.pdb source: 0C6L3.cpl

Source: eN0ONo7Zrw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: eN0ONo7Zrw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: eN0ONo7Zrw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: eN0ONo7Zrw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: eN0ONo7Zrw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01366260 push ecx; ret	0_2_01366273
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01365668 push eax; ret	0_2_01365686
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_048E1810 push esi; mov dword ptr [esp], 80B9FF70h	2_2_048E1811
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04861810 push esi; mov dword ptr [esp], 80B9FF70h	4_2_04861811

Source: eN0ONo7Zrw.exe	Static PE information: section name: .didat
Source: 0C6L3.cpl.0.dr	Static PE information: section name: 4E7
Source: 0C6L3.cpl.0.dr	Static PE information: section name: CRT
Source: 0C6L3.cpl.0.dr	Static PE information: section name: .crt0

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6254406

Jump to behavior

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

File created: C:\Users\user\AppData\Local\Temp\0C6L3.cpl

Jump to dropped file

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

File created: C:\Users\user\AppData\Local\Temp\0C6L3.cpl

Jump to dropped file

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Code function: 0_2_013650C6 VirtualQuery,GetSystemInfo,

0_2_013650C6

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01352C15 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_01352C15
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01362D90 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_01362D90
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01371758 FindFirstFileExA,	0_2_01371758

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

API call chain: ExitProcess graph end node

graph_0-23000

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Code function: 0_2_0136A24F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0136A24F

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Code function: 0_2_01372440 GetProcessHeap,

0_2_01372440

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Code function: 0_2_0136E3C2 mov eax, dword ptr fs:[00000030h]

0_2_0136E3C2

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01366195 SetUnhandledExceptionFilter,	0_2_01366195
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_013663EA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_013663EA
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_0136A24F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0136A24F
Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Code function: 0_2_01365FF2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_01365FF2

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",			Jump to behavior

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_01361B15

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Code function: 0_2_01356B0D cpuid

0_2_01356B0D

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Code function: 0_2_01364968 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_01364968

Source: C:\Users\user\Desktop\eN0ONo7Zrw.exe

Code function: 0_2_01352D8E GetVersionExW,

0_2_01352D8E

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	12 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	2 Obfuscated Files or Information	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Software Packing	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
eN0ONo7Zrw.exe	42%	ReversingLabs	Win32.Trojan.Uztuby
eN0ONo7Zrw.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\0C6L3.cpl	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\0C6L3.cpl	29%	ReversingLabs	Win32.Dropper.Generic

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1309438
Start date and time:	2023-09-16 13:48:08 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	eN0ONo7Zrw.exe
Original Sample Name:	9f88b9ae0fe7903ba4f24f0ed5de67c5.exe
Detection:	MAL
Classification:	mal64.winEXE@9/1@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 120 Number of non-executed functions: 69
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Users\user\Desktop\eN0ONo7Zrw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2846720
Entropy (8bit):	7.907946029142491
Encrypted:	false
SSDEEP:	49152:f9voilHbQqe8rxSHpn1erjTYzz5YOfXemLgrEpjz7sEKFd:TqDAxOerj0HfJpnobd
MD5:	1520885263BE005F93DD29C815D60512
SHA1:	9D71042E013D116D6072E91695EF181740D3E6FC
SHA-256:	6B08E4C932E76CED158B8D474B57327597C3889F519F5CFE96BB7D07F67C6E2B
SHA-512:	D393416274F095ED614632D2D6F6A4D0666329030304B310C331F4921A97D646A08DB8523E654436543865E0EDCB5789B7F8F2952EA0B867E2521E65478316F8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:.S.[m..[m..[m..,..Q[m...l..Zm.....[m.O...&Zm..[l..[m.a...Zm.....^Zm...l..[m..,...Zm......[m.....Y[m.....[m.....[m.....M[m...l.@Zm.."...Zm.."...[m..#..@Zm.....`Zm..-...[m.....EZm.O....Zm..#..PZm...h..Zm...o.7[m.Rich.[m.................................................................................PE..L..._..e...........!......... ...............@................................+.......+.................................Y...,........`......................p.X.......8............................................................................text...7u.......................... ..`.rdata..s...........................e..@.data...............................@...4E7..........@.......0..............@...CRT.....\|j...@...p...0..............@....crt0..."...........................@....rsrc........`......P................@.reloc..R....p......`.............@..B

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9629842152105175
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	eN0ONo7Zrw.exe
File size:	2'834'755 bytes
MD5:	9f88b9ae0fe7903ba4f24f0ed5de67c5
SHA1:	ba2c2442644473bfec02e9c05abf9992e011a14e
SHA256:	56f15cf68dbe3cb2e751a5b82b206ce127695ce63c31c442773d45cdbd89b496
SHA512:	ed0201d431777db69d1838e1303ba17c234dd1a11d114373996150b9c7ae55f849f383b8b0a3a75411ef378a1ca906e3777e7e0478c5db6fae73fe84a4d53039
SSDEEP:	49152:acbz6gQjfbaqO2L9SH1Vrg5RHkzx5YDuHfhemBaREzjVfsMMd1zD:acbPQCRS9Wg5REOuHf9zBEn13
TLSH:	EDD5233176C28675E46329324BA59636BF7C7C700722CADB23581E5E8FB42C1A9347B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=LF.S.F.S.F.S..$..K.S..$....S..$..^.S.....D.S...W.U.S...P.Q.S...V.t.S.O...M.S.O...A.S.F.R.N.S...V.`.S...S.G.S.....G.S...Q.G.S

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x415de0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x64C8CFB7 [Tue Aug 1 09:26:15 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fa8d20faea9ef7b4e2b7fbfe93442593

Entrypoint Preview

Instruction
call 00007FCD587DE151h
jmp 00007FCD587DDAEDh
jmp 00007FCD587E22FFh
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FCD587DD367h
push 00431B08h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FCD587DEA8Ah
int3
push ebp
mov ebp, esp
and dword ptr [004692A8h], 00000000h
sub esp, 24h
or dword ptr [00434674h], 01h
push 0000000Ah
call dword ptr [00429170h]
test eax, eax
je 00007FCD587DDE22h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-20h]
mov dword ptr [ebp-0Ch], eax
xor edi, 756E6547h
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr [ebp-1Ch]
xor eax, 6C65746Eh
mov dword ptr [ebp-08h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
nop
lea ebx, dword ptr [ebp-24h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-04h]
or eax, dword ptr [ebp-08h]
or eax, edi
mov dword ptr [ebx+04h], esi
mov dword ptr [ebx+08h], ecx
mov dword ptr [ebx+0Ch], edx
jne 00007FCD587DDCB5h
mov eax, dword ptr [ebp-24h]
and eax, 0FFF3FF0h
cmp eax, 000106C0h
je 00007FCD587DDC95h

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x32a30	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x32a64	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6b000	0xdff8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x79000	0x2954	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x30e40	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2b338	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x29000	0x22c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3205c	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x27d0c	0x27e00	False	0.5858946414576802	data	6.69415089194142	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x29000	0xa6e6	0xa800	False	0.4578218005952381	data	5.246739495724833	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x34000	0x35ca0	0x1000	False	0.41455078125	DOS executable (block device driver w{\362ko\3050)	4.160089790234222	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x6a000	0x178	0x200	False	0.4296875	data	3.2022535810191277	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6b000	0xdff8	0xe000	False	0.6373639787946429	data	6.6386075857660645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x79000	0x2954	0x2a00	False	0.7797619047619048	data	6.703800314116885	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x6b650	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x6c198	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x6d748	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.47832369942196534
RT_ICON	0x6dcb0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.5410649819494585
RT_ICON	0x6e558	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4933368869936034
RT_ICON	0x6f400	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.5390070921985816
RT_ICON	0x6f868	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.41393058161350843
RT_ICON	0x70910	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.3479253112033195
RT_ICON	0x72eb8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809269502193401
RT_DIALOG	0x77588	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x77358	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x77498	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x77228	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x76ef0	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x76c98	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x77f68	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x78150	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x78320	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x784d8	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x78620	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x78a90	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x78bf8	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x78d50	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x78e60	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x78f20	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x76c30	0x68	data	English	United States	0.7019230769230769
RT_MANIFEST	0x77810	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	GetLastError, SetLastError, FormatMessageW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileTime, CloseHandle, CreateFileW, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, DeleteFileW, MoveFileW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetTimeFormatW, GetDateFormatW, LocalFree, GetCurrentProcess, GetExitCodeProcess, WaitForSingleObject, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, GetOEMCP, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetCommandLineA
OLEAUT32.dll	VariantClear
gdiplus.dll	GdipCreateBitmapFromStream, GdipAlloc, GdipCloneImage, GdipDisposeImage, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	13:48:55
Start date:	16/09/2023
Path:	C:\Users\user\Desktop\eN0ONo7Zrw.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\eN0ONo7Zrw.exe
Imagebase:	0x1350000
File size:	2'834'755 bytes
MD5 hash:	9F88B9AE0FE7903BA4F24F0ED5DE67C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:48:56
Start date:	16/09/2023
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",
Imagebase:	0x1140000
File size:	114'688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:48:56
Start date:	16/09/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",
Imagebase:	0xc00000
File size:	61'952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:49:05
Start date:	16/09/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",
Imagebase:	0x7ff6d38f0000
File size:	69'632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:49:05
Start date:	16/09/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\user\AppData\Local\Temp\0C6L3.cPl",
Imagebase:	0xc00000
File size:	61'952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	34

Executed Functions

Function 01364968 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 202
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01356BE4: GetModuleHandleW.KERNEL32(kernel32), ref: 01356BFD
Part of subcall function 01356BE4: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 01356C0F
Part of subcall function 01356BE4: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 01356C40

Part of subcall function 0136115D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 01361165

Part of subcall function 0136181B: OleInitialize.OLE32(00000000), ref: 01361834
Part of subcall function 0136181B: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0136186B
Part of subcall function 0136181B: SHGetMalloc.SHELL32(0139F948), ref: 01361875

GetCommandLineW.KERNEL32 ref: 013649A7
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 013649D1
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007402), ref: 013649E2
UnmapViewOfFile.KERNEL32(00000000), ref: 01364A33

Part of subcall function 01364676: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0136468C
Part of subcall function 01364676: SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 013646C8

Part of subcall function 01355A27: _wcslen.LIBCMT ref: 01355A4B

CloseHandle.KERNEL32(00000000), ref: 01364A3A
GetModuleFileNameW.KERNEL32(00000000,013B6210,00000800), ref: 01364A54
SetEnvironmentVariableW.KERNEL32(sfxname,013B6210), ref: 01364A60
GetLocalTime.KERNEL32(?), ref: 01364A6B
_swprintf.LIBCMT ref: 01364AAA
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 01364ABF
GetModuleHandleW.KERNEL32(00000000), ref: 01364AC6
LoadIconW.USER32(00000000,00000064), ref: 01364ADD
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00012350,00000000), ref: 01364B2E
Sleep.KERNEL32(?), ref: 01364B5C
DeleteObject.GDI32 ref: 01364B95
DeleteObject.GDI32(?), ref: 01364BA5
CloseHandle.KERNEL32 ref: 01364BE8

Strings

STARTDLG, xrefs: 01364B23
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 01364A9B
sfxname, xrefs: 01364A5B
sfxstime, xrefs: 01364ABA
winrarsfxmappingfile.tmp, xrefs: 013649C5

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf_wcslen
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3014515783-3710569615
Opcode ID: 997cdcc13cc0db9cfb9180315f4af2b836023ec298b80ca8f1ba74170a610a02
Instruction ID: aa9c4429d49d2096a1ba831a0065919b64724955acdcefc804962beef0c1ba8f
Opcode Fuzzy Hash: 997cdcc13cc0db9cfb9180315f4af2b836023ec298b80ca8f1ba74170a610a02
Instruction Fuzzy Hash: A061E371904301BFD731AB69EC89F6B3FACEB9475DF044519FA45A3288EB388844C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 013611D2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,013622AD,00000066), ref: 013611E5
SizeofResource.KERNEL32(00000000,?,?,?,013622AD,00000066), ref: 013611FC
LoadResource.KERNEL32(00000000,?,?,?,013622AD,00000066), ref: 01361213
LockResource.KERNEL32(00000000,?,?,?,013622AD,00000066), ref: 01361222
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,013622AD,00000066), ref: 0136123D
GlobalLock.KERNEL32 ref: 0136124E
GlobalUnlock.KERNEL32(00000000), ref: 013612D6

Part of subcall function 01361136: GdipAlloc.GDIPLUS(00000010), ref: 0136113C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 013612B7
GlobalFree.KERNEL32 ref: 013612DD

Strings

PNG, xrefs: 013611D6

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: c279e794244d1aaf7dc6f46939e61b5174bf16980a257f170fc0705303980557
Instruction ID: 6e944766edd9fcabdca3bc7a0bba5b818d8ac3b4f1a1cd8908c817ec939e275e
Opcode Fuzzy Hash: c279e794244d1aaf7dc6f46939e61b5174bf16980a257f170fc0705303980557
Instruction Fuzzy Hash: EF3130B1600716AFD7329F65EC49A1B7FBCFF857A9B048619F905D2258EB31D800CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01352C15 Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 01352C3E

Part of subcall function 013535E5: _wcslen.LIBCMT ref: 01353609

FindFirstFileW.KERNELBASE(?,?,?,?,00000800), ref: 01352C6C
GetLastError.KERNEL32(?,?,00000800), ref: 01352C78
FindNextFileW.KERNEL32(?,?), ref: 01352CA2
GetLastError.KERNEL32 ref: 01352CAE

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: b64b79b6e282a7015709660861e5df110464cca608543286059c0070816b7ca2
Instruction ID: 4bdbc83d45522c7721f35022b0aa54b360ad2662d9bc90c957e8d3cbe57198f6
Opcode Fuzzy Hash: b64b79b6e282a7015709660861e5df110464cca608543286059c0070816b7ca2
Instruction Fuzzy Hash: 23415E72900519EBCB65DF68CC84FEAB7B8BB48754F000696ED5DE3201D774AA94CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0136E3C2 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,0136E398,00000003,01381D50,0000000C,0136E4EF,00000003,00000002,00000000,?,0136F382,00000003), ref: 0136E3E3
TerminateProcess.KERNEL32(00000000,?,0136E398,00000003,01381D50,0000000C,0136E4EF,00000003,00000002,00000000,?,0136F382,00000003), ref: 0136E3EA
ExitProcess.KERNEL32 ref: 0136E3FC

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: dff43044a1c8382bafc2a98a21bcefaf4ad20535e290abda34e7982b6ecb13e9
Instruction ID: 2ebd923771b4a0dc040c2154ce5f7df823ee6ab9c9bde5ef82286c8fa3a7c848
Opcode Fuzzy Hash: dff43044a1c8382bafc2a98a21bcefaf4ad20535e290abda34e7982b6ecb13e9
Instruction Fuzzy Hash: 71E04F31000154EBCF22AF68D90CB493B2DEB00369F008424F90556125DB35D942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0135B79D Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

c, xrefs: 0135BAAE

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: ca50c9bdd23865e4813df8a5e38717c3af6fb7460c344940e44bf027378a24b8
Instruction ID: 19797d3f956721bc5640171de5e85a542e8a9163cb7a4118ac8e6727df076ef2
Opcode Fuzzy Hash: ca50c9bdd23865e4813df8a5e38717c3af6fb7460c344940e44bf027378a24b8
Instruction Fuzzy Hash: D2E16971A083958FC765DF28D480A6EFBE6BBC8B08F00492EE89997345D730E845CF52

Uniqueness

Uniqueness Score: -1.00%

Function 01366195 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_000161B0,01365C55), ref: 0136619A

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6dc97d1ce587b2b80ee85b0f2bc79ac4046790399f18f0dd572a18a377819acd
Instruction ID: 20ccef9f79a798011f8ffb2d1ac22a10967d38d6a39393885e07e7b6c4c57084
Opcode Fuzzy Hash: 6dc97d1ce587b2b80ee85b0f2bc79ac4046790399f18f0dd572a18a377819acd
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 01362350 Relevance: 102.2, APIs: 49, Strings: 9, Instructions: 730windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01362355

Part of subcall function 013511C6: GetDlgItem.USER32(00000000,00003021), ref: 0135120A
Part of subcall function 013511C6: SetWindowTextW.USER32(00000000,01379584), ref: 01351220

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 01362441
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0136245F
IsDialogMessageW.USER32(?,?), ref: 01362472
TranslateMessage.USER32(?), ref: 01362480
DispatchMessageW.USER32(?), ref: 0136248A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 013624AD
EndDialog.USER32(?,00000001), ref: 013624D0
GetDlgItem.USER32(?,00000068), ref: 013624F3
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0136250E
SendMessageW.USER32(00000000,000000C2,00000000,01379584), ref: 01362521

Part of subcall function 01363F05: _wcslen.LIBCMT ref: 01363F2F

SetFocus.USER32(00000000), ref: 01362528
_swprintf.LIBCMT ref: 01362587

Part of subcall function 01352AA2: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01352AB5

GetLastError.KERNEL32(00000000,?), ref: 013625EA
GetLastError.KERNEL32(?,00000000,?), ref: 01362612
GetTickCount.KERNEL32 ref: 01362630
_swprintf.LIBCMT ref: 01362648
GetLastError.KERNEL32 ref: 0136267A
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,00000000,?), ref: 013626CD
_swprintf.LIBCMT ref: 01362704
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007402,winrarsfxmappingfile.tmp), ref: 01362758
GetCommandLineW.KERNEL32 ref: 0136276E
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,013A696A,00000400,00000001,00000001), ref: 013627C5
ShellExecuteExW.SHELL32(0000003C), ref: 013627ED
WaitForInputIdle.USER32(?,00002710), ref: 01362821
Sleep.KERNEL32(00000064), ref: 01362835
UnmapViewOfFile.KERNEL32(?,?,0000421C,013A696A,00000400), ref: 0136285E
CloseHandle.KERNEL32(00000000), ref: 01362867
_swprintf.LIBCMT ref: 0136289A
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 013628F9
SetDlgItemTextW.USER32(?,00000065,01379584), ref: 01362910
GetDlgItem.USER32(?,00000065), ref: 01362919
GetWindowLongW.USER32(00000000,000000F0), ref: 01362928
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 01362937
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 013629E4
_wcslen.LIBCMT ref: 01362A3A
_swprintf.LIBCMT ref: 01362A64
SendMessageW.USER32(?,00000080,00000001,?), ref: 01362AAE
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 01362AC8
GetDlgItem.USER32(?,00000068), ref: 01362AD1
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 01362AE7
GetDlgItem.USER32(?,00000066), ref: 01362B01
SetWindowTextW.USER32(00000000,013A8D8A), ref: 01362B23
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 01362B78
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 01362B8B
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_00012130,00000000,?), ref: 01362C2E
EnableWindow.USER32(00000000,00000000), ref: 01362D08
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 01362D4A

Part of subcall function 013631F1: __EH_prolog.LIBCMT ref: 013631F6

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 01362D6E

Strings

STARTDLG, xrefs: 01362371
__tmp_rar_sfx_access_check_%u, xrefs: 01362637
%s, xrefs: 01362A54
"%s"%s, xrefs: 01362889
<, xrefs: 0136270C
LICENSEDLG, xrefs: 01362C23
-el -s2 "-d%s" "-sp%s", xrefs: 013626F3
@, xrefs: 01362719
winrarsfxmappingfile.tmp, xrefs: 0136272E

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Item$MessageText$Send$Window_swprintf$File$DialogErrorLast$H_prologLongView_wcslen$CloseCommandCountCreateDispatchEnableExecuteFocusHandleIdleInputLineMappingModuleNameParamShellSleepTickTranslateUnmapWait__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3103142498-1645151803
Opcode ID: d748e414adcbdb5342213d6ada2cb237cee936e9d0f035f064ccc012a1fc9c99
Instruction ID: 516881fd3802159546e8a5dff82df93a2d61cb83b668bf725dc11af219eede01
Opcode Fuzzy Hash: d748e414adcbdb5342213d6ada2cb237cee936e9d0f035f064ccc012a1fc9c99
Instruction Fuzzy Hash: 5D42F471A44249BEEB32AB68DC89FBF3B7CAB1170CF058154FA40B61C9D7794984CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01356BE4 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 01356BFD
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 01356C0F
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 01356C40
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 01356EEA
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 01356F04
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 01356F14
ReadFile.KERNEL32(00000000,?,00007FFE,0137987C,00000000), ref: 01356F32
CloseHandle.KERNEL32(00000000), ref: 01356F8A
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 01356F9F
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,0137987C,?,00000000,?,00000800), ref: 01356FF3
GetFileAttributesW.KERNELBASE(?,?,0137987C,00000800,?,00000000,?,00000800), ref: 0135701D
GetFileAttributesW.KERNEL32(?,?,01379944,00000800), ref: 01357059

Part of subcall function 01356B9C: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 01356BB7
Part of subcall function 01356B9C: LoadLibraryW.KERNELBASE(?,?,0135590F,Crypt32.dll,00000000,01355989,?,?,0135596C,00000000,00000000,?,00000000), ref: 01356BD9

_swprintf.LIBCMT ref: 013570CB
_swprintf.LIBCMT ref: 01357117

Part of subcall function 01352AA2: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01352AB5

AllocConsole.KERNEL32 ref: 0135711F
GetCurrentProcessId.KERNEL32 ref: 01357129
AttachConsole.KERNEL32(00000000), ref: 01357130
_wcslen.LIBCMT ref: 01357145
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 01357156
WriteConsoleW.KERNEL32(00000000), ref: 0135715D
Sleep.KERNEL32(00002710), ref: 01357168
FreeConsole.KERNEL32 ref: 0135716E
ExitProcess.KERNEL32 ref: 01357176

Strings

dwmapi.dll, xrefs: 01356CA8, 0135708E
DXGIDebug.dll, xrefs: 01356C7D, 01356FDF
kernel32, xrefs: 01356BF4
uxtheme.dll, xrefs: 01357098
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 01357105
SetDllDirectoryW, xrefs: 01356C09
SetDefaultDllDirectories, xrefs: 01356C3A

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: 55f5aa91a26eed75340dfee04ed824d830580c4cc36379795138de6cace23650
Instruction ID: 891191643816e605c6eb03cff92a59dede7f00932603763b334b397024feb79b
Opcode Fuzzy Hash: 55f5aa91a26eed75340dfee04ed824d830580c4cc36379795138de6cace23650
Instruction Fuzzy Hash: 60D14FB54083859BE7759F54C848FDFBBECBB8572CF900A1DE58996240DB38854CCBA2

Uniqueness

Uniqueness Score: -1.00%

Function 013631F1 Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 013631F6

Part of subcall function 01361E84: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 01361F6B

_wcslen.LIBCMT ref: 013634BC
_wcslen.LIBCMT ref: 013634C5
SetWindowTextW.USER32(?,?), ref: 01363523
_wcslen.LIBCMT ref: 01363565
_wcsrchr.LIBVCRUNTIME ref: 013636AD
GetDlgItem.USER32(?,00000066), ref: 013636E8
SetWindowTextW.USER32(00000000,?), ref: 013636F8
SendMessageW.USER32(00000000,00000143,00000000,013A8D8A), ref: 01363706
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 01363731

Strings

ProgramFilesDir, xrefs: 013635F7
Software\Microsoft\Windows\CurrentVersion, xrefs: 013635CC
<br>, xrefs: 01363486
%s.%d.tmp, xrefs: 013633F2

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: 79b0f772df9ba178c91e53d7e967e13c89ab6babed7b4539869477c1bfb9c7b2
Instruction ID: ea08cc79170d9ebd57bf3bc5e90502079043e5d7db649334fd194761fea23d78
Opcode Fuzzy Hash: 79b0f772df9ba178c91e53d7e967e13c89ab6babed7b4539869477c1bfb9c7b2
Instruction Fuzzy Hash: ACE17672D00119AADF35DBA8DC84EEE77BCFF04758F4484A5E60DE7148EB749A848B60

Uniqueness

Uniqueness Score: -1.00%

Function 01353FF7 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01354000
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0135403C

Part of subcall function 01353919: _wcslen.LIBCMT ref: 01353921

Part of subcall function 01356934: _wcslen.LIBCMT ref: 0135693A

Part of subcall function 01357956: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,013535CB,00000000,?,?), ref: 01357972

_wcslen.LIBCMT ref: 01354379
__fprintf_l.LIBCMT ref: 013544AC

Strings

@%s:, xrefs: 01354496, 013544A2
*messages***, xrefs: 01354151
*messages***, xrefs: 0135418A
a, xrefs: 013541A6
, xrefs: 013542FC
$%s:, xrefs: 0135448F
R, xrefs: 0135419C
,, xrefs: 013544E7
RTL, xrefs: 0135446E

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: 7a456ef4a0e6907dceeeb8a15ab8ba08cb6a47ed6d97d292b11fb22915f29bfe
Instruction ID: 2c983b41035003014ebb1383513d64cdce166a9d75df00e58b92af7bbca0caa2
Opcode Fuzzy Hash: 7a456ef4a0e6907dceeeb8a15ab8ba08cb6a47ed6d97d292b11fb22915f29bfe
Instruction Fuzzy Hash: 3E32DF71A00219EBDB69DF68C844FED7BB8FF14B28F40415AFE0597290E7719984CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01358FC3 Relevance: 22.4, APIs: 5, Strings: 7, Instructions: 1383COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01358FCC
_wcslen.LIBCMT ref: 013594F1
__allrem.LIBCMT ref: 01359764
__allrem.LIBCMT ref: 013597E4
_wcslen.LIBCMT ref: 01359F60

Strings

zipx, xrefs: 01359665
AES-0017, xrefs: 013593C5
0C6L3.cpl, xrefs: 0135912E, 0135920D, 01359218, 01359224, 01359225, 013592D6, 013593CA, 01359480, 013594EC, 013594F8, 01359538, 013599D9, 01359A00, 01359A8E, 01359A98, 01359AA6, 01359AA7, 01359B24, 01359B3D, 01359B43, 01359B85, 01359B86, 01359C73, 01359E3B, 01359E47, 01359EA4, 01359EC9, 01359EE1, 01359EF5, 01359F0A, 01359F14, 01359F5B, 01359F67, 01359FDA, 0135A069, 0135A0B8
x, xrefs: 013590A6
zx01, xrefs: 01359599
z01, xrefs: 013595A0, 013595AA
zip, xrefs: 0135966C, 01359676

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: __allrem_wcslen$H_prolog
String ID: 0C6L3.cpl$AES-0017$x$z01$zip$zipx$zx01
API String ID: 2085098250-1085946349
Opcode ID: aca2933ee44155b9a2da0844a66bf688a728fbfdb1b663ed5d021bac4b37ed8d
Instruction ID: 0bb510a69df83064aaea21f7525c5ac5805e46610651837421e6a9d6ea62181e
Opcode Fuzzy Hash: aca2933ee44155b9a2da0844a66bf688a728fbfdb1b663ed5d021bac4b37ed8d
Instruction Fuzzy Hash: 6BB2CC71900259DFEFA5DF29D890FAD7BB9BB08B1CF14012AED0597285E731D984CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01363F86 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 013620D8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 013620E9
Part of subcall function 013620D8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 013620FA
Part of subcall function 013620D8: IsDialogMessageW.USER32(?,?), ref: 0136210E
Part of subcall function 013620D8: TranslateMessage.USER32(?), ref: 0136211C
Part of subcall function 013620D8: DispatchMessageW.USER32(?), ref: 01362126

GetDlgItem.USER32(00000068,013B7248), ref: 01363F9A
ShowWindow.USER32(00000000,00000005,?,?,?,01361B0D,00000001,?,?,01362329,0137ADA0,013B7248,013B7248,00001000,00000000,00000000), ref: 01363FC2
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 01363FCD
SendMessageW.USER32(00000000,000000C2,00000000,01379584), ref: 01363FDB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 01363FF1
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0136400B
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0136404F
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0136405D
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0136406C
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 01364093
SendMessageW.USER32(00000000,000000C2,00000000,01379F1C), ref: 013640A2

Strings

\, xrefs: 01363FFB

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 8c3bd9991865436f0341ace3bbc9665f4f4dfa311373c8ac28620ad51ebe21eb
Instruction ID: b15a6779e3ec743429c15abb48af274b6b64b54563fccb5e348cebe4cfc856ff
Opcode Fuzzy Hash: 8c3bd9991865436f0341ace3bbc9665f4f4dfa311373c8ac28620ad51ebe21eb
Instruction Fuzzy Hash: 7C312471149B04BFE3219F24DC88FAF7FACEB82719F000508F642D7284D765494D8BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0136424F Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 184
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0136426E
ShellExecuteExW.SHELL32(?), ref: 0136439E
IsWindowVisible.USER32(?), ref: 013643D1
ShowWindow.USER32(?,00000000), ref: 013643DD
WaitForInputIdle.USER32(?,000007D0), ref: 013643EE
GetExitCodeProcess.KERNELBASE(?,?), ref: 01364419
CloseHandle.KERNEL32(?), ref: 0136443F
ShowWindow.USER32(?,00000001), ref: 013644A1

Strings

.exe, xrefs: 01364449
.inf, xrefs: 0136435A

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_wcslen
String ID: .exe$.inf
API String ID: 3646668279-3750412487
Opcode ID: 6ddd2827d98dc5a7c2d44e4ad312eb4ca899d8385648daba1330cc4dd4fee4d9
Instruction ID: 1e678e1356cd465642064b50fc0753c9a6b4c0fba11f405b6a3da72696eeb390
Opcode Fuzzy Hash: 6ddd2827d98dc5a7c2d44e4ad312eb4ca899d8385648daba1330cc4dd4fee4d9
Instruction Fuzzy Hash: B351F5319087819AE7329F68D444AAB7BECAF8174CF54841DEAC0A728DE771C494CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0135D2E8 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 307
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 0135D3B2
_strncpy.LIBCMT ref: 0135D49A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0135D4D8
_strncpy.LIBCMT ref: 0135D5B1

Strings

CA+, xrefs: 0135D5F6, 0135D602
CA+, xrefs: 0135D2EC, 0135D343

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _strncpy$Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID: CA+$CA+
API String ID: 2527496121-2194209714
Opcode ID: f4c6c5d439aa70642274f79efebcbb2c7141a063160cfa0dd70b88778f4af95e
Instruction ID: 7fd65152aa5dba481fb05c37f354dc1b35fbe4b8d3324419f9e15ecc6c3acc54
Opcode Fuzzy Hash: f4c6c5d439aa70642274f79efebcbb2c7141a063160cfa0dd70b88778f4af95e
Instruction Fuzzy Hash: DDB19EB1504316DFD765EF68D890A2A7BEDFB88718F050A3EE845D3248F732E9058B91

Uniqueness

Uniqueness Score: -1.00%

Function 01370D74 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0136BD5E,0136BD5E,?,?,?,01370FC5,00000001,00000001,F4E85006), ref: 01370DCE
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,01370FC5,00000001,00000001,F4E85006,?,?,?), ref: 01370E54
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,F4E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 01370F4E
__freea.LIBCMT ref: 01370F5B

Part of subcall function 0136F9E5: RtlAllocateHeap.NTDLL(00000000,?,?,?,0136A7E9,?,0000015D,?,?,?,?,0136BCC5,000000FF,00000000,?,?), ref: 0136FA17

__freea.LIBCMT ref: 01370F64
__freea.LIBCMT ref: 01370F89

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 1c433c8ffbf9b0bc500424cbdf89e222c6d95a196d2da2fdd7507eae4d69bc1e
Instruction ID: edaff574877ae2f39e149ff3248b4a16bf2fb9809a5291aec77cd14974b2d88b
Opcode Fuzzy Hash: 1c433c8ffbf9b0bc500424cbdf89e222c6d95a196d2da2fdd7507eae4d69bc1e
Instruction Fuzzy Hash: C451E172610217AFEB398F68CC81FAF7BA9EB56758F144628FD08D6180DB78DC54C690

Uniqueness

Uniqueness Score: -1.00%

Function 0135723D Relevance: 9.1, APIs: 6, Instructions: 98
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 01357295

Part of subcall function 01352D8E: GetVersionExW.KERNEL32(?), ref: 01352DB3

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 013572B9
FileTimeToSystemTime.KERNEL32(?,?), ref: 013572D3
TzSpecificLocalTimeToSystemTime.KERNELBASE(00000000,?,?), ref: 013572E6
SystemTimeToFileTime.KERNEL32(?,?), ref: 013572F6
SystemTimeToFileTime.KERNEL32(?,?), ref: 01357306

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 0a7990070beadbe03f77128df13edc78267fee5ecee76e9f6ef79b23e0be2045
Instruction ID: 9c8363eee6d3ed38e254ac25665c0dfb3dd38e0754cd2b5747b87e76be3dba1f
Opcode Fuzzy Hash: 0a7990070beadbe03f77128df13edc78267fee5ecee76e9f6ef79b23e0be2045
Instruction Fuzzy Hash: 7E31E479118356AFC714DFA8C88499BB7E8BF88618F444A1AF999C3210E730D509CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 013646D3 Relevance: 9.0, APIs: 6, Instructions: 42
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 013646DF
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 013646F9
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0136470A
TranslateMessage.USER32(?), ref: 01364714
DispatchMessageW.USER32(?), ref: 0136471E
WaitForSingleObject.KERNEL32(?,0000000A), ref: 01364729

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 873b37cfa7bed21e28fa9f237b3536ba6100dac030fe3d5fd589d05ac5f4368a
Instruction ID: 4d73a9f2761aecff579809b7904321a201a40428196a2b82e7a9c2780f2f268d
Opcode Fuzzy Hash: 873b37cfa7bed21e28fa9f237b3536ba6100dac030fe3d5fd589d05ac5f4368a
Instruction Fuzzy Hash: 0EF03C72A01129FBCB315AA5DC8DDDB7F6DEF423A5F008411F606D2048E6388505C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 013616C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 013616D7
SHAutoComplete.SHLWAPI(?,00000010), ref: 0136170E

Part of subcall function 01357D7D: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,01353108,?,?,?,013530B5,?,-00000002,?,00000000,?), ref: 01357D93

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 013616FE

Strings

EDIT, xrefs: 013616E2, 013616ED, 013616FA
pl9u, xrefs: 0136170E

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT$pl9u
API String ID: 4243998846-2836395951
Opcode ID: c4a1ba63fad62f3e1e151b445c4573b8e18c59961645c8eaa620a0ab4d86e61e
Instruction ID: d0774ef6576cc41738da1bdb8b4a6e7206ed7c0767f0809a0960dff681b99fe2
Opcode Fuzzy Hash: c4a1ba63fad62f3e1e151b445c4573b8e18c59961645c8eaa620a0ab4d86e61e
Instruction Fuzzy Hash: 18F0827360072867EB3056189C49FDB7A6C9B86B49F440011BF41F3184E768D50587B5

Uniqueness

Uniqueness Score: -1.00%

Function 01351EE0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000), ref: 01351F5F
GetLastError.KERNEL32 ref: 01351F6C
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800), ref: 01351FA2
GetLastError.KERNEL32 ref: 01351FAA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000), ref: 01351FF9

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: e9974840ed2dd8ad74f5254be02c1ed0cd8e634e4badc613df94b0d0684cac30
Instruction ID: d0c426d0c7228575768c04cddc64c02ad0dedce9b1eb5a3cf26aa575943bd928
Opcode Fuzzy Hash: e9974840ed2dd8ad74f5254be02c1ed0cd8e634e4badc613df94b0d0684cac30
Instruction Fuzzy Hash: 06312330544346AFE3719F28CC45FEABBA8BB14B38F100B19FDA1961C1C3B5A188CB91

Uniqueness

Uniqueness Score: -1.00%

Function 013620D8 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 013620E9
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 013620FA
IsDialogMessageW.USER32(?,?), ref: 0136210E
TranslateMessage.USER32(?), ref: 0136211C
DispatchMessageW.USER32(?), ref: 01362126

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 77591dde887d41ba74d8b07748d3b8a71d70d91a6f099d0396b81bfceace764e
Instruction ID: 8046838592a5571a33a01afb995cd12a6853986f921f0802d10e6e6c87d91607
Opcode Fuzzy Hash: 77591dde887d41ba74d8b07748d3b8a71d70d91a6f099d0396b81bfceace764e
Instruction Fuzzy Hash: BAF0B77590222AABDB20ABF6EC8CDEB7F7CEE05294B014414F705D3148F668D105CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 0136181B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01356B9C: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 01356BB7
Part of subcall function 01356B9C: LoadLibraryW.KERNELBASE(?,?,0135590F,Crypt32.dll,00000000,01355989,?,?,0135596C,00000000,00000000,?,00000000), ref: 01356BD9

OleInitialize.OLE32(00000000), ref: 01361834
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0136186B
SHGetMalloc.SHELL32(0139F948), ref: 01361875

Strings

riched20.dll, xrefs: 01361823

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: b4be1f02790c697785a5a140d42c5c2b867b5afeaf43980a73e5565f438026f4
Instruction ID: 0a01f26b126772dd4be456c23fb7ac4021f988b6e542fe6069702d124b7ddbb9
Opcode Fuzzy Hash: b4be1f02790c697785a5a140d42c5c2b867b5afeaf43980a73e5565f438026f4
Instruction Fuzzy Hash: 02F01DB1D00209ABCB60AF9AD8499EFFFFCEF94755F00405AE915E3204D7B45605CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01364676 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0136468C
SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 013646C8

Strings

sfxpar, xrefs: 013646C3
sfxcmd, xrefs: 01364687

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 89c38c24349b7a512e08d70bd2e051fb4488a54485b3340274e7e16176023155
Instruction ID: 98e15a87cbf12e5d9bd2ceac2c75fb0f36a6a1f0c79ec026baebc99a5d7b6fbf
Opcode Fuzzy Hash: 89c38c24349b7a512e08d70bd2e051fb4488a54485b3340274e7e16176023155
Instruction Fuzzy Hash: 37F0ECB2C00225F6DF301B99DC0AFEA7BAC9F15B6DB408515FD4856108D7648C90C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 0136A007 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,01369FB8,00000000,?,013B9614,?,?,?,0136A15B,00000004,InitializeCriticalSectionEx,0137C0B4,InitializeCriticalSectionEx), ref: 0136A014
GetLastError.KERNEL32(?,01369FB8,00000000,?,013B9614,?,?,?,0136A15B,00000004,InitializeCriticalSectionEx,0137C0B4,InitializeCriticalSectionEx,00000000,?,01369DA2), ref: 0136A01E
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0136A046

Strings

api-ms-, xrefs: 0136A02B

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: b73c3ab039672d4ddb0c1c7b94f10911499c0cb17f6fa966df8767d838fcbccb
Instruction ID: 1f496c2eb878eebf12c95af2fe2fa2c10098c48e6c48b6c4c1f73b7d61a22a32
Opcode Fuzzy Hash: b73c3ab039672d4ddb0c1c7b94f10911499c0cb17f6fa966df8767d838fcbccb
Instruction Fuzzy Hash: 8FE01A302C0209BBEF311A65ED0AB583B6DBB01B68F108020FA0DA90D9DBA6A420D794

Uniqueness

Uniqueness Score: -1.00%

Function 01351D95 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 01351DA5
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 01351DBD
GetLastError.KERNEL32 ref: 01351DEF
GetLastError.KERNEL32 ref: 01351E0E

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: d54276b924953c5a8cde61692265593d94d1167849c45edf9410d04a0e2d1cb9
Instruction ID: cb0168b6a2252198515dfb9294fef3f0d2a1885159e9b4942746e556c0c27c6e
Opcode Fuzzy Hash: d54276b924953c5a8cde61692265593d94d1167849c45edf9410d04a0e2d1cb9
Instruction Fuzzy Hash: 5D117034900608EBDFB2AB68C804FB977FDBB01A69F104629EC2A95180D7708E84EB51

Uniqueness

Uniqueness Score: -1.00%

Function 01371144 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,0136A652,00000000,00000000,?,013710EB,0136A652,00000000,00000000,00000000,?,013712E8,00000006,FlsSetValue), ref: 01371176
GetLastError.KERNEL32(?,013710EB,0136A652,00000000,00000000,00000000,?,013712E8,00000006,FlsSetValue,0137D690,FlsSetValue,00000000,00000364,?,0136F837), ref: 01371182
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,013710EB,0136A652,00000000,00000000,00000000,?,013712E8,00000006,FlsSetValue,0137D690,FlsSetValue,00000000), ref: 01371190

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 4a55cd13bcdac1a5b0d9ce8ac0dd88084e1b8b940439b8d323769067c39d9735
Instruction ID: b09ac75859d9764849d201cf92cc7988b6402aa834f4f7a45d229780d46764bb
Opcode Fuzzy Hash: 4a55cd13bcdac1a5b0d9ce8ac0dd88084e1b8b940439b8d323769067c39d9735
Instruction Fuzzy Hash: 5E01DB3765122AABDB324A7CBC45B577BACBF05BB9B110724FA06DB181D725D800CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0135251A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,00000000,00000000,0135AFDE,?,?,?,?,?,0135B798,0138E5AC,?,0135C12B,00010000), ref: 0135253E
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 01352585
WriteFile.KERNELBASE(00000008,?,0135C12B,00010000,00000000,036BCBF9,?,?,?,00000000,00000000,0135AFDE,?,?,?,?), ref: 013525B1

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 51da0cd608e889859cc44e76e53dd1e7df9769d6c2458285c4458fc3a283c3b9
Instruction ID: d5751d6c60b1845fc61c3fce9791f4d8367ea31463ba265b7c9bd13a2f9981ad
Opcode Fuzzy Hash: 51da0cd608e889859cc44e76e53dd1e7df9769d6c2458285c4458fc3a283c3b9
Instruction Fuzzy Hash: 4331A231204305EFDB65CE18D868F6FBBA9FB84B2DF044919FD8257290D7709948CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01352810 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 013538FD: _wcslen.LIBCMT ref: 01353903

CreateDirectoryW.KERNELBASE(?,00000000,?), ref: 01352837
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?), ref: 0135286A
GetLastError.KERNEL32(?,?), ref: 01352887

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: ca77b14475bacce0853c9af09330d796c31e508a8d07faf4486f2f383317b70c
Instruction ID: 6aa68835d03a65656a8dadd5ab4d51ef1b85614ac4bd52b074390fa118e5373f
Opcode Fuzzy Hash: ca77b14475bacce0853c9af09330d796c31e508a8d07faf4486f2f383317b70c
Instruction Fuzzy Hash: 93017535210255A6EFA66BAC4844FFF2F6C6F19F9CF080864FE41E6084D764D584C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 0135A22C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 341COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0135A2E6

Part of subcall function 0135B122: __EH_prolog.LIBCMT ref: 0135B127

Strings

0C6L3.cpl, xrefs: 0135A261, 0135A27D, 0135A28C, 0135A2B0, 0135A3C0, 0135A3E2, 0135A53C, 0135A687, 0135A6FC

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: H_prologUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: 0C6L3.cpl
API String ID: 3007126557-1539666090
Opcode ID: 85f6a0119539d21f182270f8ffbe5ac25bb52de0d8bb77fa64a5c9d62957a2f6
Instruction ID: 3cbd1e01e533a617b5ce3f3cc5707bb6e86f19e5ee8d2319679bd94f6b6fa0aa
Opcode Fuzzy Hash: 85f6a0119539d21f182270f8ffbe5ac25bb52de0d8bb77fa64a5c9d62957a2f6
Instruction Fuzzy Hash: EAD1E271504352DFE7B5EF2CE854E2A3BA9E745B2CF080629ED4183289F771D844EB62

Uniqueness

Uniqueness Score: -1.00%

Function 01371CA3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 01371CC8

Strings

, xrefs: 01371D0D

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 940d42e135a7bf4171ed6a5a2a4f313cda858e1b3dd1bc3390fef44c6e934d71
Instruction ID: 2cedd12372064f696e86e296f28de1135298beff4c11f54e5bae702c05908131
Opcode Fuzzy Hash: 940d42e135a7bf4171ed6a5a2a4f313cda858e1b3dd1bc3390fef44c6e934d71
Instruction Fuzzy Hash: 18410A7150438C9EDB368E688C84AF6BBFEEB5530CF1404ECE59A87142D2399945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0135B122 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0135B127

Part of subcall function 01352AE7: FindClose.KERNELBASE(00000000), ref: 01352B12

Strings

0C6L3.cpl, xrefs: 0135B14A, 0135B150, 0135B166, 0135B195, 0135B1A4

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: CloseFindH_prolog
String ID: 0C6L3.cpl
API String ID: 1153179139-1539666090
Opcode ID: 72c3cfb97a1e5f8206013e9f24c09de000ec1a0da0a433b5db1d2a4d7a1ec543
Instruction ID: f73f9523b26e9b3014c15974fc7467d93ae9b8deebdb5ff868788dfc41871ab7
Opcode Fuzzy Hash: 72c3cfb97a1e5f8206013e9f24c09de000ec1a0da0a433b5db1d2a4d7a1ec543
Instruction Fuzzy Hash: D311E731A00256DBDFD1EF789801FEEB7AAAF51B2CF004165ED01A71C4EBB84A458B90

Uniqueness

Uniqueness Score: -1.00%

Function 0137137C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,F4E85006,00000001,?,000000FF), ref: 013713ED

Strings

LCMapStringEx, xrefs: 0137138D, 01371397

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 83d3559f8883f7b7fbcc5b836839c80a356332441b0e2d4fa95d131b42cad287
Instruction ID: 1a84e7764aaf1e8747f2647fbbf373818506c9001ebd690c78e94e85d7ee5e2d
Opcode Fuzzy Hash: 83d3559f8883f7b7fbcc5b836839c80a356332441b0e2d4fa95d131b42cad287
Instruction Fuzzy Hash: 77010C3250020DBBCF225F95DC05DDE3F6AFF18768F454159FE0825120C67A8931EB84

Uniqueness

Uniqueness Score: -1.00%

Function 0137131A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0137091F), ref: 01371365

Strings

InitializeCriticalSectionEx, xrefs: 0137132B, 01371335

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 18dafc3d83460db33fc55d0c22b7be548a68e7847a146a01354e5a3665c4aeb4
Instruction ID: 435ff534d3c93b3897c285a9f26ed10fdf4aea0d322e47fe1f354796696b85fc
Opcode Fuzzy Hash: 18dafc3d83460db33fc55d0c22b7be548a68e7847a146a01354e5a3665c4aeb4
Instruction Fuzzy Hash: 13F0B43264121CBBCF316F55DC05E9D7FA9EF14B25F404159FD0C1A224CA7659109B84

Uniqueness

Uniqueness Score: -1.00%

Function 013711BF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 013711FE

Strings

FlsAlloc, xrefs: 013711D0, 013711DA

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: c592acfc013eb462cc9e851786b18d3b2c927e0587cfba27a847917ee9c7e283
Instruction ID: df734fb62b948a44128ede892af6dded78ec64027bea819c4a8833f4c018c03e
Opcode Fuzzy Hash: c592acfc013eb462cc9e851786b18d3b2c927e0587cfba27a847917ee9c7e283
Instruction Fuzzy Hash: 1BE0E532B4221DABC731ABA5AC06F6D7B6CDF54B39F41416DF80967300DD7919048789

Uniqueness

Uniqueness Score: -1.00%

Function 01372000 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 01371BCB: GetOEMCP.KERNEL32(00000000,?,?,01371E54,?), ref: 01371BF6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,01371E99,?,00000000), ref: 01372074
GetCPInfo.KERNEL32(00000000,01371E99,?,?,?,01371E99,?,00000000), ref: 01372087

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 8448acb19deef537c262a8f50c5627f897c4c69822ffe37208a9257aedbb1b9e
Instruction ID: 686cdd107c854777c2cb9bde9e58eff044f0779c70c63cf0e000fabfb36b907a
Opcode Fuzzy Hash: 8448acb19deef537c262a8f50c5627f897c4c69822ffe37208a9257aedbb1b9e
Instruction Fuzzy Hash: F3513574E0024A9FDB318F39D8806BBBFE9FF41318F14406ED69687241D63D9545CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0135203C Relevance: 3.1, APIs: 2, Instructions: 134COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?), ref: 013521A2
GetLastError.KERNEL32 ref: 013521B1

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: e23d4a13777d97b3b0e3b68a95e95d955ceb63940d33a975389c57053067795d
Instruction ID: 37bec6d5e0d170808f3dc4f03f25925d946d254eceaa87558c7ec050a718088e
Opcode Fuzzy Hash: e23d4a13777d97b3b0e3b68a95e95d955ceb63940d33a975389c57053067795d
Instruction Fuzzy Hash: 99414B7460534ACBC7B4EE28C884EABB7EAFB48B68F04451DEE4583641D770D984CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01371E37 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 0136F765: GetLastError.KERNEL32(?,?,0136ABD7,?,?,?,0136A652,00000050), ref: 0136F769
Part of subcall function 0136F765: _free.LIBCMT ref: 0136F79C
Part of subcall function 0136F765: SetLastError.KERNEL32(00000000), ref: 0136F7DD
Part of subcall function 0136F765: _abort.LIBCMT ref: 0136F7E3

Part of subcall function 01371F5E: _abort.LIBCMT ref: 01371F90
Part of subcall function 01371F5E: _free.LIBCMT ref: 01371FC4

Part of subcall function 01371BCB: GetOEMCP.KERNEL32(00000000,?,?,01371E54,?), ref: 01371BF6

_free.LIBCMT ref: 01371EAF
_free.LIBCMT ref: 01371EE5

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: f38478917f72f74e3c4a4b87b4f53da53b6cd5a4b1bd88b2865524f516e87133
Instruction ID: fe272597b1f1381367341db66fe844fdd8c8c924cd75e9fe2c8292e2eb1ae0c0
Opcode Fuzzy Hash: f38478917f72f74e3c4a4b87b4f53da53b6cd5a4b1bd88b2865524f516e87133
Instruction Fuzzy Hash: E831DC32D04209AFDB31EF6CD480B6D7BF9EF41328F154599D9089B691EB3A5D41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013523A2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?), ref: 013523BC
SetFileTime.KERNELBASE(?,?,?,?), ref: 01352470

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: c16c21e326e7af90b8216e7d5a9704cf9c5907555b97609ea5e1bab192148f1c
Instruction ID: 762926305f0373bd86ecfc37e9da1af7b46db72f4b8646d5f3c98d6a1599ebdb
Opcode Fuzzy Hash: c16c21e326e7af90b8216e7d5a9704cf9c5907555b97609ea5e1bab192148f1c
Instruction Fuzzy Hash: A3210131248286DFD755CE78C881EABBFE8AF95A08F04491CFCC587142D328E50DD761

Uniqueness

Uniqueness Score: -1.00%

Function 01351C7E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?), ref: 01351CF6
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800), ref: 01351D26

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fe635485b0c20e91736070ef7bcf128334329b0a973a1d45970f5f99c74ed171
Instruction ID: bf50cf2b1d1abcdc0c46511fc79c341c37ab85e2fdf265bcf3e741699f393c25
Opcode Fuzzy Hash: fe635485b0c20e91736070ef7bcf128334329b0a973a1d45970f5f99c74ed171
Instruction Fuzzy Hash: EC210071500344AEE7B18A69CC88FB3B6ECFB48B68F000A28ED95C21C1C379A884C731

Uniqueness

Uniqueness Score: -1.00%

Function 01369F67 Relevance: 3.1, APIs: 2, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,013B9614,?,?,?,0136A15B,00000004,InitializeCriticalSectionEx,0137C0B4,InitializeCriticalSectionEx,00000000,?,01369DA2,013B9614,00000FA0), ref: 01369FEA
GetProcAddress.KERNEL32(00000000,?), ref: 01369FF4

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID:
API String ID: 3013587201-0
Opcode ID: 63b35aee640c62d760a661e8cd52accffd1709a4419c66f6828755f62763c7c9
Instruction ID: 822e159a8e8e2beb8f76039ac0c04855df4ed50822da5b64c80bc5efe289fe52
Opcode Fuzzy Hash: 63b35aee640c62d760a661e8cd52accffd1709a4419c66f6828755f62763c7c9
Instruction Fuzzy Hash: 8D118E31604119DFDF23CF68E880B9A77ADFB4576DB168169EA06DB248E730D909CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01352480 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 013524C7
GetLastError.KERNEL32 ref: 013524D4

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 6082acdc51c6b863196a4f437d7d301ea4265bdb8499c61a263451f8826331b8
Instruction ID: f2c09b2282f59625ed05d923e44f94564723ac61a88dac9ecf2e1b635a70ae07
Opcode Fuzzy Hash: 6082acdc51c6b863196a4f437d7d301ea4265bdb8499c61a263451f8826331b8
Instruction Fuzzy Hash: 4C11C271600204EBE7758628CC40FA7BBF9AB45778F904718E953E2AC0D770F945C750

Uniqueness

Uniqueness Score: -1.00%

Function 01352A4B Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,?,?,01352883,?,?), ref: 01352A5F

Part of subcall function 013535E5: _wcslen.LIBCMT ref: 01353609

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,?,01352883,?,?), ref: 01352A90

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: dcf5b682c84a786e1d7002005a365f051dc3299b563bc115f83adee6bb42e8b9
Instruction ID: ac86d4903b93222dbd88451e5e616e4faacec03e7ae2c719cb5b967893fcb44f
Opcode Fuzzy Hash: dcf5b682c84a786e1d7002005a365f051dc3299b563bc115f83adee6bb42e8b9
Instruction Fuzzy Hash: ACF0A93110021AABEF229E6ACC00FDA3B6CBB087D9F00C420BC48D6154DB31C9949B20

Uniqueness

Uniqueness Score: -1.00%

Function 0135272F Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,01351D8F,?,?,01351BE3,?,?,?,?,?,01378AA3,000000FF), ref: 01352740

Part of subcall function 013535E5: _wcslen.LIBCMT ref: 01353609

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,01351D8F,?,?,01351BE3,?,?,?,?,?,01378AA3), ref: 0135276E

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: 08ff6b9b2cbc535a3976fd99b7ad4057ed4dd468c13398727c0dfb8aa00216a2
Instruction ID: 53dc7cecec4cad35cf2d53e0b1b854f1326f38dea389540ff00d9516bec32fcd
Opcode Fuzzy Hash: 08ff6b9b2cbc535a3976fd99b7ad4057ed4dd468c13398727c0dfb8aa00216a2
Instruction Fuzzy Hash: 4BE0D83125120AEBEB229F68DC40FDA37ACAF047DDF444061BD44D2055DB71DD84DB54

Uniqueness

Uniqueness Score: -1.00%

Function 01361881 Relevance: 3.0, APIs: 2, Instructions: 26comCOMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,01378AA3,000000FF), ref: 013618B5
OleUninitialize.OLE32(?,?,?,?,01378AA3,000000FF), ref: 013618BA

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 841c57e1fe5fc02e92094edb0d65c21ce71a04a7c762d7f9153d3a4e7ffa23bc
Instruction ID: 2f0e9719bcbb392ab278c6daa088a9123b2b5f2adbc3c6df10602b09af7e4d2d
Opcode Fuzzy Hash: 841c57e1fe5fc02e92094edb0d65c21ce71a04a7c762d7f9153d3a4e7ffa23bc
Instruction Fuzzy Hash: 06E03072604A54AFC720DF4DE945B49FBACFB48B60F004265E015D3754CB746800CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0136490E Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 01364938

Part of subcall function 01352AA2: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01352AB5

SetDlgItemTextW.USER32(00000065,?), ref: 0136494F

Part of subcall function 013620D8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 013620E9
Part of subcall function 013620D8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 013620FA
Part of subcall function 013620D8: IsDialogMessageW.USER32(?,?), ref: 0136210E
Part of subcall function 013620D8: TranslateMessage.USER32(?), ref: 0136211C
Part of subcall function 013620D8: DispatchMessageW.USER32(?), ref: 01362126

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: e993a752cbe7e7dddb948b22f24314ba9b82403f76fd89377dd3fa50e91b733f
Instruction ID: ac674a60943953ebd15d3be15034f1411ffc9efe5e93f450d768924d7b57f42f
Opcode Fuzzy Hash: e993a752cbe7e7dddb948b22f24314ba9b82403f76fd89377dd3fa50e91b733f
Instruction Fuzzy Hash: 49E0D87240424A7AEF11BB69DC05FEB3FAC5F147C9F040451BA40E7091F679DAA18761

Uniqueness

Uniqueness Score: -1.00%

Function 01352792 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 013527A3

Part of subcall function 013535E5: _wcslen.LIBCMT ref: 01353609

GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 013527CF

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 8705c8ef265e326ee19ecb3de4ba8c6819e347b0906167547df5144adadc8d36
Instruction ID: d9580fb5784b4e1a70d151f52b9c1ffbe5768d22613476f835e5451b051b9450
Opcode Fuzzy Hash: 8705c8ef265e326ee19ecb3de4ba8c6819e347b0906167547df5144adadc8d36
Instruction Fuzzy Hash: 06E0ED315002249ADB61AB689C04BD97A6CBB097F9F0542A0FE55E3195D7649D80CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 01356B9C Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 01356BB7
LoadLibraryW.KERNELBASE(?,?,0135590F,Crypt32.dll,00000000,01355989,?,?,0135596C,00000000,00000000,?,00000000), ref: 01356BD9

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: cb2f539c84558661a7b94ddb2ec5a0965370d17b2a091bc9f9a62a6e5e477296
Instruction ID: 031b50cc786015d5280f3d59485650fd308a83400cadd905a8d9f9eebe4f7da3
Opcode Fuzzy Hash: cb2f539c84558661a7b94ddb2ec5a0965370d17b2a091bc9f9a62a6e5e477296
Instruction Fuzzy Hash: FAE04872910228A6DF219AA9DC04FDA776CFF487E5F4440A17949D2108D674DA84CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 01360EC8 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 01360EE9
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 01360EF0

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 475e1bc9ba80ba182f28352e74da53572e4c898f75b6f0e255868450a4e82a39
Instruction ID: dd465ba47a9fd2cb9a903b074c6598676dafa34ce6bf91133d147fadcf4c9966
Opcode Fuzzy Hash: 475e1bc9ba80ba182f28352e74da53572e4c898f75b6f0e255868450a4e82a39
Instruction Fuzzy Hash: 1EE06D71400618EBDB24DF48C90069DB7ECEB142A9F10C02AE84993640D270AE44DB61

Uniqueness

Uniqueness Score: -1.00%

Function 01368F7C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 01368F9A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 01368FA5

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 79d0b740ca02bca9fa360bfbef9bb988763c9fb1c89e599815da1308324c48ae
Instruction ID: c69c6d3ef77bc651f310253af7333fa97b6a8cbfcf0e861f560b2da6ac545d33
Opcode Fuzzy Hash: 79d0b740ca02bca9fa360bfbef9bb988763c9fb1c89e599815da1308324c48ae
Instruction Fuzzy Hash: F9D0A9A0544B02CCDD106B7D3C404C9334E6C2AABC3A0C2DAD3308E9CCEFA1800A6211

Uniqueness

Uniqueness Score: -1.00%

Function 013511A1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 013511B6
ShowWindow.USER32(00000000), ref: 013511BD

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: cc16324d906a81dd48991afdfa26b1cc45a63be4b587d3dec6519c09c5a58750
Instruction ID: 2f82a00d0f947d8b670f86232e89de01a25820810b957215152f259ec557864a
Opcode Fuzzy Hash: cc16324d906a81dd48991afdfa26b1cc45a63be4b587d3dec6519c09c5a58750
Instruction Fuzzy Hash: 59C01232058640BECB410BB0DC09D2EBBACABA5312F00C908F2A5C2154E638C010EB11

Uniqueness

Uniqueness Score: -1.00%

Function 0135B41D Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0135B43E

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: 839efb0563ea9aa1e540876683ff2869baa57f851b20562658a8e3df5884674c
Instruction ID: c8c4dbcef9b04bded3311b400622cfdfaf951145bd52d06eb8e1de9c2fd010ff
Opcode Fuzzy Hash: 839efb0563ea9aa1e540876683ff2869baa57f851b20562658a8e3df5884674c
Instruction Fuzzy Hash: E3319076601225DFD779DF28E854B297BAEF788B14F05453AED0197389F732E8008B91

Uniqueness

Uniqueness Score: -1.00%

Function 013710A8 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 01371108

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 8d55a5d4263d9248a8e2c2b01528a0eacc0f61ad6ba5973b25a8bae4dbf5101a
Instruction ID: 71a575327b5d77b5f21a36d34598beef444a11c4bda540cba838265b326c76b7
Opcode Fuzzy Hash: 8d55a5d4263d9248a8e2c2b01528a0eacc0f61ad6ba5973b25a8bae4dbf5101a
Instruction Fuzzy Hash: ED11A737B002269BDF329E2DEC4059A779D9B84378B064220FE15AF648DA35DC0187D0

Uniqueness

Uniqueness Score: -1.00%

Function 01372889 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 01371546: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0136F793,00000001,00000364,?,0136ABD7,?,?,?,0136A652,00000050), ref: 01371587

_free.LIBCMT ref: 013728F5

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction ID: 056f135893aaf2a7f065f476b0a7a307b3bfabcb5c1ba168cc9462a1d58feb4c
Opcode Fuzzy Hash: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction Fuzzy Hash: B101D673600345ABF3358E69988195AFFEDEB85374F29062DE59483280EA35A805C664

Uniqueness

Uniqueness Score: -1.00%

Function 01364512 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01364517

Part of subcall function 01356A26: _wcslen.LIBCMT ref: 01356A3C

Part of subcall function 0135F482: __EH_prolog.LIBCMT ref: 0135F487

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 13d6aad8f4eaf1a56e0219e9788a9846c3e467b10d980aad396fc6d7e8c1a3e1
Instruction ID: 08b19564b1bc115f3e502907e8f2da00bb8e281bccb36289086c819da9c8f8bf
Opcode Fuzzy Hash: 13d6aad8f4eaf1a56e0219e9788a9846c3e467b10d980aad396fc6d7e8c1a3e1
Instruction Fuzzy Hash: 7E01427254A380BED360AF7CF492F993FACEB2572CF00404EE64896385E6F61408C720

Uniqueness

Uniqueness Score: -1.00%

Function 01371546 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0136F793,00000001,00000364,?,0136ABD7,?,?,?,0136A652,00000050), ref: 01371587

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 948d97cad41e325daffeff3bdef5c00705bc36fe0eb0ef6e16b04e41e80b3ad1
Instruction ID: 1c1d67845c44d2d0cc8c22cc5a6b992e06ba8f1f75bfcad3a587cb042f40a586
Opcode Fuzzy Hash: 948d97cad41e325daffeff3bdef5c00705bc36fe0eb0ef6e16b04e41e80b3ad1
Instruction Fuzzy Hash: EAF0E933644325E7EF395A7AAC45B6A3F4CEF41A78F1C8021EE0AA7484DA34D90087E1

Uniqueness

Uniqueness Score: -1.00%

Function 0136F9E5 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0136A7E9,?,0000015D,?,?,?,?,0136BCC5,000000FF,00000000,?,?), ref: 0136FA17

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 16bcc95a6ce17705916dd20bf0019bf8eab046996d01dd0ad0e85e7aa9214d12
Instruction ID: 35642de1d1edfc1f07d5e54d59d017094c57aba98ca570361c4556719df44927
Opcode Fuzzy Hash: 16bcc95a6ce17705916dd20bf0019bf8eab046996d01dd0ad0e85e7aa9214d12
Instruction Fuzzy Hash: 6AE02B3220431567F731267DFC21B9F7A8CDF026BCF19C121DD859208CCB60C8108BA4

Uniqueness

Uniqueness Score: -1.00%

Function 01351C30 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,01351BEA,?,?,?,?,?,01378AA3,000000FF), ref: 01351C4B

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4218aa4891350c49263b72da236c1132e7997cb8380752edf01fdeebea101622
Instruction ID: 619e0adf58da1dda2161361719c5c9a6e4b7c89d0cf0924803459e18dacf69ae
Opcode Fuzzy Hash: 4218aa4891350c49263b72da236c1132e7997cb8380752edf01fdeebea101622
Instruction Fuzzy Hash: 3AF08271481B158FEF728A29C458B92B7E8AB02739F045B1EC5F247AE4D3A3A18DC750

Uniqueness

Uniqueness Score: -1.00%

Function 01352AE7 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 01352C15: FindFirstFileW.KERNELBASE(?,?), ref: 01352C3E
Part of subcall function 01352C15: FindFirstFileW.KERNELBASE(?,?,?,?,00000800), ref: 01352C6C
Part of subcall function 01352C15: GetLastError.KERNEL32(?,?,00000800), ref: 01352C78

FindClose.KERNELBASE(00000000), ref: 01352B12

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 2b25502673fbb0c51daa5289c6b751ae9469adffae71b26b1981f52e2c61ad56
Instruction ID: 5859d3b7f00bc3c2144d5a1a40dc21e068ad67180f954ec37537ce7c3efd7ddc
Opcode Fuzzy Hash: 2b25502673fbb0c51daa5289c6b751ae9469adffae71b26b1981f52e2c61ad56
Instruction Fuzzy Hash: 51F082314097D0EACFA35BB84844FCBBF956F2A779F008A49E9FD121A1C2B55098D772

Uniqueness

Uniqueness Score: -1.00%

Function 0135F9A5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0135F9AA

Part of subcall function 01351EE0: CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000), ref: 01351F5F
Part of subcall function 01351EE0: GetLastError.KERNEL32 ref: 01351F6C
Part of subcall function 01351EE0: CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800), ref: 01351FA2
Part of subcall function 01351EE0: GetLastError.KERNEL32 ref: 01351FAA
Part of subcall function 01351EE0: SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000), ref: 01351FF9

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: File$CreateErrorLast$H_prologTime
String ID:
API String ID: 3517926197-0
Opcode ID: b875d3b14936ff1dd19851fed4fa10d3fea67ae886cd9055c3a5478c00ead3f5
Instruction ID: 32e213360b8331a0c07dced39e8de96d06f4776bce1291c9dc126a1d0d3f0c72
Opcode Fuzzy Hash: b875d3b14936ff1dd19851fed4fa10d3fea67ae886cd9055c3a5478c00ead3f5
Instruction Fuzzy Hash: 32F0307590215AEBDFA1EF54C981FDCB739FF20B48F008094AA4566190DB799A94DB20

Uniqueness

Uniqueness Score: -1.00%

Function 01361136 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 0136113C

Part of subcall function 01360EC8: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 01360EE9

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 5ab87911419d104bf8d52cca4c52cd39a732c6fb385016300ad2ab0103f248f7
Instruction ID: e425f1d1ac718305654586124882618178e01760c8a698cd1abbc61511eee7f7
Opcode Fuzzy Hash: 5ab87911419d104bf8d52cca4c52cd39a732c6fb385016300ad2ab0103f248f7
Instruction Fuzzy Hash: 6ED0A77060020DB6DF412B249C02A6E7B9C9B51248F00C031E90595388EAB1D9109151

Uniqueness

Uniqueness Score: -1.00%

Function 013647C9 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,0135790C), ref: 013647EE

Part of subcall function 013620D8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 013620E9
Part of subcall function 013620D8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 013620FA
Part of subcall function 013620D8: IsDialogMessageW.USER32(?,?), ref: 0136210E
Part of subcall function 013620D8: TranslateMessage.USER32(?), ref: 0136211C
Part of subcall function 013620D8: DispatchMessageW.USER32(?), ref: 01362126

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: bc6ed2d719a55f6c739f3bc77faf979ba99496c9c7ce9b38223a2685bc32b593
Instruction ID: bbbcdcb92ac25606e2e06d86cf70be6d418d5dab38366bb6e355e1783f3375db
Opcode Fuzzy Hash: bc6ed2d719a55f6c739f3bc77faf979ba99496c9c7ce9b38223a2685bc32b593
Instruction Fuzzy Hash: 0DD0C771145301BEDB512B51CD06F1B7BEABB98F09F404954B744740F4C662DD75DB01

Uniqueness

Uniqueness Score: -1.00%

Function 01364C37 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 91801e19fa7ccdb025828022cf99a0a1086f1cdeeb96e97ef66d71b22b6290da
Instruction ID: 6e6095471a9bacfa73beef329a2bdcb1a1fe964ca9209f44dc3fe37a9599fd48
Opcode Fuzzy Hash: 91801e19fa7ccdb025828022cf99a0a1086f1cdeeb96e97ef66d71b22b6290da
Instruction Fuzzy Hash: E4B012D5259205BCF88822492F45C37111CC2C0A5E320C21EF402D1B08E8404C4E6032

Uniqueness

Uniqueness Score: -1.00%

Function 01364C70 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 285166c545b60ec460347a30f441a1587e061f96f5b97ddab8c113cfab66c8da
Instruction ID: a194d707f54585fb401703f37e5cc6bd26d372f75cefe78632dab2feb8717d66
Opcode Fuzzy Hash: 285166c545b60ec460347a30f441a1587e061f96f5b97ddab8c113cfab66c8da
Instruction Fuzzy Hash: 66B012E5259105BCF488624E2E05C37115CD1C0A5D320C11EF401C2A08EC400C0A5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364C66 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 88426d7e004bafb0d95ab6b3601108f9d93375f00120ba36a8b697a06ed08fdc
Instruction ID: 0fe221df804c18888673fb55a2cf83fab75e9c8f370339e8ccb6c674494eb596
Opcode Fuzzy Hash: 88426d7e004bafb0d95ab6b3601108f9d93375f00120ba36a8b697a06ed08fdc
Instruction Fuzzy Hash: 0FB012F5259105BDF488624D2F05C37115CC1C0A5D320C11EF401D2A08EC400D0B5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364C52 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 15d2cb01f2b63a2abc11bb31ac8268b242b4818b78bb6b9efd0960a0ac2fddf9
Instruction ID: b2b77cb7fa7457165a1d069f40249c8e6509d6cecd011d2e2ac6d656bf9a08b8
Opcode Fuzzy Hash: 15d2cb01f2b63a2abc11bb31ac8268b242b4818b78bb6b9efd0960a0ac2fddf9
Instruction Fuzzy Hash: 09B012E5259105BCF488624D2E05C37115CC5C0A5D320C11EF801C2A08EC400C0A5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364C5C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 3a3d05d5b942bdc9ece02f154fcf602b7c5d1223ab8f658fc7abe796c59b311a
Instruction ID: a02bb245211527e4fcd758ba31b53faef39747d8681d0991027b8a5c8eb8a054
Opcode Fuzzy Hash: 3a3d05d5b942bdc9ece02f154fcf602b7c5d1223ab8f658fc7abe796c59b311a
Instruction Fuzzy Hash: 73B012E5259205BCF4C8624D2E05C37115CC2C0A5D320C21EF401C2A08EC400C4A5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364CB6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 0cce2ed1aeace612594792694b251410c432d18b21e9d6632aa2ab29c5832625
Instruction ID: 804c1eda5ebb35ae27b577dd373d333c9d6d3f285477928ad890556b30ada218
Opcode Fuzzy Hash: 0cce2ed1aeace612594792694b251410c432d18b21e9d6632aa2ab29c5832625
Instruction Fuzzy Hash: 91B012F5659205BCF488624D2F05C3711DCC1C0A5D320C11EF401D2A08E8404C0B5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364CA2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: d8af7309880e68c6afa740b1ad84b191176ef1d10112de125ff8e94acd6868e4
Instruction ID: 2ebb84823fc382ee9bc2ab5dd7b3033e8da8ec233778067a99ddf49a2613d64d
Opcode Fuzzy Hash: d8af7309880e68c6afa740b1ad84b191176ef1d10112de125ff8e94acd6868e4
Instruction Fuzzy Hash: 20B012D5659205BCF488625D2E05C37119CC2C0A5D320C11EF901C2A08E8404C0A5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364CAC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: af6ccb2a83107dadfc917e34791ad4eaa38914d61b03a194eb702feccda32bc0
Instruction ID: 51a80974c0c077883507a2362303c460af73b52fe87c58f1404d3891b811df15
Opcode Fuzzy Hash: af6ccb2a83107dadfc917e34791ad4eaa38914d61b03a194eb702feccda32bc0
Instruction Fuzzy Hash: 28B012D5659305BCF4C8624D2E05C37119CC2C0A5D320C21EF401C2A08E8408C4A5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364C98 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 441534a14dde3e0c85bee942dcc66d1c8a7e4619ee3b2c3e412829a0b44784a2
Instruction ID: c2f569c5ad7a4cc013cfae10aa2bf78415444da1f51d42de3e1774de15e49289
Opcode Fuzzy Hash: 441534a14dde3e0c85bee942dcc66d1c8a7e4619ee3b2c3e412829a0b44784a2
Instruction Fuzzy Hash: BAB012D526A105BCF488624D2E05C3721DDD5C0A5D320C11EF401C2A08E8400C0A5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364C84 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: f3c907333075eb3dd5f1baca61e35f7a11046a6883c12b106f8f676e17940a06
Instruction ID: 9de75986b93b48d80c5f577374bdc5be6a77b6f20067736d4faff0f30b017cee
Opcode Fuzzy Hash: f3c907333075eb3dd5f1baca61e35f7a11046a6883c12b106f8f676e17940a06
Instruction Fuzzy Hash: 0CB012E525A205BCF4C8634D2E05C37119DC2C0A5D320C21EF401C2A08E8400C4A5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364C8E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 920b61827804dfa054ad71e7061ce8884e7a0f22f4b6dbe81b6dbe54239f98e8
Instruction ID: 090e055279441ce69ee793a613adc4f4816dfe19a8e3073229def064f523a7ce
Opcode Fuzzy Hash: 920b61827804dfa054ad71e7061ce8884e7a0f22f4b6dbe81b6dbe54239f98e8
Instruction Fuzzy Hash: CCB012E525B105BCF488624D2F05C37119DC1C0A9E320C11EF401D2A08E8400D0B5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364CE8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: da6f8c5965414ad572748056d305fdb5d7f8892c3b3ba7c54036b7905ccf5978
Instruction ID: b7ca334037b74d49ec5e38ca40c68e1e9a5768c9319fc40539996f5bf4f87756
Opcode Fuzzy Hash: da6f8c5965414ad572748056d305fdb5d7f8892c3b3ba7c54036b7905ccf5978
Instruction Fuzzy Hash: 69B012D5759105BCF488624D2E07C37115CD1C0A5D320C51EF401C2A48E8400C0A5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364CD4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: df72b43afd85980504ac26de81c1848142e02704354a2bf30ca11f0998f8ee4f
Instruction ID: bd889fb18e945f942195f73048c9db46bc58b3b25e556e84074ad82affeef4b1
Opcode Fuzzy Hash: df72b43afd85980504ac26de81c1848142e02704354a2bf30ca11f0998f8ee4f
Instruction Fuzzy Hash: 5DB012D5759205BCF4C8624D2E06C37115CC2C0A5D320C21EF401C2A08E8400C4A5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364CDE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 35b3babe04f4b58a5fe50c2f8168957f5478792bf683c2e592b59bdeae759d4c
Instruction ID: d9dff92ed61dfe128b55544dc7eeedd1f6d6c172bbf4f4360adf6ce695027881
Opcode Fuzzy Hash: 35b3babe04f4b58a5fe50c2f8168957f5478792bf683c2e592b59bdeae759d4c
Instruction Fuzzy Hash: 69B012E5359105BCF488624D6F06C37115CC1C0E5D320C11EF401D2A08E8400C0B5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364CCA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 8c277743c4ccf76b9ef61d89a7b33deb6f8febc2e5d07c6eeab5dd98c17609b6
Instruction ID: 7234c373a26141db2f0a94f941f25e1f18c07f24af30eed2714761ee33c21899
Opcode Fuzzy Hash: 8c277743c4ccf76b9ef61d89a7b33deb6f8febc2e5d07c6eeab5dd98c17609b6
Instruction Fuzzy Hash: BFB012D5359105BCF488634E2E06C37115CC1C0A5D320C11EF801C2A08E8400C0A5032

Uniqueness

Uniqueness Score: -1.00%

Function 01364F3A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364F4C

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: a29bafb9f3ebef5d38bfac9b000632de3368d8dc786a6813db00db1ef6ab401f
Instruction ID: db12c01182f32c22f444d17ef5f8c8c06f8744a6e88c9a2b82779b22bce4238d
Opcode Fuzzy Hash: a29bafb9f3ebef5d38bfac9b000632de3368d8dc786a6813db00db1ef6ab401f
Instruction Fuzzy Hash: 0CB012D529D101FCF00422456C05C37220CC1C0A1E320C61EF800D5404E8400C0D4037

Uniqueness

Uniqueness Score: -1.00%

Function 01364F73 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364F4C

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: c79b60bb847a927571dfb60bab5c2308d7bce6ddc45c88b0be6995b420fa9e6c
Instruction ID: 7da2392dd26b0f443fd75447651acc23a611d69784f4df7d468409bab49d3361
Opcode Fuzzy Hash: c79b60bb847a927571dfb60bab5c2308d7bce6ddc45c88b0be6995b420fa9e6c
Instruction Fuzzy Hash: 1FB012E529D301ACF044664D3E45C37210CC2C0A1D320C51EF500C6504E8410C0E4033

Uniqueness

Uniqueness Score: -1.00%

Function 01364F55 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364F4C

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 39c25d5a840cbd23800c95370999821930ed1c3853c0940b4bdcaa8f69611421
Instruction ID: 11af938dc95b1540de3d567dfd86e6a3042d64a13698d9d24cabfe860221b92b
Opcode Fuzzy Hash: 39c25d5a840cbd23800c95370999821930ed1c3853c0940b4bdcaa8f69611421
Instruction Fuzzy Hash: 63B012D52AD101BCF04466496C05D37210CD1C0A1E320C71FF400C6504E8400C0D4037

Uniqueness

Uniqueness Score: -1.00%

Function 01364F5F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364F4C

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 7b4411329eb891b7441923465b24669852ce57f9d3383d721f2972734d6b6ffa
Instruction ID: 69b229c553a695eecde923bd45b6445cac34ce87fd4092795387034eaf031a49
Opcode Fuzzy Hash: 7b4411329eb891b7441923465b24669852ce57f9d3383d721f2972734d6b6ffa
Instruction Fuzzy Hash: DBB012D529D201ECF044624D2C45C37210CC1C0A1D320C51EF800C6504E8400C0D4033

Uniqueness

Uniqueness Score: -1.00%

Function 01365608 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136561A

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: d61a3bd4aec41151a5d1f47846046373ff92950c15a07b23aea7a2f4a642a251
Instruction ID: 2cf96cfe700cab579b5944cda54cf2fec63bd27bc56600c819912ce09df1f1b7
Opcode Fuzzy Hash: d61a3bd4aec41151a5d1f47846046373ff92950c15a07b23aea7a2f4a642a251
Instruction Fuzzy Hash: A9B0129927B1017CF004224A2D02C37210CE6C1BAD370D13EF500C0404E4400C08403A

Uniqueness

Uniqueness Score: -1.00%

Function 01364E7F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364E62

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: eac71b4df16df093bc95dbf66db72ccd9106fffd125e085c18129ca85bcba0a4
Instruction ID: 4d6a3501aad4649f1db0206fd16ddcb08a63aad49aba53d2378e5d45e8b7bd79
Opcode Fuzzy Hash: eac71b4df16df093bc95dbf66db72ccd9106fffd125e085c18129ca85bcba0a4
Instruction Fuzzy Hash: 1EB012E52DD501BCF04866492C01D37121CE1C4F1D320C11EF404C1504E8450C098032

Uniqueness

Uniqueness Score: -1.00%

Function 01364EB1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364E62

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: c08b8ea1db1f893b183bc90974df0d17932c21c897d9fc0d6bfd80837923e62f
Instruction ID: 8aada15bd64e48208cf1610bc9deb3f606261970124a91a3c71a246c4ea8939f
Opcode Fuzzy Hash: c08b8ea1db1f893b183bc90974df0d17932c21c897d9fc0d6bfd80837923e62f
Instruction Fuzzy Hash: 8DB012E52DD601ACF14862492C01C37121CD1C4F1D320C61EF404C1504E8410C4D8032

Uniqueness

Uniqueness Score: -1.00%

Function 01364E89 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364E62

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 13344b9066ee5adcf825fe16e3ca2d62de09091714f8bbd4982df49e531cd57b
Instruction ID: 7f5a1d5d9df8ae8f09d609c6be3f9f8ab2d0174f593afc889efd75d621a1660e
Opcode Fuzzy Hash: 13344b9066ee5adcf825fe16e3ca2d62de09091714f8bbd4982df49e531cd57b
Instruction Fuzzy Hash: 6DB012E52DE601ACF14862492C01C37124CD1C8F5D320C21EF404C1504E4410C4D8032

Uniqueness

Uniqueness Score: -1.00%

Function 01364D33 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 8b6ba7e2b597d6e53b488af2dfcc6d6888fa33bfcaf0fa5490745fecf936e92f
Instruction ID: 7dd7b12073ea8bdcf94ed34569c131c11be89473dc90a84534e544baa718d57b
Opcode Fuzzy Hash: 8b6ba7e2b597d6e53b488af2dfcc6d6888fa33bfcaf0fa5490745fecf936e92f
Instruction Fuzzy Hash: D5A002D5559106BCB54862556E05C37155DC5D4A59360C51DF44295548984018565035

Uniqueness

Uniqueness Score: -1.00%

Function 01364D3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: a743219f00ba02aba7b9c654ffcf07e686e5f5f456a9f753d0c8b4b15c229e32
Instruction ID: 7dd7b12073ea8bdcf94ed34569c131c11be89473dc90a84534e544baa718d57b
Opcode Fuzzy Hash: a743219f00ba02aba7b9c654ffcf07e686e5f5f456a9f753d0c8b4b15c229e32
Instruction Fuzzy Hash: D5A002D5559106BCB54862556E05C37155DC5D4A59360C51DF44295548984018565035

Uniqueness

Uniqueness Score: -1.00%

Function 01364D29 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 40a832a904155e1bc27a6c78604bc1a967f5ebdc9893e5821000e624c1b1a916
Instruction ID: 7dd7b12073ea8bdcf94ed34569c131c11be89473dc90a84534e544baa718d57b
Opcode Fuzzy Hash: 40a832a904155e1bc27a6c78604bc1a967f5ebdc9893e5821000e624c1b1a916
Instruction Fuzzy Hash: D5A002D5559106BCB54862556E05C37155DC5D4A59360C51DF44295548984018565035

Uniqueness

Uniqueness Score: -1.00%

Function 01364D15 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 81b3d63909a98a7c4582fd14d08e49733aaa1a4c713bdebf69672e6e9ff7725b
Instruction ID: 7dd7b12073ea8bdcf94ed34569c131c11be89473dc90a84534e544baa718d57b
Opcode Fuzzy Hash: 81b3d63909a98a7c4582fd14d08e49733aaa1a4c713bdebf69672e6e9ff7725b
Instruction Fuzzy Hash: D5A002D5559106BCB54862556E05C37155DC5D4A59360C51DF44295548984018565035

Uniqueness

Uniqueness Score: -1.00%

Function 01364D1F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: dc2df7c9c76e777950fd38842e34f01e9640fd35d763d963edc617cdaa1c6529
Instruction ID: 7dd7b12073ea8bdcf94ed34569c131c11be89473dc90a84534e544baa718d57b
Opcode Fuzzy Hash: dc2df7c9c76e777950fd38842e34f01e9640fd35d763d963edc617cdaa1c6529
Instruction Fuzzy Hash: D5A002D5559106BCB54862556E05C37155DC5D4A59360C51DF44295548984018565035

Uniqueness

Uniqueness Score: -1.00%

Function 01364D01 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 174ff43ef78d71710245b05380c64d1a558690f4cb45eaf2d821713a50f48b9a
Instruction ID: 7dd7b12073ea8bdcf94ed34569c131c11be89473dc90a84534e544baa718d57b
Opcode Fuzzy Hash: 174ff43ef78d71710245b05380c64d1a558690f4cb45eaf2d821713a50f48b9a
Instruction Fuzzy Hash: D5A002D5559106BCB54862556E05C37155DC5D4A59360C51DF44295548984018565035

Uniqueness

Uniqueness Score: -1.00%

Function 01364D0B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: a0b32d5d252e098925730124f7451a5b1394685a0c5f885ea3fa3e1ebc84ba5b
Instruction ID: 7dd7b12073ea8bdcf94ed34569c131c11be89473dc90a84534e544baa718d57b
Opcode Fuzzy Hash: a0b32d5d252e098925730124f7451a5b1394685a0c5f885ea3fa3e1ebc84ba5b
Instruction Fuzzy Hash: D5A002D5559106BCB54862556E05C37155DC5D4A59360C51DF44295548984018565035

Uniqueness

Uniqueness Score: -1.00%

Function 01364C7F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: e92f83263af42491e4b7578fbfdea5657bd00b0415cb396e12a97ab90abcf3c1
Instruction ID: 7dd7b12073ea8bdcf94ed34569c131c11be89473dc90a84534e544baa718d57b
Opcode Fuzzy Hash: e92f83263af42491e4b7578fbfdea5657bd00b0415cb396e12a97ab90abcf3c1
Instruction Fuzzy Hash: D5A002D5559106BCB54862556E05C37155DC5D4A59360C51DF44295548984018565035

Uniqueness

Uniqueness Score: -1.00%

Function 01364CF7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: a3539ec7f8974541424e398e3f46a032c41e2b470baa5b03c3afbabdbef3d623
Instruction ID: 7dd7b12073ea8bdcf94ed34569c131c11be89473dc90a84534e544baa718d57b
Opcode Fuzzy Hash: a3539ec7f8974541424e398e3f46a032c41e2b470baa5b03c3afbabdbef3d623
Instruction Fuzzy Hash: D5A002D5559106BCB54862556E05C37155DC5D4A59360C51DF44295548984018565035

Uniqueness

Uniqueness Score: -1.00%

Function 01364CC5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364C49

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 34e1ac825c60f76ae25c740da352aadef38c7e48c7bd5435f731961ab591de3a
Instruction ID: 7dd7b12073ea8bdcf94ed34569c131c11be89473dc90a84534e544baa718d57b
Opcode Fuzzy Hash: 34e1ac825c60f76ae25c740da352aadef38c7e48c7bd5435f731961ab591de3a
Instruction Fuzzy Hash: D5A002D5559106BCB54862556E05C37155DC5D4A59360C51DF44295548984018565035

Uniqueness

Uniqueness Score: -1.00%

Function 01364F6E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364F4C

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: b8cfdaea06722001956b0aafe146f20ddd62afe9fb121ab8594b662f82ce0206
Instruction ID: 9f50d1039d2944fd5d30247634f996d7de93d89d857a42f0c321951709665ac8
Opcode Fuzzy Hash: b8cfdaea06722001956b0aafe146f20ddd62afe9fb121ab8594b662f82ce0206
Instruction Fuzzy Hash: 47A001E66AE216BCB15866966D0AC3B221DC5D4AAE360CA6EF80299549A880184A8036

Uniqueness

Uniqueness Score: -1.00%

Function 01364F96 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364F4C

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 3c08e69b62320cf9df213ac78b80bb299019f5cd98a662508333b94e690edc06
Instruction ID: 9f50d1039d2944fd5d30247634f996d7de93d89d857a42f0c321951709665ac8
Opcode Fuzzy Hash: 3c08e69b62320cf9df213ac78b80bb299019f5cd98a662508333b94e690edc06
Instruction Fuzzy Hash: 47A001E66AE216BCB15866966D0AC3B221DC5D4AAE360CA6EF80299549A880184A8036

Uniqueness

Uniqueness Score: -1.00%

Function 01364F82 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364F4C

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: a1fe978ab9a0f112e59f89c31337af9c64aa390ffd2e2be48cbf8a5615a32e88
Instruction ID: 9f50d1039d2944fd5d30247634f996d7de93d89d857a42f0c321951709665ac8
Opcode Fuzzy Hash: a1fe978ab9a0f112e59f89c31337af9c64aa390ffd2e2be48cbf8a5615a32e88
Instruction Fuzzy Hash: 47A001E66AE216BCB15866966D0AC3B221DC5D4AAE360CA6EF80299549A880184A8036

Uniqueness

Uniqueness Score: -1.00%

Function 01364F8C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364F4C

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 08c78e58c8bfa88fbe10cebdfee16b798766a245bd09380c9cb1b45b1ade7615
Instruction ID: 9f50d1039d2944fd5d30247634f996d7de93d89d857a42f0c321951709665ac8
Opcode Fuzzy Hash: 08c78e58c8bfa88fbe10cebdfee16b798766a245bd09380c9cb1b45b1ade7615
Instruction Fuzzy Hash: 47A001E66AE216BCB15866966D0AC3B221DC5D4AAE360CA6EF80299549A880184A8036

Uniqueness

Uniqueness Score: -1.00%

Function 01364E70 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364E62

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 1e543cc0225aec1d11591b83e6585f023d9abcf8616bf6114800b95a551d99f7
Instruction ID: 853a3668c169160da0a8512bc035dd710cc25b55ceb8adbf663e0d5c4f4cdbff
Opcode Fuzzy Hash: 1e543cc0225aec1d11591b83e6585f023d9abcf8616bf6114800b95a551d99f7
Instruction Fuzzy Hash: 7BA001E66EE606BCB14866966D06C3B121DC5D8FAA360CA2EF85684548A982184A8036

Uniqueness

Uniqueness Score: -1.00%

Function 01364E7A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364E62

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 9b68b334c225628228c9e7c4c5e2459c3c16112077cef8d80b20267f976c7fb7
Instruction ID: 853a3668c169160da0a8512bc035dd710cc25b55ceb8adbf663e0d5c4f4cdbff
Opcode Fuzzy Hash: 9b68b334c225628228c9e7c4c5e2459c3c16112077cef8d80b20267f976c7fb7
Instruction Fuzzy Hash: 7BA001E66EE606BCB14866966D06C3B121DC5D8FAA360CA2EF85684548A982184A8036

Uniqueness

Uniqueness Score: -1.00%

Function 01364E55 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364E62

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 681ddf9e653c395c8588ddf00d7f1b22123313d3590fa362cecec21cde766dfa
Instruction ID: c1bb005d338b928805e0b21bdd757e86e4e177e5e847f590a6c16356f9e0f31a
Opcode Fuzzy Hash: 681ddf9e653c395c8588ddf00d7f1b22123313d3590fa362cecec21cde766dfa
Instruction Fuzzy Hash: BCA011E22EA202BCB00822822C02C3B030CC0E0F2A320C22EF80280008A882080A8032

Uniqueness

Uniqueness Score: -1.00%

Function 01364EA2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364E62

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 5ad4f7e98f4ec7ec82b6b68942d6c62cbb31a5423cbce54f893f80dae431d4d3
Instruction ID: 853a3668c169160da0a8512bc035dd710cc25b55ceb8adbf663e0d5c4f4cdbff
Opcode Fuzzy Hash: 5ad4f7e98f4ec7ec82b6b68942d6c62cbb31a5423cbce54f893f80dae431d4d3
Instruction Fuzzy Hash: 7BA001E66EE606BCB14866966D06C3B121DC5D8FAA360CA2EF85684548A982184A8036

Uniqueness

Uniqueness Score: -1.00%

Function 01364EAC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364E62

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 02920cff77ea114992d36d67608f76335f83fe39e7eb644586173d6e7643af19
Instruction ID: 853a3668c169160da0a8512bc035dd710cc25b55ceb8adbf663e0d5c4f4cdbff
Opcode Fuzzy Hash: 02920cff77ea114992d36d67608f76335f83fe39e7eb644586173d6e7643af19
Instruction Fuzzy Hash: 7BA001E66EE606BCB14866966D06C3B121DC5D8FAA360CA2EF85684548A982184A8036

Uniqueness

Uniqueness Score: -1.00%

Function 01364E98 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364E62

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: c15c8d078f579a390a14eb21ea7c2c29beed27982d80bf3bc12d73c10133098a
Instruction ID: 853a3668c169160da0a8512bc035dd710cc25b55ceb8adbf663e0d5c4f4cdbff
Opcode Fuzzy Hash: c15c8d078f579a390a14eb21ea7c2c29beed27982d80bf3bc12d73c10133098a
Instruction Fuzzy Hash: 7BA001E66EE606BCB14866966D06C3B121DC5D8FAA360CA2EF85684548A982184A8036

Uniqueness

Uniqueness Score: -1.00%

Function 01364F9B Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 01364FA3

Part of subcall function 01365280: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0136528B
Part of subcall function 01365280: DloadReleaseSectionWriteAccess.DELAYIMP ref: 013652F3
Part of subcall function 01365280: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 01365304

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 1a85e5487c941559d60a4b833ddd09bf6a0db35d4cd85af038b4a7ad0448275e
Instruction ID: 970f2515d31998d94d40be54b1a2deba36a64254f5048022e4db41f0d1c79b0d
Opcode Fuzzy Hash: 1a85e5487c941559d60a4b833ddd09bf6a0db35d4cd85af038b4a7ad0448275e
Instruction Fuzzy Hash: 58A002E62BB202BCB14873966D06C3B121DC6D0FAA370C72EF800D4144A8801C8A8436

Uniqueness

Uniqueness Score: -1.00%

Function 01352509 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,0135A6E7), ref: 0135250C

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 294f3db3ef222d9042eb55eccac558bcff386341c42237fd17bfbc6e3cff7845
Instruction ID: 884a98f3a72d9d49c031f74b675320cb4cbd8153a430bc4662519795c9e3c5b7
Opcode Fuzzy Hash: 294f3db3ef222d9042eb55eccac558bcff386341c42237fd17bfbc6e3cff7845
Instruction Fuzzy Hash: 3BA0243045000D47CD311730C50410C3731F7107C470003F45007CF051C7134407C700

Uniqueness

Uniqueness Score: -1.00%

Function 01361719 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,01361A78,013A6D80,00000000,013A7D82,00000006), ref: 0136171D

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: baa73071e0f614098b5d7902e02d7e8dff25dda5e2064d3c79efee46d8b73383
Instruction ID: 8cb02fa386d79e74491b2cf15e5831136e3222a42162de37076bee60fb51d894
Opcode Fuzzy Hash: baa73071e0f614098b5d7902e02d7e8dff25dda5e2064d3c79efee46d8b73383
Instruction Fuzzy Hash: 5EA011302002008BC3222A308B0AA0EBAAEAFA0B20F00C02AA20A80020CB308820AB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01362D90 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 233windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 013511C6: GetDlgItem.USER32(00000000,00003021), ref: 0135120A
Part of subcall function 013511C6: SetWindowTextW.USER32(00000000,01379584), ref: 01351220

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 01362E21
EndDialog.USER32(?,00000006), ref: 01362E34
GetDlgItem.USER32(?,0000006C), ref: 01362E50
SetFocus.USER32(00000000), ref: 01362E57
SetDlgItemTextW.USER32(?,00000065,?), ref: 01362E91
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 01362EC8
FindFirstFileW.KERNEL32(?,?), ref: 01362EDE

Part of subcall function 0136172B: FileTimeToSystemTime.KERNEL32(?,?), ref: 0136173F
Part of subcall function 0136172B: SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 01361750
Part of subcall function 0136172B: SystemTimeToFileTime.KERNEL32(?,?), ref: 0136175E
Part of subcall function 0136172B: FileTimeToSystemTime.KERNEL32(?,?), ref: 0136176C
Part of subcall function 0136172B: GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 01361787
Part of subcall function 0136172B: GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 013617AE
Part of subcall function 0136172B: _swprintf.LIBCMT ref: 013617D4

_swprintf.LIBCMT ref: 01362F27

Part of subcall function 01352AA2: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01352AB5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 01362F3A
FindClose.KERNEL32(00000000), ref: 01362F41
_swprintf.LIBCMT ref: 01362F90
SetDlgItemTextW.USER32(?,00000068,?), ref: 01362FA3
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 01362FC0
_swprintf.LIBCMT ref: 01362FF3
SetDlgItemTextW.USER32(?,0000006B,?), ref: 01363006
_swprintf.LIBCMT ref: 01363050
SetDlgItemTextW.USER32(?,00000069,?), ref: 01363063

Part of subcall function 01361B15: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 01361B3B
Part of subcall function 01361B15: GetNumberFormatW.KERNEL32 ref: 01361B8A

Strings

%s %s, xrefs: 01362F14, 01362F20, 01362F86, 01362FE9, 01363046
REPLACEFILEDLG, xrefs: 01362DB7

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Item$Time$Text$_swprintf$FileSystem$FormatMessageSend$Find$CloseDateDialogFirstFocusInfoLocalLocaleNumberSpecificWindow__vswprintf_c_l
String ID: %s %s$REPLACEFILEDLG
API String ID: 3464475507-439456425
Opcode ID: cf2c09de2e491e774646f8e66851d051c6806c7c9a2d7ddac10205935bc2b82b
Instruction ID: 662b17394aad6095effec0e1b246e74af0773597f645479c7b266c99e2aafcbb
Opcode Fuzzy Hash: cf2c09de2e491e774646f8e66851d051c6806c7c9a2d7ddac10205935bc2b82b
Instruction Fuzzy Hash: 6C71B672548304BBE3319B68CC89FFB7BACEB96B04F054829FB49D6084E67595088772

Uniqueness

Uniqueness Score: -1.00%

Function 01373CFE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 01373E44

Strings

1#SNAN, xrefs: 01375043
1#QNAN, xrefs: 0137504A
1#INF, xrefs: 01375051
1#IND, xrefs: 0137503C

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 2e8f36747f5e3eb6e0fd5044a96779feed0dd2047fb1a5509cb98163f4fbbb49
Instruction ID: e8fee5f2c83932f9fec645fb8a0e11ce84785a1e47872aaa0d9a94996c14cefa
Opcode Fuzzy Hash: 2e8f36747f5e3eb6e0fd5044a96779feed0dd2047fb1a5509cb98163f4fbbb49
Instruction Fuzzy Hash: 3BC24A71E086298FDB35CE28DD407EAB7B9EB44309F1541EAD94DE7241E778AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 01365FF2 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 01365FFE
IsDebuggerPresent.KERNEL32 ref: 013660CA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 013660EA
UnhandledExceptionFilter.KERNEL32(?), ref: 013660F4

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 9ccb7cf3038eedba1c2878fd4c3e7a5cb4da8f182df7964bcf878553b9e49d61
Instruction ID: c2978be08115130a10ef556bc25dfa79538f2259eaaa26e07b89be9b8fe9ca38
Opcode Fuzzy Hash: 9ccb7cf3038eedba1c2878fd4c3e7a5cb4da8f182df7964bcf878553b9e49d61
Instruction Fuzzy Hash: F93129B5D0521DDBDF21DFA4D989BCCBBB8BF08348F1041AAE409AB244EB715A84CF45

Uniqueness

Uniqueness Score: -1.00%

Function 013650C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,0136500B,0000001C,01365200,00000000,?,?,?,?,?,?,?,0136500B,00000004,013B9274,01365290), ref: 013650D7
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,0136500B,00000004,013B9274,01365290), ref: 013650F2

Strings

D, xrefs: 013650E6

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 17e997e56489fa3f85e04c2969b1b64d6cbc140139e107b74881882591c7519b
Instruction ID: ca2f741585e0029a5e676fc89b8528da0d2fb719efc0eeee33745a369dfe20b2
Opcode Fuzzy Hash: 17e997e56489fa3f85e04c2969b1b64d6cbc140139e107b74881882591c7519b
Instruction Fuzzy Hash: 4501A772A40109ABDF24DE29DC05BEE7BADAFC4368F0CC224ED59D7149DA34D951C780

Uniqueness

Uniqueness Score: -1.00%

Function 0136A24F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0136A347
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0136A351
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0136A35E

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 21e8144082fc403f2636227f9857dc8ce1fc9ae0c3d55cbb91e129f209e886ec
Instruction ID: 398350bca227be723d714516539946c89fc9f5674a7fe2a2faf08a034bcf743f
Opcode Fuzzy Hash: 21e8144082fc403f2636227f9857dc8ce1fc9ae0c3d55cbb91e129f209e886ec
Instruction Fuzzy Hash: 7931C57490122D9BCB21DF68D989B8CBBB8BF18314F5082EAE41CA7254E7709B858F45

Uniqueness

Uniqueness Score: -1.00%

Function 01371758 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 013718EB

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 38748ae2721d2dbdfd4fcc0935b2c90db5f6ba1db12910d645f0eaaefc8d5c67
Instruction ID: ef99bb24324add103d5828ec48de342e4ea3761da0c3a5f6bc00eff8044768b1
Opcode Fuzzy Hash: 38748ae2721d2dbdfd4fcc0935b2c90db5f6ba1db12910d645f0eaaefc8d5c67
Instruction Fuzzy Hash: 8C31E272900249BFDB359E7DCC84EEABBADDB85318F0442A8E919D7241E6349A458B90

Uniqueness

Uniqueness Score: -1.00%

Function 01373850 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3dd93da610b919f8d165fbb2784f9b1b6ab208c1227b41d85b18d91c3e1033
Instruction ID: afad88226ba3b43d0f38fe3ee4d0624480ac3bfd6cfe59bf183600756ac1b369
Opcode Fuzzy Hash: fd3dd93da610b919f8d165fbb2784f9b1b6ab208c1227b41d85b18d91c3e1033
Instruction Fuzzy Hash: 6E023C71E002199BDF24CFADC8806AEBBF5FF48328F15816AD919E7341D735A9419B80

Uniqueness

Uniqueness Score: -1.00%

Function 01361B15 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 01361B3B
GetNumberFormatW.KERNEL32 ref: 01361B8A

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 2021e44e939fd7345ba7e3c5b1c3fa5683d9b1036f6fe8eb977b9ed5990c477a
Instruction ID: 7e40493610bcdcc6410aca94c536cb01cb5b8280dc20153056def7f44c48f025
Opcode Fuzzy Hash: 2021e44e939fd7345ba7e3c5b1c3fa5683d9b1036f6fe8eb977b9ed5990c477a
Instruction Fuzzy Hash: 21017175500309AED7209FA5DC45F9E77BCEF48728F008026FA04EB185E3709A25CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 01351891 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(013519FE,?,00000400), ref: 01351891
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 013518B2

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 45041f3d5f731274d10f2997df5c2fde5188573fc0eb5003abd1e7961440420f
Instruction ID: aee555a929c5e0826e24cfc6b9bda3303eb94b0f3340845a1058a1dc0df5522a
Opcode Fuzzy Hash: 45041f3d5f731274d10f2997df5c2fde5188573fc0eb5003abd1e7961440420f
Instruction Fuzzy Hash: 55D05230244300BAFA720A204C06F2A3BADBB00B69F048104BB10A80D0C6709020A728

Uniqueness

Uniqueness Score: -1.00%

Function 0135C42B Relevance: 1.9, Strings: 1, Instructions: 615COMMON

Download Yara Rule

Strings

0C6L3.cpl, xrefs: 0135C432

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID:
String ID: 0C6L3.cpl
API String ID: 0-1539666090
Opcode ID: 691db56a405778c0c61b2dcb848517d7d8998c4d556864aa743c5135ca939414
Instruction ID: e77d1c356b0af3e3bb965d9ae5853a0c0f009a89f780b219d67d58a32a6de43e
Opcode Fuzzy Hash: 691db56a405778c0c61b2dcb848517d7d8998c4d556864aa743c5135ca939414
Instruction Fuzzy Hash: AE22C171504316CFC7A5DE68D89082ABBEDFB84B2CF141A2DED9197384F731D9088B92

Uniqueness

Uniqueness Score: -1.00%

Function 01377E04 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,01377DFF,?,?,00000008,?,?,01377A9F,00000000), ref: 01378031

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 2aec8ef88ff66570c2615d4b6fa93a4662782c630135eb01c61f243fee8f29b9
Instruction ID: 490e5c0916c06cdad0c74989af1e405c31d736e017e21db9b3242bf48cb7e0d0
Opcode Fuzzy Hash: 2aec8ef88ff66570c2615d4b6fa93a4662782c630135eb01c61f243fee8f29b9
Instruction Fuzzy Hash: 8AB11A31210609DFE725CF2CC58AB657FA0FF45368F258698E999CF2A1C339D995CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01352D8E Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 01352DB3

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 0f718a6c30a4109c07e5569d7fe1b8c9ebe3d3567e1282ce2ddfa50e80f5b67e
Instruction ID: 13ce6b8aa91725bedc45059326f3303f359c9317d7a171d1034cdcefc69b9fc6
Opcode Fuzzy Hash: 0f718a6c30a4109c07e5569d7fe1b8c9ebe3d3567e1282ce2ddfa50e80f5b67e
Instruction Fuzzy Hash: D9F017F4904208CBCB29CB18E882ADE77E9FB88758F500295D92593388D7709A848FA1

Uniqueness

Uniqueness Score: -1.00%

Function 01356B0D Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

, xrefs: 01356B40

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 934ccf0cd4b67d897cb7c2438ec395f92651c0feaeced376863ec7c5dca47e2e
Instruction ID: ff3660bc8c7c2d66a1d823b9c95cf18f8fdc40317b60209da62ee46e95bd67d3
Opcode Fuzzy Hash: 934ccf0cd4b67d897cb7c2438ec395f92651c0feaeced376863ec7c5dca47e2e
Instruction Fuzzy Hash: 021146B19047099FD7A48F5AD846B5AFBF5EB00718F50C92ED9A6E2580D371E140CB00

Uniqueness

Uniqueness Score: -1.00%

Function 01372440 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 01372440

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9f8d2e525faa8c3c73d4be92bde00c09de7ff8c01686c11c3bcbcd43607d953e
Instruction ID: 0bf8f0083e15eb7143dedea8495301b3b647744309b05f0a2dd2baf7a282d987
Opcode Fuzzy Hash: 9f8d2e525faa8c3c73d4be92bde00c09de7ff8c01686c11c3bcbcd43607d953e
Instruction Fuzzy Hash: 17A001B06022018BDBA08E75A68D30A3BEDAA457A9B068169A609C6268FA248460DB01

Uniqueness

Uniqueness Score: -1.00%

Function 01355AFD Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27329bd2b38ea0fc70af58ccf55552f5284fd50f828b14c9829db2735e4e426b
Instruction ID: f9615137fc880c777caddae59361c6c4b83886dd2e66d10cda692cf98f2b749f
Opcode Fuzzy Hash: 27329bd2b38ea0fc70af58ccf55552f5284fd50f828b14c9829db2735e4e426b
Instruction Fuzzy Hash: 66524B726187018FC718CF19C891A6AF7E1FFCC304F498A2DE9959B255D334EA19CB86

Uniqueness

Uniqueness Score: -1.00%

Function 01354F3C Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 730cedae5e032ea2acdef81fe9a8540f9002496c6160569bf7150c16bdff4a7c
Instruction ID: 99f44201b0ac8778ff310453ba443751ad2a6f1a27f711bb728f38c066eb3a2b
Opcode Fuzzy Hash: 730cedae5e032ea2acdef81fe9a8540f9002496c6160569bf7150c16bdff4a7c
Instruction Fuzzy Hash: B6D15B745083928FC755CF29E09087EFBF4AB9A310F08895EF5E58734AC231E61ADB61

Uniqueness

Uniqueness Score: -1.00%

Function 0136B72C Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8c5b1a7093fdd6b2c97badd3fdd53e6382018a618ee7ca9affa3e5dc6e03b1
Instruction ID: f1162a36ebbac12f2876fffdafeb203b14ab17e1abcbfae529981ca27d623979
Opcode Fuzzy Hash: bf8c5b1a7093fdd6b2c97badd3fdd53e6382018a618ee7ca9affa3e5dc6e03b1
Instruction Fuzzy Hash: F261AD7170034DABEE34592C8895BBEFB9CDF1120CF08C42AEA82DB68DD219D9418F55

Uniqueness

Uniqueness Score: -1.00%

Function 0136B4FD Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction ID: bb5bd17b5662c118fa49633a437d0c7c8281c7db21608a1ee6e7fc3bbcd63451
Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction Fuzzy Hash: 325187A1700649D7EF38892C85A57FFEB9D9F1231CF08C919D782CB69EC615DA018F22

Uniqueness

Uniqueness Score: -1.00%

Function 013554DD Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9615c2b8285eff84a7c5dfa0d8d9816c9273637927f61b83547e9f544fbdee3c
Instruction ID: 302bc222f5489a9d88f30f7e9341ef61b9cd733a735964bb205be365e5b0d5b9
Opcode Fuzzy Hash: 9615c2b8285eff84a7c5dfa0d8d9816c9273637927f61b83547e9f544fbdee3c
Instruction Fuzzy Hash: 6951F5715093D58FC702CF28D14096EFFE1AF9AA2CF4A089DE8D55B142D230E64ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 01354878 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0135489E

Part of subcall function 01352AA2: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01352AB5

Part of subcall function 01357B9F: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,013548BA,?,00000000,00000000,?,?,?,013548BA,?,?,00000050), ref: 01357BBC

SetDlgItemTextW.USER32(?,01384154,?), ref: 0135491F
GetWindowRect.USER32(?,?), ref: 01354959
GetClientRect.USER32(?,?), ref: 01354965
GetWindowLongW.USER32(?,000000F0), ref: 01354A05
GetWindowRect.USER32(?,?), ref: 01354A32
SetWindowTextW.USER32(?,?), ref: 01354A6B
GetSystemMetrics.USER32(00000008), ref: 01354A73
GetWindow.USER32(?,00000005), ref: 01354A7E
GetWindowRect.USER32(00000000,?), ref: 01354AAB
GetWindow.USER32(00000000,00000002), ref: 01354B1D

Strings

$%s:, xrefs: 01354892
CAPTION, xrefs: 01354A4D
d, xrefs: 01354985

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_swprintf
String ID: $%s:$CAPTION$d
API String ID: 3208934588-2512411981
Opcode ID: 0a06f5e166fe57396a29b52efc4baaecfd8f963958b73e9af0c10a3e39d9e26e
Instruction ID: f0f909cbce9cca350ac1434e54240cfec0e57340396b8572a1da941bff5b7329
Opcode Fuzzy Hash: 0a06f5e166fe57396a29b52efc4baaecfd8f963958b73e9af0c10a3e39d9e26e
Instruction Fuzzy Hash: C181A472608301AFD764DF68CD85E6FBBFDEB89718F04451DFA84A3244E670E9058B52

Uniqueness

Uniqueness Score: -1.00%

Function 01372F32 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 01372F76

Part of subcall function 01372B11: _free.LIBCMT ref: 01372B2E
Part of subcall function 01372B11: _free.LIBCMT ref: 01372B40
Part of subcall function 01372B11: _free.LIBCMT ref: 01372B52
Part of subcall function 01372B11: _free.LIBCMT ref: 01372B64
Part of subcall function 01372B11: _free.LIBCMT ref: 01372B76
Part of subcall function 01372B11: _free.LIBCMT ref: 01372B88
Part of subcall function 01372B11: _free.LIBCMT ref: 01372B9A
Part of subcall function 01372B11: _free.LIBCMT ref: 01372BAC
Part of subcall function 01372B11: _free.LIBCMT ref: 01372BBE
Part of subcall function 01372B11: _free.LIBCMT ref: 01372BD0
Part of subcall function 01372B11: _free.LIBCMT ref: 01372BE2
Part of subcall function 01372B11: _free.LIBCMT ref: 01372BF4
Part of subcall function 01372B11: _free.LIBCMT ref: 01372C06

_free.LIBCMT ref: 01372F6B

Part of subcall function 0136F8BA: RtlFreeHeap.NTDLL(00000000,00000000,?,01372CA6,?,00000000,?,00000000,?,01372CCD,?,00000007,?,?,013730CA,?), ref: 0136F8D0
Part of subcall function 0136F8BA: GetLastError.KERNEL32(?,?,01372CA6,?,00000000,?,00000000,?,01372CCD,?,00000007,?,?,013730CA,?,?), ref: 0136F8E2

_free.LIBCMT ref: 01372F8D
_free.LIBCMT ref: 01372FA2
_free.LIBCMT ref: 01372FAD
_free.LIBCMT ref: 01372FCF
_free.LIBCMT ref: 01372FE2
_free.LIBCMT ref: 01372FF0
_free.LIBCMT ref: 01372FFB
_free.LIBCMT ref: 01373033
_free.LIBCMT ref: 0137303A
_free.LIBCMT ref: 01373057
_free.LIBCMT ref: 0137306F

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 242aa1dcd7aef650d79d84d6e31200c6a6c27d1f92b6390f24d2229a98178753
Instruction ID: b9e5d7a634ce0753e691e6736da596d57d9d43c73f0eb28a256ef3e1e52bfe72
Opcode Fuzzy Hash: 242aa1dcd7aef650d79d84d6e31200c6a6c27d1f92b6390f24d2229a98178753
Instruction Fuzzy Hash: 743152325007059FFB36AA3DE844B5BBBEDFF10218F108469E95AD7254DF39A884DB10

Uniqueness

Uniqueness Score: -1.00%

Function 0136415E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 01364181
GetClassNameW.USER32(00000000,?,00000800), ref: 013641AD

Part of subcall function 01357D7D: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,01353108,?,?,?,013530B5,?,-00000002,?,00000000,?), ref: 01357D93

GetWindowLongW.USER32(00000000,000000F0), ref: 013641C9
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 013641E0
GetObjectW.GDI32(00000000,00000018,?), ref: 013641F4
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0136421D
DeleteObject.GDI32(00000000), ref: 01364224
GetWindow.USER32(00000000,00000002), ref: 0136422D

Strings

STATIC, xrefs: 013641B3

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: a941a946319f00469898b5630235516ba512c78762e580e25713312ca2f7de5f
Instruction ID: f4a2c0cf66c0b39b39a8faece5038a506282810a514aa93d3f5f8bdc17be40e3
Opcode Fuzzy Hash: a941a946319f00469898b5630235516ba512c78762e580e25713312ca2f7de5f
Instruction Fuzzy Hash: CF113672A047117BE7316B28EC89FAF7A5CEF54759F008020FF41A708DEB68890687B4

Uniqueness

Uniqueness Score: -1.00%

Function 0136F671 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0136F685

Part of subcall function 0136F8BA: RtlFreeHeap.NTDLL(00000000,00000000,?,01372CA6,?,00000000,?,00000000,?,01372CCD,?,00000007,?,?,013730CA,?), ref: 0136F8D0
Part of subcall function 0136F8BA: GetLastError.KERNEL32(?,?,01372CA6,?,00000000,?,00000000,?,01372CCD,?,00000007,?,?,013730CA,?,?), ref: 0136F8E2

_free.LIBCMT ref: 0136F691
_free.LIBCMT ref: 0136F69C
_free.LIBCMT ref: 0136F6A7
_free.LIBCMT ref: 0136F6B2
_free.LIBCMT ref: 0136F6BD
_free.LIBCMT ref: 0136F6C8
_free.LIBCMT ref: 0136F6D3
_free.LIBCMT ref: 0136F6DE
_free.LIBCMT ref: 0136F6EC

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3bd744ad36be5cf2084c115e0625035ef743b4da670cd06f2f05060c444d41a0
Instruction ID: 0dd8114335878575a8960071587e36733a8003643ee82eba9a3ecfdc105b131e
Opcode Fuzzy Hash: 3bd744ad36be5cf2084c115e0625035ef743b4da670cd06f2f05060c444d41a0
Instruction Fuzzy Hash: 0A11A476900119BFDB01EF98E860CDD3FBEEF18254B01C1A5FA188B225DA31DE519B80

Uniqueness

Uniqueness Score: -1.00%

Function 01369221 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 01369340
___TypeMatch.LIBVCRUNTIME ref: 0136944E
_UnwindNestedFrames.LIBCMT ref: 013695A0
CallUnexpected.LIBVCRUNTIME ref: 013695BB
_abort.LIBCMT ref: 013695C0

Strings

csm, xrefs: 01369377
csm, xrefs: 013692CB
csm, xrefs: 0136925E

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 2039b88b90fa1438da33a9efe967476460f11a8b62d0fe05e685fc1f054b20b7
Instruction ID: a848cd008166c09e3611f8ef03175f48d3814907833e2a1f57ff1ffcccd8e830
Opcode Fuzzy Hash: 2039b88b90fa1438da33a9efe967476460f11a8b62d0fe05e685fc1f054b20b7
Instruction Fuzzy Hash: 65B16C7190020ADFCF15DFA8C980AAEBBBDFF1831CF14815AE9056B21AD771DA51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 013601D1 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 013601F6
_wcslen.LIBCMT ref: 01360296
GlobalAlloc.KERNEL32(00000040,?), ref: 013602A5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 013602C6

Strings

<html>, xrefs: 01360215, 0136024E
</html>, xrefs: 01360277
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 01360220
utf-8"></head>, xrefs: 0136022B

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _wcslen$AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1116704506-4209811716
Opcode ID: 1686b8a8b5b73e4cf8bf22d5bc5fd643856ff24ae19ca273e5042afc684009ab
Instruction ID: 4bd283db14fae681aa1d2ad8073cf6f0a03f9bc84a99984bd1705434e10330a2
Opcode Fuzzy Hash: 1686b8a8b5b73e4cf8bf22d5bc5fd643856ff24ae19ca273e5042afc684009ab
Instruction Fuzzy Hash: E7317D322043167BE739AB78DC06F6F7BACDF52728F14800DF551A71C9EBA4990883A5

Uniqueness

Uniqueness Score: -1.00%

Function 01362130 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 013511C6: GetDlgItem.USER32(00000000,00003021), ref: 0135120A
Part of subcall function 013511C6: SetWindowTextW.USER32(00000000,01379584), ref: 01351220

EndDialog.USER32(?,00000001), ref: 01362180
SendMessageW.USER32(?,00000080,00000001,?), ref: 013621A7
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 013621C0
SetWindowTextW.USER32(?,?), ref: 013621D1
GetDlgItem.USER32(?,00000065), ref: 013621DA
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 013621EE
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 01362204

Strings

LICENSEDLG, xrefs: 01362144

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: e5582cdc7045b65666e9cfded37745c9c6cdfbc100dbef3a805f1455ae69db26
Instruction ID: c10f6478dfebdd11c6e5df2ee92508b76ed6ee035552891bce55056c5b8710b5
Opcode Fuzzy Hash: e5582cdc7045b65666e9cfded37745c9c6cdfbc100dbef3a805f1455ae69db26
Instruction Fuzzy Hash: DB21E532644209BBE2315F39EC8DE7B3B7CEB8AB89F028014F705A619CE75699019731

Uniqueness

Uniqueness Score: -1.00%

Function 0136172B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 0136173F
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 01361750
SystemTimeToFileTime.KERNEL32(?,?), ref: 0136175E
FileTimeToSystemTime.KERNEL32(?,?), ref: 0136176C
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 01361787
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 013617AE
_swprintf.LIBCMT ref: 013617D4

Strings

%s %s, xrefs: 013617C9

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecific_swprintf
String ID: %s %s
API String ID: 385609497-2939940506
Opcode ID: 25b9772cbc1a5469725777926e9e1721a1b81d4690ddd8c6004032f4230891b7
Instruction ID: 3542659f2009dd2c054db4b836b9bd40fad9f0aef5807f749b83069d2441c27d
Opcode Fuzzy Hash: 25b9772cbc1a5469725777926e9e1721a1b81d4690ddd8c6004032f4230891b7
Instruction Fuzzy Hash: 402106B251019CAFDB22DFA1DC48EEF3BADFF49318F044526FA05D2105E625DA49CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0136081E Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0136082A

Strings

<style>, xrefs: 01360950
>, xrefs: 0136086B
<br>, xrefs: 0136091E
</style>, xrefs: 01360972
</p>, xrefs: 01360908

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 4d96279c7babe9063e40910478096c0c90679bdbc389fd590e29cd58928a6cea
Instruction ID: e0afa81a3a02af3462b8299bb8ecf145b4eb10c1d459148250cfc6208569b874
Opcode Fuzzy Hash: 4d96279c7babe9063e40910478096c0c90679bdbc389fd590e29cd58928a6cea
Instruction Fuzzy Hash: 94515F6674032355F7389A1C4C13B7A77EDDF51698F58841BFEC09B1D9FBA588408391

Uniqueness

Uniqueness Score: -1.00%

Function 01375A9D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,01376212,00000000,00000000,00000000,00000000,00000000,0136B802), ref: 01375ADF
__fassign.LIBCMT ref: 01375B5A
__fassign.LIBCMT ref: 01375B75
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 01375B9B
WriteFile.KERNEL32(?,00000000,00000000,01376212,00000000,?,?,?,?,?,?,?,?,?,01376212,00000000), ref: 01375BBA
WriteFile.KERNEL32(?,00000000,00000001,01376212,00000000,?,?,?,?,?,?,?,?,?,01376212,00000000), ref: 01375BF3

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: e82a32adac15d77fdea32503804c915ec92ac9fec255913bbc076411deffa412
Instruction ID: df20c04b4fc2f3b036b527e2e1ff36845857fb7328bcef9276e27e87a0716536
Opcode Fuzzy Hash: e82a32adac15d77fdea32503804c915ec92ac9fec255913bbc076411deffa412
Instruction Fuzzy Hash: E951A3B1A0020D9FDB24CFA8D885BEEBBF8EF19314F14421AE655E7291E6349941CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01368B60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 01368B97
___except_validate_context_record.LIBVCRUNTIME ref: 01368B9F
_ValidateLocalCookies.LIBCMT ref: 01368C28
__IsNonwritableInCurrentImage.LIBCMT ref: 01368C53
_ValidateLocalCookies.LIBCMT ref: 01368CA8

Strings

csm, xrefs: 01368C3D

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 890cab931e13b3c1e8f98afec2b1a3d8e84975d7a87d4496b3c5536eae44b115
Instruction ID: 394dd1b8138f4bb7e75ea81c7955430563c01923a2dea68ee0219ef0e660b94d
Opcode Fuzzy Hash: 890cab931e13b3c1e8f98afec2b1a3d8e84975d7a87d4496b3c5536eae44b115
Instruction Fuzzy Hash: 9541BF30A01309AFCF20DF6CC884A9EBBB9AF5932CF04C195E9186B35DD7719905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 013609F5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 01360A0E
GetWindowRect.USER32(?,?), ref: 01360A64
ShowWindow.USER32(?,00000005,00000000), ref: 01360B01
SetWindowTextW.USER32(?,00000000), ref: 01360B09
ShowWindow.USER32(00000000,00000005), ref: 01360B1F

Strings

RarHtmlClassName, xrefs: 01360AC5

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: ef499c4b987c41d778775c1a13917ae55af9f1d8d7843bcd9907cc65313c7bec
Instruction ID: 809d9d4963bd3f17f498722bf72f0ead17e5804124dad9d2f6ba1e9378809286
Opcode Fuzzy Hash: ef499c4b987c41d778775c1a13917ae55af9f1d8d7843bcd9907cc65313c7bec
Instruction Fuzzy Hash: FD41E431404204AFDB259F68DC89B6B7FACEF48749F00C658FA496B159EB30D440CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01360475 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0136047E
_wcslen.LIBCMT ref: 013604B3

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 013604A7
<br>, xrefs: 013604FF
, xrefs: 013604D0
 , xrefs: 01360541

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: 3334e24d8750b0e5d7dd0145f7e9564cbfda3f986cd1f50f838b4d215d727ed7
Instruction ID: 7314f638fb23e610000bd50d5591e7ebdc10de3d3fbaef6f9a11e787b2a6cf51
Opcode Fuzzy Hash: 3334e24d8750b0e5d7dd0145f7e9564cbfda3f986cd1f50f838b4d215d727ed7
Instruction Fuzzy Hash: 4C315E61648306E6E639BF9C9C03B7B73ACEB40328F14C41FF99567284FA95A94083A5

Uniqueness

Uniqueness Score: -1.00%

Function 01372CB4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01372C78: _free.LIBCMT ref: 01372CA1

_free.LIBCMT ref: 01372D02

Part of subcall function 0136F8BA: RtlFreeHeap.NTDLL(00000000,00000000,?,01372CA6,?,00000000,?,00000000,?,01372CCD,?,00000007,?,?,013730CA,?), ref: 0136F8D0
Part of subcall function 0136F8BA: GetLastError.KERNEL32(?,?,01372CA6,?,00000000,?,00000000,?,01372CCD,?,00000007,?,?,013730CA,?,?), ref: 0136F8E2

_free.LIBCMT ref: 01372D0D
_free.LIBCMT ref: 01372D18
_free.LIBCMT ref: 01372D6C
_free.LIBCMT ref: 01372D77
_free.LIBCMT ref: 01372D82
_free.LIBCMT ref: 01372D8D

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction ID: c13564c5878925856a7b8a196e29d566b50de13f730e6ecf96edd2cb3c3ce017
Opcode Fuzzy Hash: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction Fuzzy Hash: BA1193B2940F06BAE930B7F4CD05FCB7BADAF30704F404D28B7AAA6150DA38B5059790

Uniqueness

Uniqueness Score: -1.00%

Function 01365011 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0136508C,01364FEF,01365290), ref: 01365028
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0136503E
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 01365053

Strings

ReleaseSRWLockExclusive, xrefs: 01365048
KERNEL32.DLL, xrefs: 01365023
AcquireSRWLockExclusive, xrefs: 01365038

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 5c271e9ab73cd8d16743ade196053a6ea2a4014965810a14dae207d7b56ec028
Instruction ID: a1ccdc11fdfa1d291d87d0a92313632a570c96915206d6cbb2f112427a9ce07e
Opcode Fuzzy Hash: 5c271e9ab73cd8d16743ade196053a6ea2a4014965810a14dae207d7b56ec028
Instruction Fuzzy Hash: C9F0C871746217ABEF324D799CC4AAA779C6B023EC308813DDB41DAA0CE611C845D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 01368EEA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,01368EE1,01368E6C,013661F4), ref: 01368EF8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 01368F06
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 01368F1F
SetLastError.KERNEL32(00000000,01368EE1,01368E6C,013661F4), ref: 01368F71

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f6f52f21804a8f4f008880e674c94bd9bccb3b28570383a65022e20d493d09c1
Instruction ID: 886048d367b779444e657cce1131e5be6ac428fdf5fac71e781ccea06083941f
Opcode Fuzzy Hash: f6f52f21804a8f4f008880e674c94bd9bccb3b28570383a65022e20d493d09c1
Instruction Fuzzy Hash: A601B5322197139EE6356E7D7C44A2A3A5DEB1577CB308369E210694DCFE5248459344

Uniqueness

Uniqueness Score: -1.00%

Function 0136F765 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0136ABD7,?,?,?,0136A652,00000050), ref: 0136F769
_free.LIBCMT ref: 0136F79C
_free.LIBCMT ref: 0136F7C4
SetLastError.KERNEL32(00000000), ref: 0136F7D1
SetLastError.KERNEL32(00000000), ref: 0136F7DD
_abort.LIBCMT ref: 0136F7E3

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 2b06e35595b11a4be7bee804d48ab18bf32b53a39e7b187f6b66b48f2eddfe1b
Instruction ID: 13ed8b5e5fe386be4914889b492e1b4f94201ce8a5d9fd7ad0b8290154a9b549
Opcode Fuzzy Hash: 2b06e35595b11a4be7bee804d48ab18bf32b53a39e7b187f6b66b48f2eddfe1b
Instruction Fuzzy Hash: 7CF0CD37200602A6D733363C7C55B1B297D5FD17BDF258224F915D258DEF2988014220

Uniqueness

Uniqueness Score: -1.00%

Function 01363939 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0136394F

Part of subcall function 013531E2: _wcslen.LIBCMT ref: 013531E8

_swprintf.LIBCMT ref: 01363983

Part of subcall function 01352AA2: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01352AB5

SetDlgItemTextW.USER32(?,00000066,013A7D82), ref: 013639A3
EndDialog.USER32(?,00000001), ref: 01363AB0

Strings

%s%s%u, xrefs: 01363978

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: 73f700b94ef2da12fcc6fd074ae867426cbdf13f3c4eab4471cc2b74cc96deec
Instruction ID: 89b6dc4930bb254a2bc0e2ac6fe93e9e1cfc1abf0855977ccd962c1cbd857142
Opcode Fuzzy Hash: 73f700b94ef2da12fcc6fd074ae867426cbdf13f3c4eab4471cc2b74cc96deec
Instruction Fuzzy Hash: 66416472900119AADF31DB98CC44FEE77BCFB14748F8080A6EA0DA7145EB719A449FA5

Uniqueness

Uniqueness Score: -1.00%

Function 013535E5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 01353609
GetCurrentDirectoryW.KERNEL32(000007FF,?,000000FF,000000FF,?,?,?,?,01352763,000000FF,?,00000800,?,?,01351D8F,?), ref: 013536A7
_wcslen.LIBCMT ref: 0135371D

Strings

UNC, xrefs: 01353689
\\?\, xrefs: 01353634, 0135367B, 013536D9, 01353730

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: 3d62bec54ad4333958a04cb866f95f540292a66bb11c7fd0b7a7c96ce9d9382a
Instruction ID: b73fa990f45a01c6501c9e17b814f5ea52b3d50206a60619eb414438ebabb894
Opcode Fuzzy Hash: 3d62bec54ad4333958a04cb866f95f540292a66bb11c7fd0b7a7c96ce9d9382a
Instruction Fuzzy Hash: 2141C3B184025ABACB61AF2CCC41EEE7B79BF11FECB404129FD14A7100E7719A4087A0

Uniqueness

Uniqueness Score: -1.00%

Function 0136224D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 0136225D
GetObjectW.GDI32(00000000,00000018,?), ref: 01362282
DeleteObject.GDI32(00000000), ref: 013622B4
DeleteObject.GDI32(00000000), ref: 013622D7

Part of subcall function 013611D2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,013622AD,00000066), ref: 013611E5
Part of subcall function 013611D2: SizeofResource.KERNEL32(00000000,?,?,?,013622AD,00000066), ref: 013611FC
Part of subcall function 013611D2: LoadResource.KERNEL32(00000000,?,?,?,013622AD,00000066), ref: 01361213
Part of subcall function 013611D2: LockResource.KERNEL32(00000000,?,?,?,013622AD,00000066), ref: 01361222
Part of subcall function 013611D2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,013622AD,00000066), ref: 0136123D
Part of subcall function 013611D2: GlobalLock.KERNEL32 ref: 0136124E
Part of subcall function 013611D2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 013612B7
Part of subcall function 013611D2: GlobalUnlock.KERNEL32(00000000), ref: 013612D6
Part of subcall function 013611D2: GlobalFree.KERNEL32 ref: 013612DD

Strings

], xrefs: 0136228A

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: GlobalResource$Object$BitmapDeleteLoadLock$AllocCreateFindFreeFromGdipSizeofUnlock
String ID: ]
API String ID: 1428510222-3352871620
Opcode ID: 38172ebfb3500ca5d6d565f670e6e61f2d1e7688b65d8ca63706d0e94ffb1036
Instruction ID: 88021aad8e049acbdf30575b736deb4254ee0f3c45f5e7474f8a6956f0744950
Opcode Fuzzy Hash: 38172ebfb3500ca5d6d565f670e6e61f2d1e7688b65d8ca63706d0e94ffb1036
Instruction Fuzzy Hash: B101D232900606ABDB62276C8C09A6F7E7EABC1B99F054014EE00B728CEF35880546A1

Uniqueness

Uniqueness Score: -1.00%

Function 013640C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 013511C6: GetDlgItem.USER32(00000000,00003021), ref: 0135120A
Part of subcall function 013511C6: SetWindowTextW.USER32(00000000,01379584), ref: 01351220

EndDialog.USER32(?,00000001), ref: 0136410B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 01364121
SetDlgItemTextW.USER32(?,00000066,?), ref: 01364135
SetDlgItemTextW.USER32(?,00000068), ref: 01364144

Strings

RENAMEDLG, xrefs: 013640D8

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 5b85165075cf8954891e1ea550836e7224eb1d62a53a36d8a811c309b882710e
Instruction ID: 07d76b4c6c7eb72d512afe150e46dacacf1bcb1664606b7935d0b05998574846
Opcode Fuzzy Hash: 5b85165075cf8954891e1ea550836e7224eb1d62a53a36d8a811c309b882710e
Instruction Fuzzy Hash: E701D432B80614FBE2319F69AC89F6B7BACFBAAB4AF004415F301A71C8C76155458775

Uniqueness

Uniqueness Score: -1.00%

Function 0136E447 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0136E3F8,00000003,?,0136E398,00000003,01381D50,0000000C,0136E4EF,00000003,00000002), ref: 0136E467
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0136E47A
FreeLibrary.KERNEL32(00000000,?,?,?,0136E3F8,00000003,?,0136E398,00000003,01381D50,0000000C,0136E4EF,00000003,00000002,00000000), ref: 0136E49D

Strings

CorExitProcess, xrefs: 0136E472
mscoree.dll, xrefs: 0136E460

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 605a880c7e05e25d5e620bf2bf6a1ab170eb69df96c1c9050a5be696238f047f
Instruction ID: fc8f4db93ba461b9a22840c704201776fc4fd19230b57aa90a867e8b29bccd49
Opcode Fuzzy Hash: 605a880c7e05e25d5e620bf2bf6a1ab170eb69df96c1c9050a5be696238f047f
Instruction Fuzzy Hash: 2FF0443151021DBBDB219BA5EC49B9D7FBCDF04769F008168F909A2254DB754A44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013558FC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 01356B9C: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 01356BB7
Part of subcall function 01356B9C: LoadLibraryW.KERNELBASE(?,?,0135590F,Crypt32.dll,00000000,01355989,?,?,0135596C,00000000,00000000,?,00000000), ref: 01356BD9

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0135591B
GetProcAddress.KERNEL32(0138E028,CryptUnprotectMemory), ref: 0135592B

Strings

Crypt32.dll, xrefs: 01355905
CryptProtectMemory, xrefs: 01355915
CryptUnprotectMemory, xrefs: 01355921

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 58834f193251776aee9f62dae5ad518057c8d0b40aadd4ae12b20a0c69142340
Instruction ID: 83b8fdc8e159fa1a2861653166775c7b99317702f079f8b818dd8decf69584b9
Opcode Fuzzy Hash: 58834f193251776aee9f62dae5ad518057c8d0b40aadd4ae12b20a0c69142340
Instruction Fuzzy Hash: 77E04F70851741AEDB715F39A889B81BAE89F25B3CF01891DE8DAD2200D6BAE0808B50

Uniqueness

Uniqueness Score: -1.00%

Function 01368FCA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 01369091
___AdjustPointer.LIBCMT ref: 013690B4
_abort.LIBCMT ref: 01369102
___AdjustPointer.LIBCMT ref: 01369150

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: b8e0c3fbc9d648a8bdac64ddfcf786759b18bfc7dec21684c893b7ff7e10f032
Instruction ID: ddfc5b98ed055bc5d4a4a80135da9650e528e21f9903658aaec057df1232ea98
Opcode Fuzzy Hash: b8e0c3fbc9d648a8bdac64ddfcf786759b18bfc7dec21684c893b7ff7e10f032
Instruction Fuzzy Hash: A151D172604206DFEF298F19D845B6A7BBDEF5431CF24C52DDA054B698E732E841C790

Uniqueness

Uniqueness Score: -1.00%

Function 01372340 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 01372349
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0137236C

Part of subcall function 0136F9E5: RtlAllocateHeap.NTDLL(00000000,?,?,?,0136A7E9,?,0000015D,?,?,?,?,0136BCC5,000000FF,00000000,?,?), ref: 0136FA17

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 01372392
_free.LIBCMT ref: 013723A5
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 013723B4

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: ebf4be9bdf28f2279034b217c6b2be92c058d65501e715dfeb9610f6d4a8b7ff
Instruction ID: 0b7215b9dee3437221bc9e061d50dd069ef6a4f1e3c4261e3d205b3b85fec397
Opcode Fuzzy Hash: ebf4be9bdf28f2279034b217c6b2be92c058d65501e715dfeb9610f6d4a8b7ff
Instruction Fuzzy Hash: AE0184726016157FF33119AE6C8CD7B6E7EEFC2A68316027DFE04D3244DA688C0182B0

Uniqueness

Uniqueness Score: -1.00%

Function 0136F7E9 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0136F9D7,01371598,?,0136F793,00000001,00000364,?,0136ABD7,?,?,?,0136A652,00000050), ref: 0136F7EE
_free.LIBCMT ref: 0136F823
_free.LIBCMT ref: 0136F84A
SetLastError.KERNEL32(00000000), ref: 0136F857
SetLastError.KERNEL32(00000000), ref: 0136F860

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: afa4b5d673332c8742c949396e33adc167edc47b1cf63b0389890d7b2ced7188
Instruction ID: f2746d7ccbccbfecdc66ad3efd994f82383094d1858e413cc8765ae1434ec3bf
Opcode Fuzzy Hash: afa4b5d673332c8742c949396e33adc167edc47b1cf63b0389890d7b2ced7188
Instruction Fuzzy Hash: A001F977200726A7D333667D7CA4B2B2E6EDFD137CB218178FA15D2699EA24C8018360

Uniqueness

Uniqueness Score: -1.00%

Function 01372C0F Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 01372C27

Part of subcall function 0136F8BA: RtlFreeHeap.NTDLL(00000000,00000000,?,01372CA6,?,00000000,?,00000000,?,01372CCD,?,00000007,?,?,013730CA,?), ref: 0136F8D0
Part of subcall function 0136F8BA: GetLastError.KERNEL32(?,?,01372CA6,?,00000000,?,00000000,?,01372CCD,?,00000007,?,?,013730CA,?,?), ref: 0136F8E2

_free.LIBCMT ref: 01372C39
_free.LIBCMT ref: 01372C4B
_free.LIBCMT ref: 01372C5D
_free.LIBCMT ref: 01372C6F

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 713038242a3407beb07b8597e4c48d485801f51700b4e72e08540ef5ada336e8
Instruction ID: 6539e0677d21954ae3779a09af7c792579197bd605bafa31a99594edd9f7652c
Opcode Fuzzy Hash: 713038242a3407beb07b8597e4c48d485801f51700b4e72e08540ef5ada336e8
Instruction Fuzzy Hash: 31F06273500612ABEA30DFACF6C4D5B7BEEBA247147644809F918D7A09CB38F8808750

Uniqueness

Uniqueness Score: -1.00%

Function 01357D9F Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 01357DA7
_wcslen.LIBCMT ref: 01357DB8
_wcslen.LIBCMT ref: 01357DC8
_wcslen.LIBCMT ref: 01357DD6
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,01352F91,?,?,00000000,?,?,?), ref: 01357DF1

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 8433a848b0fb8bf53853a98660613c9640ea45c9e5bcb51f6ba6904e6b0a786d
Instruction ID: cb99dfc045a0c65f388da1a69ffc4ada13673c888c17fcf2c2387484243f3da4
Opcode Fuzzy Hash: 8433a848b0fb8bf53853a98660613c9640ea45c9e5bcb51f6ba6904e6b0a786d
Instruction Fuzzy Hash: 7CF03033448069BBCF121F55EC08DDE7F2AFB40B74B15C415F9296B064CA329551D790

Uniqueness

Uniqueness Score: -1.00%

Function 0136EEE0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0136EEFE

Part of subcall function 0136F8BA: RtlFreeHeap.NTDLL(00000000,00000000,?,01372CA6,?,00000000,?,00000000,?,01372CCD,?,00000007,?,?,013730CA,?), ref: 0136F8D0
Part of subcall function 0136F8BA: GetLastError.KERNEL32(?,?,01372CA6,?,00000000,?,00000000,?,01372CCD,?,00000007,?,?,013730CA,?,?), ref: 0136F8E2

_free.LIBCMT ref: 0136EF10
_free.LIBCMT ref: 0136EF23
_free.LIBCMT ref: 0136EF34
_free.LIBCMT ref: 0136EF45

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3a8290c2ca40695626bcd4cbf59537677641b91d243e584e15e515c15261b1e8
Instruction ID: d20dd229a98d582c41db8ae9fce7bcf577210138ec234bf3ba274a90db47da92
Opcode Fuzzy Hash: 3a8290c2ca40695626bcd4cbf59537677641b91d243e584e15e515c15261b1e8
Instruction Fuzzy Hash: 22F0D0B58007229BDB33AF28B8916493FFDF715719B064155FB159625CEB3505498BC0

Uniqueness

Uniqueness Score: -1.00%

Function 013573D1 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0135758F
_swprintf.LIBCMT ref: 0135763E

Strings

%ls, xrefs: 01357414, 0135742A
%s: %s, xrefs: 0135759E

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: a16c31bbe64680393c0da70e13b42a389b8bb2e350c1ff60fcb738cc6ec56978
Instruction ID: a4ebe7082966df75e35893171b356e1431de7432a9b09ee4aed30a109f98171d
Opcode Fuzzy Hash: a16c31bbe64680393c0da70e13b42a389b8bb2e350c1ff60fcb738cc6ec56978
Instruction Fuzzy Hash: 4851CB71288749FAFBA12A9DCC41F367E5EAB24F0CF808906FFC6748E0D5A191509767

Uniqueness

Uniqueness Score: -1.00%

Function 0136E542 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\eN0ONo7Zrw.exe,00000104), ref: 0136E582
_free.LIBCMT ref: 0136E64D
_free.LIBCMT ref: 0136E657

Strings

C:\Users\user\Desktop\eN0ONo7Zrw.exe, xrefs: 0136E579, 0136E580, 0136E5AF, 0136E5E7

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\eN0ONo7Zrw.exe
API String ID: 2506810119-3520326165
Opcode ID: a271332a0ce3e06bfdae48357025400110474ef25dfec24d5ea427c2fad62b12
Instruction ID: 5cfc0beaeff18730497ec11334fa0bc6db9debb3dcaca611662c3d9f5b223f89
Opcode Fuzzy Hash: a271332a0ce3e06bfdae48357025400110474ef25dfec24d5ea427c2fad62b12
Instruction Fuzzy Hash: 773156B5A04219EFDB21DF9D988499EBBFCEF95718F108076EA0497208E7709E44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 013695C6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 013695EB
_abort.LIBCMT ref: 013696F6

Strings

RCC, xrefs: 01369605
MOC, xrefs: 013695FD

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 1f63a5c936c1726fb708fd19e9309e2fa8ada6e40ad93759308a036e113ce51a
Instruction ID: a5c6d3c9498420d2d3e80eea17fb272d9585a6133a5dbc39c3a71e1d9a0943c4
Opcode Fuzzy Hash: 1f63a5c936c1726fb708fd19e9309e2fa8ada6e40ad93759308a036e113ce51a
Instruction Fuzzy Hash: 80414971900209AFDF16DF98CC80BAEBBB9FF48328F148059FA1967219D3359950DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01353E7C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 01353EE4
_strncpy.LIBCMT ref: 01353F2A

Part of subcall function 01357B9F: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,013548BA,?,00000000,00000000,?,?,?,013548BA,?,?,00000050), ref: 01357BBC

Strings

$%s, xrefs: 01353ED9
@%s, xrefs: 01353ECE

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 7dc395d583aef702d669d136ec668c5efb819ef808a2cf18b46355d310279f5a
Instruction ID: b8242a55d77812721d5388dd543b3e930b25cbe469573573309a37aad9c267c2
Opcode Fuzzy Hash: 7dc395d583aef702d669d136ec668c5efb819ef808a2cf18b46355d310279f5a
Instruction Fuzzy Hash: BF21F07290020CAAEF21DEA8CC05FEE3BECBB01B98F000526FE1496290E771D208CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01361DE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 013511C6: GetDlgItem.USER32(00000000,00003021), ref: 0135120A
Part of subcall function 013511C6: SetWindowTextW.USER32(00000000,01379584), ref: 01351220

EndDialog.USER32(?,00000001), ref: 01361E2E
GetDlgItemTextW.USER32(?,00000066,?,00000200), ref: 01361E46
SetDlgItemTextW.USER32(?,00000067,?), ref: 01361E74

Strings

GETPASSWORD1, xrefs: 01361DF9

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: db05b77bd810eaa4f43d3a42b8da3503cf16a586d57c164c3b5b2c7c570cd1eb
Instruction ID: ee29b33795ce13a1a031d2448a1984d7ec513dd034c4aaef59f9aee18697e763
Opcode Fuzzy Hash: db05b77bd810eaa4f43d3a42b8da3503cf16a586d57c164c3b5b2c7c570cd1eb
Instruction Fuzzy Hash: 6F110472940219BAEB219E789C8DFBB7B7CEB8970CF044020FB09B3188D274D901C660

Uniqueness

Uniqueness Score: -1.00%

Function 01364739 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 0136478D
REPLACEFILEDLG, xrefs: 01364778, 013647AC

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: a9c09df00017d476b76c141d7f163f540b840d142b656daf38fe27597eeddd8a
Instruction ID: ab03cd178d3a9bde799658355858d858b912c60824d02191bbd1fca5ff33f527
Opcode Fuzzy Hash: a9c09df00017d476b76c141d7f163f540b840d142b656daf38fe27597eeddd8a
Instruction Fuzzy Hash: 800188B1A04545BFE7215F69FC85A667FADE707759F04C026FA15D3228D3364850CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01358EA8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 01358EAD

Part of subcall function 013655CD: std::invalid_argument::invalid_argument.LIBCONCRT ref: 013655D9
Part of subcall function 013655CD: ___delayLoadHelper2@8.DELAYIMP ref: 013655FF

std::_Xinvalid_argument.LIBCPMT ref: 01358EB8

Strings

vector too long, xrefs: 01358EB3
string too long, xrefs: 01358EA8

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Helper2@8Load___delaystd::invalid_argument::invalid_argument
String ID: string too long$vector too long
API String ID: 2355824318-1617939282
Opcode ID: 174962dbf31513a8e08e9a3a39a917c25f0f12a9e3f39c32ceb08135938922a8
Instruction ID: 2cbb604460a3ce81ebb01bed5ffa57f16f6f787e4643459c0d30d402b7f4ba9c
Opcode Fuzzy Hash: 174962dbf31513a8e08e9a3a39a917c25f0f12a9e3f39c32ceb08135938922a8
Instruction Fuzzy Hash: 13F0A731200345ABC3306E4EEC45D4BB7FDEB95E6CB50065EEA4687601D7F0A90487B5

Uniqueness

Uniqueness Score: -1.00%

Function 0136FDC1 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0136FE4C
__alldvrm.LIBCMT ref: 0137004D
__alldvrm.LIBCMT ref: 0137006F

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: d44050169a961246a75403e81249a310e18b1805ed77af15c25c3f8bfb7b45ee
Instruction ID: b6d3a824a1e2152072fbb5b42f3c3c1cbf026756c3c3c8073e7e24b15c35ccec
Opcode Fuzzy Hash: d44050169a961246a75403e81249a310e18b1805ed77af15c25c3f8bfb7b45ee
Instruction Fuzzy Hash: 57A16E719043869FE736CF1CD8A07AEBFEDEF16328F1481ADE5959B281C2388945C790

Uniqueness

Uniqueness Score: -1.00%

Function 013528B2 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 01352958
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800), ref: 0135299C
SetFileTime.KERNEL32(?,?,?,00000000), ref: 01352A1D
CloseHandle.KERNEL32(?), ref: 01352A24

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 9b0c28996aaa9f717572d478a03f251215ba91e51a21f66c197de16118981ecb
Instruction ID: 83ce09bd325170e8703bb1c72ec428cd3512f195a3dd967bcedfa28ebc2958a9
Opcode Fuzzy Hash: 9b0c28996aaa9f717572d478a03f251215ba91e51a21f66c197de16118981ecb
Instruction Fuzzy Hash: EA41CD31248381EAE731DE28DC51FEBBBE8AF95B58F04091DFAD093280C664DA48D752

Uniqueness

Uniqueness Score: -1.00%

Function 01372D98 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,F4E85006,0136AD29,00000000,00000000,0136BD5E,?,0136BD5E,?,00000001,0136AD29,F4E85006,00000001,0136BD5E,0136BD5E), ref: 01372DE5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 01372E6E
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 01372E80
__freea.LIBCMT ref: 01372E89

Part of subcall function 0136F9E5: RtlAllocateHeap.NTDLL(00000000,?,?,?,0136A7E9,?,0000015D,?,?,?,?,0136BCC5,000000FF,00000000,?,?), ref: 0136FA17

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 4842577bf5735f80e5bcf538cd23585a641bd30c01d46ffb934f7c2bff64868a
Instruction ID: 0b3c189494a8ddf6a2d20e3b5ea1f330765706e97d8fa5cdd6967259a664943c
Opcode Fuzzy Hash: 4842577bf5735f80e5bcf538cd23585a641bd30c01d46ffb934f7c2bff64868a
Instruction Fuzzy Hash: 4031AE72A0020AAFDF358F69DC44EAF7BA9EB55318F044628FC08E7150E739C950CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01361173 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 01361176
GetDeviceCaps.GDI32(00000000,00000058), ref: 01361185
GetDeviceCaps.GDI32(00000000,0000005A), ref: 01361193
ReleaseDC.USER32(00000000,00000000), ref: 013611A1

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 00f8a3eaa609c1109c66b3cbaf906d5c40febc9f1d67d0e12d93e42de14209fb
Instruction ID: 6b29be303c5f2eb2993e7aa5f4649e7f9f48eb8c207a6ee09703293a613bf2e5
Opcode Fuzzy Hash: 00f8a3eaa609c1109c66b3cbaf906d5c40febc9f1d67d0e12d93e42de14209fb
Instruction Fuzzy Hash: CFE0EC31986F20ABD3302B64A84DB963EACBB19752F004142F70697188E76545048B90

Uniqueness

Uniqueness Score: -1.00%

Function 0136131C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 013611A9: GetDC.USER32(00000000), ref: 013611AD
Part of subcall function 013611A9: GetDeviceCaps.GDI32(00000000,0000000C), ref: 013611B8
Part of subcall function 013611A9: ReleaseDC.USER32(00000000,00000000), ref: 013611C3

GetObjectW.GDI32(?,00000018,?), ref: 0136134C

Part of subcall function 013615DE: GetDC.USER32(00000000), ref: 013615E7
Part of subcall function 013615DE: GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,?,?,01361339,?,?,?), ref: 01361616
Part of subcall function 013615DE: ReleaseDC.USER32(00000000,?), ref: 013616AE

Strings

(, xrefs: 013614BF

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 2f214eefe30ac37ab25c95ca4aef5dd9fea39d0d2c201ecd36fd0aba315fc1b1
Instruction ID: df3fa60a1ecc4e92b7e12a70c13f7c77098f2f9b24731132be0bdba0f8a3f29b
Opcode Fuzzy Hash: 2f214eefe30ac37ab25c95ca4aef5dd9fea39d0d2c201ecd36fd0aba315fc1b1
Instruction Fuzzy Hash: 2191C071608348AFC720DF25D844A2BBBFCFBC9718F10895DF59AD7264DA70A805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0135DDBA Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0135DDD6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0135DF32

Strings

CA+, xrefs: 0135DDC7, 0135DE04

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID: CA+
API String ID: 1992179935-3359862159
Opcode ID: 6cea6c3a33a1dcc0c3037a4528463b10396a12988b8c2d66b3ab5ebc6f857696
Instruction ID: 17f6e0270ba47a509236a09549e66e68101dd99242fd5dd6a823bfd07245c3b4
Opcode Fuzzy Hash: 6cea6c3a33a1dcc0c3037a4528463b10396a12988b8c2d66b3ab5ebc6f857696
Instruction Fuzzy Hash: 86818071600216DFD764DF28E884B2A77AAFB84718F150A39E815D7398F732E9048F51

Uniqueness

Uniqueness Score: -1.00%

Function 013715C8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 01371734

Part of subcall function 0136A446: IsProcessorFeaturePresent.KERNEL32(00000017,0136A418,00000003,?,00000000,0136F3B0,00000000,00000016,?,?,0136A425,00000000,00000000,00000000,00000000,00000000), ref: 0136A448
Part of subcall function 0136A446: GetCurrentProcess.KERNEL32(C0000417,?,00000003,0136F7E8), ref: 0136A46A
Part of subcall function 0136A446: TerminateProcess.KERNEL32(00000000,?,00000003,0136F7E8), ref: 0136A471

Strings

*?, xrefs: 0137160B
., xrefs: 013718EB

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: c19b6910c70e6d2bb048fb15ca3b27fb97d6692790e10f063fe099939b87b22a
Instruction ID: 807dcf685cb8728daf8732ca68bd6981e8c6c4446159a5ab89d6c11cb0e910e0
Opcode Fuzzy Hash: c19b6910c70e6d2bb048fb15ca3b27fb97d6692790e10f063fe099939b87b22a
Instruction Fuzzy Hash: 2C517276E0010A9FDF25DFACC8809ADFBF9EF58318F258169D955E7340E6399A018B50

Uniqueness

Uniqueness Score: -1.00%

Function 01361FFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 01362053
_wcslen.LIBCMT ref: 0136206E

Strings

}, xrefs: 01362046

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: 190a4b048bbe10d0729796efa1f246df9ad5123fe94a1e1b8ce6376dfef91f8d
Instruction ID: c091def4cc38b954fbbb3d6dc70a663a33ebcb8eb9dcece030eda8ecb5856dba
Opcode Fuzzy Hash: 190a4b048bbe10d0729796efa1f246df9ad5123fe94a1e1b8ce6376dfef91f8d
Instruction Fuzzy Hash: 9B21F62290431B5AD731EA68D844B6BB7DDDF4166CF42842AE540C7149E7A5D94CC3A2

Uniqueness

Uniqueness Score: -1.00%

Function 01355971 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 013558FC: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0135591B
Part of subcall function 013558FC: GetProcAddress.KERNEL32(0138E028,CryptUnprotectMemory), ref: 0135592B

GetCurrentProcessId.KERNEL32(?,?,?,0135596C), ref: 013559FF

Strings

CryptProtectMemory failed, xrefs: 013559B6
CryptUnprotectMemory failed, xrefs: 013559F7

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: a0d1e4b1f5d2cbbfe8db6016e9e780554173770b3b00372927a73c21ac4c06eb
Instruction ID: b5b5dd505d7452813301ba98182c7fe762f0c47dc78d6aecb470532a828bbc48
Opcode Fuzzy Hash: a0d1e4b1f5d2cbbfe8db6016e9e780554173770b3b00372927a73c21ac4c06eb
Instruction Fuzzy Hash: 1211E932601329ABEB679F29E841E6D3B79FF45F7CB048119EC015F245D624BD0187D1

Uniqueness

Uniqueness Score: -1.00%

Function 01353502 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 01353529

Part of subcall function 01352AA2: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01352AB5

Strings

%c:\, xrefs: 0135351F

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: 79387d3c803a186a279cf848487ac347d5847c31116009c19284cb46298f032c
Instruction ID: 784a356bab209937e61861b9d99552ab1695360099cf58a700a1b71d4ad3a497
Opcode Fuzzy Hash: 79387d3c803a186a279cf848487ac347d5847c31116009c19284cb46298f032c
Instruction Fuzzy Hash: F301D2A3504312E9EB706B6E9C45D6BBBACFEA5AF8750980EF944C6041FA20D44082A1

Uniqueness

Uniqueness Score: -1.00%

Function 013647FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 01364836
DialogBoxParamW.USER32(GETPASSWORD1,?,01361DE0,?), ref: 01364871

Strings

GETPASSWORD1, xrefs: 01364866

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1
API String ID: 3157717868-3292211884
Opcode ID: a017900a362de74251787673f90a15f642a587f95c8412a6950d4ead2b0cddae
Instruction ID: b483e167874519ed7e646b2516c771846ad3c05e4567d2f9cfd87cc5e26e3fe1
Opcode Fuzzy Hash: a017900a362de74251787673f90a15f642a587f95c8412a6950d4ead2b0cddae
Instruction Fuzzy Hash: BF114C31544295AFDB229E6CDC41FFA7FACAB0578DF048035FD45E3149C6A45984CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 013511C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 01354878: _swprintf.LIBCMT ref: 0135489E
Part of subcall function 01354878: SetDlgItemTextW.USER32(?,01384154,?), ref: 0135491F
Part of subcall function 01354878: GetWindowRect.USER32(?,?), ref: 01354959
Part of subcall function 01354878: GetClientRect.USER32(?,?), ref: 01354965

GetDlgItem.USER32(00000000,00003021), ref: 0135120A
SetWindowTextW.USER32(00000000,01379584), ref: 01351220

Strings

0, xrefs: 013511C9

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: ItemRectTextWindow$Client_swprintf
String ID: 0
API String ID: 758586884-4108050209
Opcode ID: 632e01476704d3ad38a58bdc2a790f6a707835f7f0de7b9d37c704465957fdcd
Instruction ID: fc5615035fc957221862303f9def5fa9fc61b71d5742344af6bb689b436274b5
Opcode Fuzzy Hash: 632e01476704d3ad38a58bdc2a790f6a707835f7f0de7b9d37c704465957fdcd
Instruction Fuzzy Hash: CEF04F7050028DABEF961E69881CFF93F98AF55B9EF04810CFE4896191EB79C194EB50

Uniqueness

Uniqueness Score: -1.00%

Function 01358ABB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 01358B01

Strings

z%s%d, xrefs: 01358AE0
z%s%02d, xrefs: 01358AF0, 01358AFA

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: _swprintf
String ID: z%s%02d$z%s%d
API String ID: 589789837-468824935
Opcode ID: c2107ca49adf10cc47779f0b7664c05c53bc14c1fd969bce8addcfb3bde77f22
Instruction ID: c768a0c27d56fb42dad8964a42ec7f31a868c46e8b9f68eea851a39244acff28
Opcode Fuzzy Hash: c2107ca49adf10cc47779f0b7664c05c53bc14c1fd969bce8addcfb3bde77f22
Instruction Fuzzy Hash: B1F0B4B9400109ABEF60AE498C40EEB776DEF98A6CF004155ED0267141D635D95987B0

Uniqueness

Uniqueness Score: -1.00%

Function 0135482E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,01353FE5,?), ref: 01354833
FindResourceW.KERNEL32(00000000,RTL,00000005,?,01353FE5,?), ref: 01354841

Strings

RTL, xrefs: 0135483B

Memory Dump Source

Source File: 00000000.00000002.236769390.0000000001351000.00000020.00000001.01000000.00000003.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.236763269.0000000001350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236778521.0000000001379000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001384000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.000000000138A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.0000000001395000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236784018.00000000013B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.236798754.00000000013BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_eN0ONo7Zrw.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 9ecd25de0827fb7a85ffd39b28d30f375f010c22a8d3163f861c3d2b8e9ab384
Instruction ID: e28501d894eeb9f90ab509230244b18db48089839f4075049fd2702bbb097a71
Opcode Fuzzy Hash: 9ecd25de0827fb7a85ffd39b28d30f375f010c22a8d3163f861c3d2b8e9ab384
Instruction Fuzzy Hash: 91C0123165035056EB3116357C0DB832E5C7B00B3DF05074CB6029A184D7E5C441C760

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 6228, Parent PID: 6164COMMON

Execution Graph

Execution Coverage:	27.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.5%
Total number of Nodes:	42
Total number of Limit Nodes:	8

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 047C1F54 Relevance: 6.5, APIs: 4, Instructions: 462
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 047C2299
VirtualProtect.KERNELBASE(?,?,?,?,?,00000000,048D3B70), ref: 047C24CA
VirtualProtect.KERNELBASE(?,?,?,?), ref: 047C2549
VirtualProtect.KERNELBASE(?,?,?,?), ref: 047C2585

Memory Dump Source

Source File: 00000002.00000002.236481392.00000000047C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 047C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47c1000_rundll32.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: 61a8cb1c603debe83f13b2e7bff6ec50a2c5a2c003de16ddd9aec75a98801850
Instruction ID: d0548851cc4ee88a967caeb3af36ee23a1dbc35d802f67e3360a997683653538
Opcode Fuzzy Hash: 61a8cb1c603debe83f13b2e7bff6ec50a2c5a2c003de16ddd9aec75a98801850
Instruction Fuzzy Hash: 7F124C72E005198FDB18CF65CC54AEEB7B6BFC8314F14C1AED509AB255DA346A86CF80

Uniqueness

Uniqueness Score: -1.00%

Function 048E55B0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 048E56DB

Strings

SlT&, xrefs: 048E56C0, 048E575C, 048E586B

Memory Dump Source

Source File: 00000002.00000002.236503615.00000000048E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 048E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48e1000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID: SlT&
API String ID: 1263568516-3052097721
Opcode ID: cdfc6f4b4a538e8d0ff24f9b60e6b4c327a115cb6fcd37598ab7700bf7ef14e8
Instruction ID: 370d896413a8e4b4a7b9b321e029e53e410010900216b101b5208ec92a62cd02
Opcode Fuzzy Hash: cdfc6f4b4a538e8d0ff24f9b60e6b4c327a115cb6fcd37598ab7700bf7ef14e8
Instruction Fuzzy Hash: 758181326097419FC314CE79C84066BB7E3BBC9314F168A6DE498DB354DB75E846CB82

Uniqueness

Uniqueness Score: -1.00%

Function 048E5D33 Relevance: 1.6, APIs: 1, Instructions: 135
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateThreadEx.NTDLL(?,?), ref: 048E5D72

Memory Dump Source

Source File: 00000002.00000002.236503615.00000000048E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 048E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48e1000_rundll32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 5983ad10b8f2cc418dc5679e298e71a293e2b4af7e9fba881a2b74f639afc0bb
Instruction ID: 85a60c0b80c9160a1d074ce099118fc1c04d1e972106d721ae7e6351d3ad7bf6
Opcode Fuzzy Hash: 5983ad10b8f2cc418dc5679e298e71a293e2b4af7e9fba881a2b74f639afc0bb
Instruction Fuzzy Hash: B9515B72A00119DFDF14CFA9C984AADBBB2FB88314F2586A5E418EB255DB30ED51CF40

Uniqueness

Uniqueness Score: -1.00%

Function 048E7F70 Relevance: 1.4, APIs: 1, Instructions: 198
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 048E80C1

Memory Dump Source

Source File: 00000002.00000002.236503615.00000000048E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 048E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_48e1000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 596cbc6a0c3e9698a861d62efa9f361159e7d232f320c70891fb823c99822c3f
Instruction ID: 329ff6c285531e96e93d7ed0fb204a508816a0e8806fc645ffabc1c67458e65b
Opcode Fuzzy Hash: 596cbc6a0c3e9698a861d62efa9f361159e7d232f320c70891fb823c99822c3f
Instruction Fuzzy Hash: C5719033A183518FC314DF69C98052AB7E2BBD8314F1A8E2DE599EB350D735E805CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B51021 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 160
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00B51078
VirtualProtect.KERNELBASE ref: 00B510F9

Strings

`, xrefs: 00B51361

Memory Dump Source

Source File: 00000002.00000002.236441421.0000000000B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b50000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: `
API String ID: 544645111-2679148245
Opcode ID: d6151342797c1f7537d3d2a8d669c32fa48df093d63a1df8de8eec2e4c204d47
Instruction ID: 9962fcd982be558670acb596917ea0419da44bd16ee3942964c9e6c7e4e936bd
Opcode Fuzzy Hash: d6151342797c1f7537d3d2a8d669c32fa48df093d63a1df8de8eec2e4c204d47
Instruction Fuzzy Hash: A0819DB4E052188FDB18CF99C990B9DBBF1FF48310F2585AAD909AB352D735A985CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00B51122 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00B51173

Strings

`, xrefs: 00B51361

Memory Dump Source

Source File: 00000002.00000002.236441421.0000000000B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b50000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: `
API String ID: 544645111-2679148245
Opcode ID: 5e1dbfebc0862d02240908e21059dd03b4f6f383f7f6a2a9cf7ca49ac71ccd01
Instruction ID: d1473af8785166c0990a35b893e29ee930ee52d350b1b52f661f22e720aaa44b
Opcode Fuzzy Hash: 5e1dbfebc0862d02240908e21059dd03b4f6f383f7f6a2a9cf7ca49ac71ccd01
Instruction Fuzzy Hash: 67419CB5E006288FDB54CF58C980B88BBB1FF48314F1581E9CA09AB356D771AD95CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00B51685 Relevance: 1.3, APIs: 1, Instructions: 85
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00B516FD

Memory Dump Source

Source File: 00000002.00000002.236441421.0000000000B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b50000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 29516217bdf7ffddd56053c7a8babcd07650cd4b0498675dde91ee9eb19ff9db
Instruction ID: 5bf018473fa9e9f394424d280300c9ba544549e795c7b174178cdd4b03ad1b62
Opcode Fuzzy Hash: 29516217bdf7ffddd56053c7a8babcd07650cd4b0498675dde91ee9eb19ff9db
Instruction Fuzzy Hash: 1F41E2B49012058FDB04DFA8C5947AEBBF0FF48308F2485ADD858AB351D37AA946CF95

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 6328, Parent PID: 6308COMMON

Execution Graph

Execution Coverage:	27.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	42
Total number of Limit Nodes:	8

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04741F54 Relevance: 6.5, APIs: 4, Instructions: 462
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 04742299
VirtualProtect.KERNELBASE(?,?,?,?,?,00000000,04853B70), ref: 047424CA
VirtualProtect.KERNELBASE(?,?,?,?), ref: 04742549
VirtualProtect.KERNELBASE(?,?,?,?), ref: 04742585

Memory Dump Source

Source File: 00000004.00000002.236230234.0000000004741000.00000020.00001000.00020000.00000000.sdmp, Offset: 04741000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4741000_rundll32.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: ac1fd12a31c672e6ad9eb8bae5ac66c2a3a9e5fcb3c2406db48bcc6802b14d5e
Instruction ID: e48278afe05eb67d831013828af5677b0319042f8a0f7c99ec4f0a8da1109237
Opcode Fuzzy Hash: ac1fd12a31c672e6ad9eb8bae5ac66c2a3a9e5fcb3c2406db48bcc6802b14d5e
Instruction Fuzzy Hash: 19126C72E005298FDB18CF65CC54AEEB7B6BFC8314F14C1AAD509AB255DB346A86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 048655B0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 048656DB

Strings

SlT&, xrefs: 048656C0, 0486575C, 0486586B

Memory Dump Source

Source File: 00000004.00000002.236251090.0000000004861000.00000020.00001000.00020000.00000000.sdmp, Offset: 04861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4861000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID: SlT&
API String ID: 1263568516-3052097721
Opcode ID: 8dfdc43ea2a0bd4bf9eb434597a83c857d446b3fbff145128693845f59591f9a
Instruction ID: 4c9d99f64dc34786a2e302331de1674e8c882f230e3261963fa54d8ddd4cb76c
Opcode Fuzzy Hash: 8dfdc43ea2a0bd4bf9eb434597a83c857d446b3fbff145128693845f59591f9a
Instruction Fuzzy Hash: 55819F326087419FC314CE39D84065BB7E3BBC8314F268A6DE499DB354DA75E846CB82

Uniqueness

Uniqueness Score: -1.00%

Function 04865D33 Relevance: 1.6, APIs: 1, Instructions: 135
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateThreadEx.NTDLL(?,?), ref: 04865D72

Memory Dump Source

Source File: 00000004.00000002.236251090.0000000004861000.00000020.00001000.00020000.00000000.sdmp, Offset: 04861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4861000_rundll32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0e7745319151d52b531f4a13a023137e32cd0dcd8d22d8cf90cf35590f0aefcc
Instruction ID: f07ca994a9bc1be86c2e4a45cd33504f6c8979d014b148199e7d47b778459d1b
Opcode Fuzzy Hash: 0e7745319151d52b531f4a13a023137e32cd0dcd8d22d8cf90cf35590f0aefcc
Instruction Fuzzy Hash: BF516D32A001189FDF55CFA8D984A9DBBB2FB88310F258665D419EB255DB30ED51CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04867F70 Relevance: 1.4, APIs: 1, Instructions: 198
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 048680C1

Memory Dump Source

Source File: 00000004.00000002.236251090.0000000004861000.00000020.00001000.00020000.00000000.sdmp, Offset: 04861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4861000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 05399aca026281436e2da0dd446eccb118b5e85de4d251c5a5b109d12b6efcb9
Instruction ID: 89a24ef55a89f123733689a4c2c71929dbf66f9e7c7ae0aaeac27519e9b5ede4
Opcode Fuzzy Hash: 05399aca026281436e2da0dd446eccb118b5e85de4d251c5a5b109d12b6efcb9
Instruction Fuzzy Hash: 48719D73A183518FC354CE69C88061AB7E2BBD8314F1A8E2DE599EB350D735E905CB82

Uniqueness

Uniqueness Score: -1.00%

Function 006B1021 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 160
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 006B1078
VirtualProtect.KERNELBASE ref: 006B10F9

Strings

`, xrefs: 006B1361

Memory Dump Source

Source File: 00000004.00000002.236187385.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: `
API String ID: 544645111-2679148245
Opcode ID: d6151342797c1f7537d3d2a8d669c32fa48df093d63a1df8de8eec2e4c204d47
Instruction ID: d2bf24ebf880e5439c688fd6c6a40725bb421e7cb41060d927118aea3fd7aeee
Opcode Fuzzy Hash: d6151342797c1f7537d3d2a8d669c32fa48df093d63a1df8de8eec2e4c204d47
Instruction Fuzzy Hash: 0F819FB4E042188FDB14CF99C990A9DBBF1FF48310F2581AED909AB351D734A985CF84

Uniqueness

Uniqueness Score: -1.00%

Function 006B1122 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 006B1173

Strings

`, xrefs: 006B1361

Memory Dump Source

Source File: 00000004.00000002.236187385.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: `
API String ID: 544645111-2679148245
Opcode ID: 5e1dbfebc0862d02240908e21059dd03b4f6f383f7f6a2a9cf7ca49ac71ccd01
Instruction ID: b9c4204ad4696b4b1a9191bfe28978aea58b27320b1c32c6a626bc8e5249a01f
Opcode Fuzzy Hash: 5e1dbfebc0862d02240908e21059dd03b4f6f383f7f6a2a9cf7ca49ac71ccd01
Instruction Fuzzy Hash: 14419DB5E00228CFDB54CF58C990B88BBB2FF49314F5581A9CA08AB356D771AD91CF91

Uniqueness

Uniqueness Score: -1.00%

Function 006B1685 Relevance: 1.3, APIs: 1, Instructions: 85
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 006B16FD

Memory Dump Source

Source File: 00000004.00000002.236187385.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 29516217bdf7ffddd56053c7a8babcd07650cd4b0498675dde91ee9eb19ff9db
Instruction ID: bc1a3cd3a70af82cf15500ee7a14d2af766fefadaea3007668342a0b6c1258b2
Opcode Fuzzy Hash: 29516217bdf7ffddd56053c7a8babcd07650cd4b0498675dde91ee9eb19ff9db
Instruction Fuzzy Hash: E14132B09012058FDB04CFA8C5947AEBBF0FF48308F24856DD858AB341D37AA986CF95

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report eN0ONo7Zrw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Created / dropped Files

C:\Users\user\AppData\Local\Temp\0C6L3.cpl

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: eN0ONo7Zrw.exePID: 7124, Parent PID: 3512

General

Chronological Activities

Analysis Process: control.exePID: 6164, Parent PID: 7124

General

Chronological Activities

Analysis Process: rundll32.exePID: 6228, Parent PID: 6164

General

Chronological Activities

Analysis Process: rundll32.exePID: 6308, Parent PID: 6228

General

Windows Analysis Report
eN0ONo7Zrw.exe

Function 01364968 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 202
filesleeptimeCOMMON

Function 013611D2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Function 01352C15 Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Function 01356BE4 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Function 013631F1 Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428
windowCOMMON

Function 01363F86 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Function 0136424F Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 184
windowCOMMON

Function 0135D2E8 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 307
COMMON

Function 01370D74 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Function 0135723D Relevance: 9.1, APIs: 6, Instructions: 98
timeCOMMON

Function 013646D3 Relevance: 9.0, APIs: 6, Instructions: 42
windowsynchronizationCOMMON

Function 013616C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
COMMON

Function 01351EE0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Function 013620D8 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Function 0136181B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
comCOMMON