f7bab685eb74130f2e49156071fe2522134b3650d372ead79743f810d6e9051e

Analysis

max time kernel
39s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:37

Target

HearthCrawler_R30_10/Qt5Core.dll
Size

3.9MB
MD5

9eac99a6ff2ed53cd3a261823d95fb12
SHA1

3ce90557f8db25fb86d412650cd45039fcec4866
SHA256

c55a637d74fbd231820a58d3243a29b6b3f2a2c3b8758c6c102122afceb577a1
SHA512

2cca97860db8dbb72da882ac9a1a1e388e9b5873908156385307267a62aa40f7a3629ae7d93781910d12aaa0d43e9aed36adfcc486e37b9625f12b0555798d25
SSDEEP

49152:RBj6tUP6+McZN5YR3Y9cFpkVJsv6tWKFdu9CwTmRYPUFwR0FqWvbUbnsGw52whW8:R1M6DJsv6tWKFdu9Clgs

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1296 1332 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1296	1332	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1332	1272	rundll32.exe	rundll32.exe
PID 1332 wrote to memory of 1296	1332	rundll32.exe	WerFault.exe
PID 1332 wrote to memory of 1296	1332	rundll32.exe	WerFault.exe
PID 1332 wrote to memory of 1296	1332	rundll32.exe	WerFault.exe
PID 1332 wrote to memory of 1296	1332	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Qt5Core.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 228
3⤵
- Program crash
PID:1296

memory/1296-56-0x0000000000000000-mapping.dmp

Download
memory/1332-54-0x0000000000000000-mapping.dmp

Download
memory/1332-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download