f7bab685eb74130f2e49156071fe2522134b3650d372ead79743f810d6e9051e

Analysis

max time kernel
141s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:37

Target

HearthCrawler_R30_10/Qt5Gui.dll
Size

4.2MB
MD5

b6726eca5177899f6e3ef7eb5105f481
SHA1

54957d69fb8002e7953e0cbf53bc361b719ab557
SHA256

3f5a4f78dcd0963f8612037d8f495ac2042f986704f00a848a781e3a6e179ccd
SHA512

82fb025c16eee18e35f2dfba1554d209c2d567cb2ceca8d2d3553e970c7759cbe259a059ed3768d3efeb657642c73b47a349c15878e4bc74827d782e3177d3fc
SSDEEP

49152:GOP1tO6C0wVJzaNb7GtPGWvS61hW6saMhbPCdt/7CXm8inSj:hsOQJzkb7GpnThW2CWw

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

240 1376 WerFault.exe rundll32.exe

pid	pid_target	process	target process
240	1376	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1092 wrote to memory of 1376	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1376	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1376	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1376	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1376	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1376	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1376	1092	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 240	1376	rundll32.exe	WerFault.exe
PID 1376 wrote to memory of 240	1376	rundll32.exe	WerFault.exe
PID 1376 wrote to memory of 240	1376	rundll32.exe	WerFault.exe
PID 1376 wrote to memory of 240	1376	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Qt5Gui.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 256
3⤵
- Program crash
PID:240

memory/240-56-0x0000000000000000-mapping.dmp

Download
memory/1376-54-0x0000000000000000-mapping.dmp

Download
memory/1376-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download