f7bab685eb74130f2e49156071fe2522134b3650d372ead79743f810d6e9051e

Analysis

max time kernel
258s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:37

Target

HearthCrawler_R30_10/Qt5Widgets.dll
Size

4.2MB
MD5

acdd568d351355885658db5092348a83
SHA1

b64e1dbeed3f202066633faab9ed9273885c0bb4
SHA256

e878c209af09b4eb8f2300315c2d119cd7fd4a5fdff80d88dc73582386284867
SHA512

7541ac8e23c5fcef8e9c6c840bb8e268097b99a6c1d2f7d4fc3084b88d794d34bc282bd3630ee1489f9d5d5cdaea15d678619f201662c733dd857ff61ed7af0a
SSDEEP

49152:hOs8bunjQUDYGxPXlHFbCEi3K/zOsEdn0syhFZbfbkMRLxHX8:hOsnjQUsGxXlFCEvKjcPkMRLxHX8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1876 1060 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1876	1060	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1880 wrote to memory of 1060	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1060	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1060	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1060	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1060	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1060	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1060	1880	rundll32.exe	rundll32.exe
PID 1060 wrote to memory of 1876	1060	rundll32.exe	WerFault.exe
PID 1060 wrote to memory of 1876	1060	rundll32.exe	WerFault.exe
PID 1060 wrote to memory of 1876	1060	rundll32.exe	WerFault.exe
PID 1060 wrote to memory of 1876	1060	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Qt5Widgets.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 252
3⤵
- Program crash
PID:1876

memory/1060-54-0x0000000000000000-mapping.dmp

Download
memory/1060-55-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download
memory/1876-56-0x0000000000000000-mapping.dmp

Download