f7bab685eb74130f2e49156071fe2522134b3650d372ead79743f810d6e9051e

Analysis

max time kernel
239s
max time network
240s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:37

Target

HearthCrawler_R30_10/Qt5Widgets.dll
Size

4.2MB
MD5

acdd568d351355885658db5092348a83
SHA1

b64e1dbeed3f202066633faab9ed9273885c0bb4
SHA256

e878c209af09b4eb8f2300315c2d119cd7fd4a5fdff80d88dc73582386284867
SHA512

7541ac8e23c5fcef8e9c6c840bb8e268097b99a6c1d2f7d4fc3084b88d794d34bc282bd3630ee1489f9d5d5cdaea15d678619f201662c733dd857ff61ed7af0a
SSDEEP

49152:hOs8bunjQUDYGxPXlHFbCEi3K/zOsEdn0syhFZbfbkMRLxHX8:hOsnjQUsGxXlFCEvKjcPkMRLxHX8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4188 3084 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4188	3084	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1688 wrote to memory of 3084	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 3084	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 3084	1688	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Qt5Widgets.dll,#1
2⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 652
3⤵
- Program crash
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3084 -ip 3084
1⤵
PID:4396