f7bab685eb74130f2e49156071fe2522134b3650d372ead79743f810d6e9051e | Triage

Analysis

max time kernel
103s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:37

Sharing

Report Analysis Logs

General

Target

HearthCrawler_R30_10/Tools/HRCompiler.exe
Size

40KB
MD5

6cd5c8f999ee4b48137b5dbea91b28bb
SHA1

be5ea55ce0b7cced75b539183db6111d07a439ba
SHA256

7d80c548c63016c69a4eb19e9e05cbbf63e2e18444b7a15f3545253acd0626af
SHA512

36b0ab7c61df7f43db38333d8a268fcedc33971f43b5623943d559c4cbfe311034f4f4c86d50d88d3ec87165e2792fae9f5660ffd03e4963d712c583cbc553cd
SSDEEP

768:3qt90x//Jyb+mbgvliuPonu1EJJevWnQ:CkxytICu1EaW

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

548 1444 WerFault.exe HRCompiler.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

HRCompiler.exe

description	pid	process	target process
PID 1444 wrote to memory of 548	1444	HRCompiler.exe	WerFault.exe
PID 1444 wrote to memory of 548	1444	HRCompiler.exe	WerFault.exe
PID 1444 wrote to memory of 548	1444	HRCompiler.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Tools\HRCompiler.exe
"C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Tools\HRCompiler.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1444 -s 512
2⤵
- Program crash
PID:548

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-55-0x0000000000000000-mapping.dmp

Download
memory/1444-54-0x0000000000FF0000-0x0000000001000000-memory.dmp

Filesize
64KB

Download