f7bab685eb74130f2e49156071fe2522134b3650d372ead79743f810d6e9051e | Triage

Analysis

max time kernel
256s
max time network
461s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:37

Sharing

Report Analysis Logs

General

Target

HearthCrawler_R30_10/Tools/HRCompiler.exe
Size

40KB
MD5

6cd5c8f999ee4b48137b5dbea91b28bb
SHA1

be5ea55ce0b7cced75b539183db6111d07a439ba
SHA256

7d80c548c63016c69a4eb19e9e05cbbf63e2e18444b7a15f3545253acd0626af
SHA512

36b0ab7c61df7f43db38333d8a268fcedc33971f43b5623943d559c4cbfe311034f4f4c86d50d88d3ec87165e2792fae9f5660ffd03e4963d712c583cbc553cd
SSDEEP

768:3qt90x//Jyb+mbgvliuPonu1EJJevWnQ:CkxytICu1EaW

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2836 4460 WerFault.exe HRCompiler.exe

C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Tools\HRCompiler.exe
"C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Tools\HRCompiler.exe"
1⤵
PID:4460

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4460 -s 728
2⤵
- Program crash
PID:2836

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 180 -p 4460 -ip 4460
1⤵
PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4460-132-0x0000000000AD0000-0x0000000000AE0000-memory.dmp

Filesize
64KB

Download
memory/4460-133-0x00007FFBD4DF0000-0x00007FFBD58B1000-memory.dmp

Filesize
10.8MB

Download
memory/4460-134-0x00007FFBD4DF0000-0x00007FFBD58B1000-memory.dmp

Filesize
10.8MB

Download