f7bab685eb74130f2e49156071fe2522134b3650d372ead79743f810d6e9051e | Triage

Analysis

max time kernel
166s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:37

Sharing

Report Analysis Logs

General

Target

HearthCrawler_R30_10/icudt52.dll
Size

22.4MB
MD5

4038720985c5608a375877150a670a63
SHA1

8f78ce868717704aa135f0445b02fd76e734f54c
SHA256

cafe825422ed687480d99002254f106bfc34e1f8ac161d7bf686e1c26e8175c3
SHA512

4c04c13dbdcc3c5c1e4edd4b78cfcde821a5bcfc2b36309b9733e403ad64d7691ea34788b8a80631200a336c8094bc2f382d637ea4b3030b569454e2a5e468fb
SSDEEP

393216:3+r2hCR4vmUqjGcmUJlhvKu2apO9S9/22IY4YTsPU0CFy7hv:jY4vm0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1184 268 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 268 wrote to memory of 1184	268	rundll32.exe	WerFault.exe
PID 268 wrote to memory of 1184	268	rundll32.exe	WerFault.exe
PID 268 wrote to memory of 1184	268	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\icudt52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 268 -s 84
2⤵
- Program crash
PID:1184

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-54-0x0000000000000000-mapping.dmp

Download