f7bab685eb74130f2e49156071fe2522134b3650d372ead79743f810d6e9051e | Triage

Analysis

max time kernel
245s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:37

Sharing

Report Analysis Logs

General

Target

HearthCrawler_R30_10/icuuc52.dll
Size

1.3MB
MD5

ebd4a4818f6ce7c3fffa299264ae44c7
SHA1

d4463103ae665dd8835b6f45f6665f054ba6f596
SHA256

7bc32fef1b52eed6d47c2b43e70c748c657757218db5d90c15e0f3be0afa0d8f
SHA512

5d45893038ec9a269afd51d5e4f3c6671f01ceae59e29f808cdb759dc0b755389052a05557aa7e764db2f492482a851a23fc119472b277cfdaa674708f92955a
SSDEEP

24576:WTWJAWxJI8p9NPxgZulFv4PPy65MZ10nEAfmfz:WTWJXxJI8pnqZufvmq1SEZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3792 wrote to memory of 3452	3792	rundll32.exe	rundll32.exe
PID 3792 wrote to memory of 3452	3792	rundll32.exe	rundll32.exe
PID 3792 wrote to memory of 3452	3792	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\icuuc52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3792

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\icuuc52.dll,#1
2⤵
PID:3452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3452-132-0x0000000000000000-mapping.dmp

Download