f7bab685eb74130f2e49156071fe2522134b3650d372ead79743f810d6e9051e

Analysis

max time kernel
193s
max time network
223s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:37

Target

HearthCrawler_R30_10/imageformats/qgif.dll
Size

23KB
MD5

2505afb0fb920e3b9a1de648a19bace7
SHA1

33425dc967827d6a13efc4be31b6bbbbc39c9201
SHA256

6e0bca00583b26f8680c02a038a1b870f8cdc19b97b257ea60998557a1fb5498
SHA512

46878132aa1acd6c80fa5ee03ea95cb575209637e03c6534bb263503d8d4a01818c8ede43257fa5593863036389fe4aea42afe892670fcbb6bf9d2403c14b727
SSDEEP

384:TtfUIjcsPkeCvo9eLc+HEeh6b4vnt+BKRbyS+ngh4ZIkmaVzHOAdg5l:2Ijcs7OLc6ob4vt/Rbb+nuqZHVDvdcl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4848 wrote to memory of 4788	4848	rundll32.exe	rundll32.exe
PID 4848 wrote to memory of 4788	4848	rundll32.exe	rundll32.exe
PID 4848 wrote to memory of 4788	4848	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\imageformats\qgif.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\imageformats\qgif.dll,#1
2⤵
PID:4788