f7bab685eb74130f2e49156071fe2522134b3650d372ead79743f810d6e9051e

Analysis

max time kernel
151s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:37

Target

HearthCrawler_R30_10/HearthLoader.exe
Size

786KB
MD5

d21d67fb5aa4e035447fb215b6da6872
SHA1

1445ea78eb0cd609ae8616091595b6ed8114e82d
SHA256

7d8a7c512f7b2c4d4d9d16dfd5c5c2187c03bfcc3eaa07c0bad88e675af56865
SHA512

098b81f5eaa94aa1a9166f3c75c7926a5def6c7e426b675e8459d92651e4d890ab76d4bd8f7d05b42c22f02ab9f0acce19bb10dd3c79df431c6e8e13913755a4
SSDEEP

24576:lxU15RuD+6MFFxoKj7uUY/FMpM73BYY8Q3awotl:l4RuS6MFAe7G9MpY3l1Kwol

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3388 5064 WerFault.exe HearthLoader.exe

pid	pid_target	process	target process
3388	5064	WerFault.exe	HearthLoader.exe

C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\HearthLoader.exe
"C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\HearthLoader.exe"
1⤵
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 364
2⤵
- Program crash
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5064 -ip 5064
1⤵
PID:1620

memory/5064-132-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/5064-133-0x0000000077B90000-0x0000000077D33000-memory.dmp

Filesize
1.6MB

Download
memory/5064-134-0x00000000770B0000-0x00000000772C5000-memory.dmp

Filesize
2.1MB

Download
memory/5064-136-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download