3aadd92795daa18b5eecb1c387a1c9bab60cfc427fbce23e61d947b116d0ada4 | Triage

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-05-2022 18:45

Sharing

Report Analysis Logs

General

Target

FL Studio/FL Studio 3.2.0.exe
Size

391.3MB
MD5

b0c5ae4dec5a28e5c27ee33e2e1ab240
SHA1

d84c677bbcc05a6d28001566196f43374dfec74e
SHA256

792ea90eb358df40c67fb494300cd97397375f7ec46ef6311cfff06f7fa58de0
SHA512

dbe14ada46abd5b86fcc54e828876410b1223682a832b091e3cca31d40269f06554c3e5ad7ce043ab231856f0ae0ff7d539d1f88cf0140062c186335e95f7e05

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1036 624 WerFault.exe FL Studio 3.2.0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

FL Studio 3.2.0.exe

description	pid	process	target process
PID 624 wrote to memory of 1036	624	FL Studio 3.2.0.exe	WerFault.exe
PID 624 wrote to memory of 1036	624	FL Studio 3.2.0.exe	WerFault.exe
PID 624 wrote to memory of 1036	624	FL Studio 3.2.0.exe	WerFault.exe
PID 624 wrote to memory of 1036	624	FL Studio 3.2.0.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\FL Studio\FL Studio 3.2.0.exe
"C:\Users\Admin\AppData\Local\Temp\FL Studio\FL Studio 3.2.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 548
2⤵
- Program crash
PID:1036

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-54-0x0000000000D80000-0x0000000000E26000-memory.dmp

Filesize
664KB

Download
memory/1036-55-0x0000000000000000-mapping.dmp

Download