350a594c4295d9108753f28159e65d192256b74968b087b90cb2ec091cfa2ad2

Analysis

Target

350a594c4295d9108753f28159e65d192256b74968b087b90cb2ec091cfa2ad2.exe
Size

288KB
MD5

49c14162f3ee193af91eadadcca62016
SHA1

c45b24e9807486083c6a9f38a0ef9cfe4b75663b
SHA256

350a594c4295d9108753f28159e65d192256b74968b087b90cb2ec091cfa2ad2
SHA512

92ed684d0f88a131e8a9daa0f410a32b87f1748947fa8b7a3eda1cb953d2bb60c0e9c96933e9fa663916258cddc57a294dc0c436a9270318fe4fd6ac3de5ac5d

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1552 1880 WerFault.exe 350a594c4295d9108753f28159e65d192256b74968b087b90cb2ec091cfa2ad2.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

350a594c4295d9108753f28159e65d192256b74968b087b90cb2ec091cfa2ad2.exe

pid process

1880 350a594c4295d9108753f28159e65d192256b74968b087b90cb2ec091cfa2ad2.exe

pid	pid_target	process	target process
1552	1880	WerFault.exe	350a594c4295d9108753f28159e65d192256b74968b087b90cb2ec091cfa2ad2.exe

pid	process
1880	350a594c4295d9108753f28159e65d192256b74968b087b90cb2ec091cfa2ad2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

350a594c4295d9108753f28159e65d192256b74968b087b90cb2ec091cfa2ad2.exe

description	pid	process	target process
PID 1880 wrote to memory of 1552	1880	350a594c4295d9108753f28159e65d192256b74968b087b90cb2ec091cfa2ad2.exe	WerFault.exe
PID 1880 wrote to memory of 1552	1880	350a594c4295d9108753f28159e65d192256b74968b087b90cb2ec091cfa2ad2.exe	WerFault.exe
PID 1880 wrote to memory of 1552	1880	350a594c4295d9108753f28159e65d192256b74968b087b90cb2ec091cfa2ad2.exe	WerFault.exe
PID 1880 wrote to memory of 1552	1880	350a594c4295d9108753f28159e65d192256b74968b087b90cb2ec091cfa2ad2.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 360
2⤵
- Program crash
PID:1552

memory/1552-60-0x0000000000000000-mapping.dmp

Download
memory/1880-56-0x0000000003451000-0x0000000003456000-memory.dmp

Filesize
20KB

Download
memory/1880-57-0x00000000758D1000-0x00000000758D3000-memory.dmp

Filesize
8KB

Download
memory/1880-58-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download
memory/1880-59-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download
memory/1880-61-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download