cffccaaa05525442fa0d66526c735fe057701dede992bed9f52d77181470fe29

Analysis

max time kernel
140s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-05-2023 00:34

Target

cffccaaa05525442fa0d66526c735fe057701dede992bed9f52d77181470fe29.dll
Size

463KB
MD5

4c6c883312cb19abf300a063a02bf837
SHA1

76a6a4c79c1726847d71b34e3efd95475c5141c8
SHA256

cffccaaa05525442fa0d66526c735fe057701dede992bed9f52d77181470fe29
SHA512

746e582a31b22106c7a98ce28e51134b2bcfec6e38eceaaba073c888f8076c2e0234ff5d3510fb15922476ba3bf17e2edd4bfc5c4b81f15a54cf32c5a7b4300b
SSDEEP

6144:MC3rWhUvQ7soYSp15G/inbk3tRsQRv/ByHtM1M18ajEHYZnLvOpUqMHIDxL5Z:MsW8oYi5GUboEQl5itAMmmEOna+ho19

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

800 1596 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1596 rundll32.exe

pid	pid_target	process	target process
800	1596	WerFault.exe	rundll32.exe

pid	process
1596	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1680 wrote to memory of 1596	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1596	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1596	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1596	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1596	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1596	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1596	1680	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 800	1596	rundll32.exe	WerFault.exe
PID 1596 wrote to memory of 800	1596	rundll32.exe	WerFault.exe
PID 1596 wrote to memory of 800	1596	rundll32.exe	WerFault.exe
PID 1596 wrote to memory of 800	1596	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cffccaaa05525442fa0d66526c735fe057701dede992bed9f52d77181470fe29.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 272
3⤵
- Program crash
PID:800

memory/1596-55-0x0000000010000000-0x0000000010123000-memory.dmp

Filesize
1.1MB

Download
memory/1596-56-0x0000000010000000-0x0000000010123000-memory.dmp

Filesize
1.1MB

Download
memory/1596-54-0x0000000010000000-0x0000000010123000-memory.dmp

Filesize
1.1MB

Download
memory/1596-57-0x0000000010000000-0x0000000010123000-memory.dmp

Filesize
1.1MB

Download