cffccaaa05525442fa0d66526c735fe057701dede992bed9f52d77181470fe29

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2023 00:34

Target

cffccaaa05525442fa0d66526c735fe057701dede992bed9f52d77181470fe29.dll
Size

463KB
MD5

4c6c883312cb19abf300a063a02bf837
SHA1

76a6a4c79c1726847d71b34e3efd95475c5141c8
SHA256

cffccaaa05525442fa0d66526c735fe057701dede992bed9f52d77181470fe29
SHA512

746e582a31b22106c7a98ce28e51134b2bcfec6e38eceaaba073c888f8076c2e0234ff5d3510fb15922476ba3bf17e2edd4bfc5c4b81f15a54cf32c5a7b4300b
SSDEEP

6144:MC3rWhUvQ7soYSp15G/inbk3tRsQRv/ByHtM1M18ajEHYZnLvOpUqMHIDxL5Z:MsW8oYi5GUboEQl5itAMmmEOna+ho19

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4688 2444 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2444 rundll32.exe

pid	pid_target	process	target process
4688	2444	WerFault.exe	rundll32.exe

pid	process
2444	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2764 wrote to memory of 2444	2764	rundll32.exe	rundll32.exe
PID 2764 wrote to memory of 2444	2764	rundll32.exe	rundll32.exe
PID 2764 wrote to memory of 2444	2764	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cffccaaa05525442fa0d66526c735fe057701dede992bed9f52d77181470fe29.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cffccaaa05525442fa0d66526c735fe057701dede992bed9f52d77181470fe29.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 696
3⤵
- Program crash
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2444 -ip 2444
1⤵
PID:724

memory/2444-134-0x0000000010000000-0x0000000010123000-memory.dmp

Filesize
1.1MB

Download
memory/2444-135-0x0000000010000000-0x0000000010123000-memory.dmp

Filesize
1.1MB

Download
memory/2444-133-0x0000000010000000-0x0000000010123000-memory.dmp

Filesize
1.1MB

Download
memory/2444-136-0x0000000010000000-0x0000000010123000-memory.dmp

Filesize
1.1MB

Download