afbea9050cf76d3a393f4efe786212944c9629e2b11d7dd7939d152397501bb0

Analysis

max time kernel
144s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-03-2023 20:06

Target

EES Aprende.Química.e.Ingeniería.con.Toño/Userlib/Heat Transfer/Radiation View Factors/F3d7123.dll
Size

92KB
MD5

87e1ef6a157adbab7b1801a21cccce19
SHA1

9675fc100367a7a626740dc100c27708a575743f
SHA256

fc7bb111f010e8db7208147770c7b8e2293de43d2670e123189b8233875bed0e
SHA512

73d0874b5520ea35fcc4fc2318ddb41b39d5d03531deb2bd6e0b7da874648f3ff12dc8cc318fb4e86a2f82e58ff0a227fbba7414b2b9a9c3783a078694a3d931
SSDEEP

1536:cy5vKXZh1m0Nm4nuFZyaB7cVx9hvhiVGv:cysJhs4wZyaB7yew

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1744 860 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1744	860	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1348 wrote to memory of 860	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 860	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 860	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 860	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 860	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 860	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 860	1348	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 1744	860	rundll32.exe	WerFault.exe
PID 860 wrote to memory of 1744	860	rundll32.exe	WerFault.exe
PID 860 wrote to memory of 1744	860	rundll32.exe	WerFault.exe
PID 860 wrote to memory of 1744	860	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\EES Aprende.Química.e.Ingeniería.con.Toño\Userlib\Heat Transfer\Radiation View Factors\F3d7123.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\EES Aprende.Química.e.Ingeniería.con.Toño\Userlib\Heat Transfer\Radiation View Factors\F3d7123.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 232
3⤵
- Program crash
PID:1744

memory/860-54-0x00000000663C0000-0x00000000663DC000-memory.dmp

Filesize
112KB

Download