afbea9050cf76d3a393f4efe786212944c9629e2b11d7dd7939d152397501bb0

Analysis

max time kernel
143s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-03-2023 20:06

Target

EES Aprende.Química.e.Ingeniería.con.Toño/Userlib/Heat Transfer/Radiation View Factors/MonteCarlo.dll
Size

132KB
MD5

3fc96b6d9fae2ec680a0813136901114
SHA1

7f49421c0914f913096ce930450b3fc23ea5f080
SHA256

0a90e6a3569c658d7c8d4db9408b0cb7efe9ea6dd4df129dd5906d2d1c0b692e
SHA512

bf72003bde2a269ef6218dca3a809794fca0c1ced2ff7eff4b157056de8cdfef7b46fbb68d90712fc7cc86845600d25b2aff8fcb120eec0f2e6866209fb53e02
SSDEEP

3072:jNB1YRcjjEHLChxks3XSmpeWevze+ssuc:jNBytrF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

836 1376 WerFault.exe rundll32.exe

pid	pid_target	process	target process
836	1376	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1524 wrote to memory of 1376	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1376	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1376	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1376	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1376	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1376	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1376	1524	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 836	1376	rundll32.exe	WerFault.exe
PID 1376 wrote to memory of 836	1376	rundll32.exe	WerFault.exe
PID 1376 wrote to memory of 836	1376	rundll32.exe	WerFault.exe
PID 1376 wrote to memory of 836	1376	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\EES Aprende.Química.e.Ingeniería.con.Toño\Userlib\Heat Transfer\Radiation View Factors\MonteCarlo.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\EES Aprende.Química.e.Ingeniería.con.Toño\Userlib\Heat Transfer\Radiation View Factors\MonteCarlo.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 244
3⤵
- Program crash
PID:836

memory/1376-54-0x0000000000170000-0x000000000019C000-memory.dmp

Filesize
176KB

Download
memory/1376-55-0x0000000000170000-0x000000000019C000-memory.dmp

Filesize
176KB

Download