afbea9050cf76d3a393f4efe786212944c9629e2b11d7dd7939d152397501bb0

Analysis

max time kernel
70s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2023 20:06

Target

EES Aprende.Química.e.Ingeniería.con.Toño/Userlib/Heat Transfer/Radiation View Factors/MonteCarlo.dll
Size

132KB
MD5

3fc96b6d9fae2ec680a0813136901114
SHA1

7f49421c0914f913096ce930450b3fc23ea5f080
SHA256

0a90e6a3569c658d7c8d4db9408b0cb7efe9ea6dd4df129dd5906d2d1c0b692e
SHA512

bf72003bde2a269ef6218dca3a809794fca0c1ced2ff7eff4b157056de8cdfef7b46fbb68d90712fc7cc86845600d25b2aff8fcb120eec0f2e6866209fb53e02
SSDEEP

3072:jNB1YRcjjEHLChxks3XSmpeWevze+ssuc:jNBytrF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3412 4304 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3412	4304	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1608 wrote to memory of 4304	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 4304	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 4304	1608	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\EES Aprende.Química.e.Ingeniería.con.Toño\Userlib\Heat Transfer\Radiation View Factors\MonteCarlo.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\EES Aprende.Química.e.Ingeniería.con.Toño\Userlib\Heat Transfer\Radiation View Factors\MonteCarlo.dll",#1
2⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 616
3⤵
- Program crash
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4304 -ip 4304
1⤵
PID:4816

memory/4304-133-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download