0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
56s
max time network
183s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/MotoGranPri2.dll
Size

80KB
MD5

739f95618a54624ec8ee3a5b995b5bb5
SHA1

06de06086c05d25dd26a6584727bb03b6d735e44
SHA256

1d79c2af9c0ea6b7cb67f41f1040149ee17cc6d17151edc9d7223167063c31a7
SHA512

f068cfdc622cc13c73041230d46004e5cdf93aa840a41edef98f127ae5396ad2dfcb8c0123598f088644ab66400f5b9664815b969e0f92b472ac27def7932a99
SSDEEP

1536:hEKZ5ydFcD5qGFBLMqOV9J4JMuBvDzFmJIB8kOArRwA:h5OfFJ4JMuJDzWBkOArRwA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 428	4388	rundll32.exe	66
PID 4388 wrote to memory of 428	4388	rundll32.exe	66
PID 4388 wrote to memory of 428	4388	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\MotoGranPri2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\MotoGranPri2.dll,#1
  2⤵
  PID:428