0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
143s
max time network
174s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/NFSCarbon.dll
Size

88KB
MD5

7eba3c4275e2e633b796a9ef967254db
SHA1

ad2e041a83c3b09f1d96424a09fb208a571a7444
SHA256

c902f9ee4c52e5e9d766738f9791eea67e34bfd8497d3f65fe481da16b059f70
SHA512

0841f2def904a8686b6c27a3a75c1cd4908c2807e30f5a289fc0d6e03f0e50b4611eeaaeae7c0496255d78d457184318b665a89932ae24581eea169fcbc62177
SSDEEP

768:Ky3V5mQBjfys0lfFNQ+SAPy4mYqKNnyIsk2XMFAg+xfL5ovlHR8Q3eovGbOAj4KN:Ky3V590NGnzIEIskeMWpL56HCJ3OAxW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1680	1548	rundll32.exe	66
PID 1548 wrote to memory of 1680	1548	rundll32.exe	66
PID 1548 wrote to memory of 1680	1548	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\NFSCarbon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\NFSCarbon.dll,#1
  2⤵
  PID:1680