0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841 | Triage

Analysis

max time kernel
144s
max time network
184s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Sharing

Report Analysis Logs

General

Target

ZModeler.2.2.6/Filters/PSM.dll
Size

72KB
MD5

6c45d18a778a124ee0fae4d2922aed3a
SHA1

f42f7b44b1e650fb6966a1605e1968939b06a21c
SHA256

0d1e20ef7578a5431afece195a262497e27d7475c54557fbfd07d321b634efd9
SHA512

9cf395a011f79512efcf1c5e993fcaf8d304105c98a0dc8d042441243cee24645a6851ef4155c4589c97c884d19203aeb9d100be2875f72ac93e8d347e10a46d
SSDEEP

1536:WJjuv75RLB9y8Hb04AV6+zx9tIOEQal4rOAy:WluvvLBbFAV1zvtXZVOAy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 3616	3692	rundll32.exe	66
PID 3692 wrote to memory of 3616	3692	rundll32.exe	66
PID 3692 wrote to memory of 3616	3692	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\PSM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\PSM.dll,#1
  2⤵
  PID:3616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads