0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
50s
max time network
180s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08-05-2023 18:25

Target

ZModeler.2.2.6/Filters/RaceDriverP3D.dll
Size

96KB
MD5

0e223936f400c754097d59e98bfec8eb
SHA1

470118570b940a36dd35da731b82a3d26347dc81
SHA256

639a0b97078c248261534a24b4177aad485823be09e5e8521c0f8c273f6ef941
SHA512

6792c5f5b45a2d38f1260840c9b6e83a12c456313a9b3ab59dfae17ae3992877d914b583f67f562842fd2dc976faae67176b6eb1da61e9b0b91b4fe4329ea117
SSDEEP

1536:FLq+MkfzQJjpg3c6zVTdtHSlpqTNtgu5VPPCAkbnhOA2f8:FLq+xEoVTnylpsNtguvaphOA6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4372	4184	rundll32.exe	66
PID 4184 wrote to memory of 4372	4184	rundll32.exe	66
PID 4184 wrote to memory of 4372	4184	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\RaceDriverP3D.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\RaceDriverP3D.dll,#1
  2⤵
  PID:4372