0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
51s
max time network
179s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/RichardBurnsRally.dll
Size

188KB
MD5

8d805102fda8bd7d0b9590352e1ae8ed
SHA1

db8ee207593110bdb8472f10154cdcfda77d381a
SHA256

cf9456eb190dc36e5d0ae63b82f4c73e6f1e3f0e2b27866d45f7af4343d97e5c
SHA512

f8fcf852e1068370ec1e00b23265782c593711ccf18e0dda532307dfdcb25e15a270509cf59a939393cff22ea23bb1afd99f747058e2680c48b2bb05e3885673
SSDEEP

3072:UG77xcAZcTXTwnch1en1AIcpj4+u5RJlTOA61F:QqcTX11K1WKRJFOA61

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 1488	1332	rundll32.exe	66
PID 1332 wrote to memory of 1488	1332	rundll32.exe	66
PID 1332 wrote to memory of 1488	1332	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\RichardBurnsRally.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\RichardBurnsRally.dll,#1
  2⤵
  PID:1488