0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
58s
max time network
182s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/TestDriveUnlimited_2.dll
Size

196KB
MD5

732565ce78f88b4f60b6fd326cde7199
SHA1

e6fbab1d5301264c9ea1a2189e937d5da932d30a
SHA256

d6574e46d1f1c2e85cb8b74a974f65d9dcdc93012817416fa00dd9f85fe23804
SHA512

55a3175466947edf4d1b45ebaae838d9fe33eaa42e66516ddfdd08aaab89cae72bd9b55931404060dfa15dfd49fac7c95f194cad8eafd6ca3658119c43a95817
SSDEEP

3072:JfVxTZe6jv0/kreDdi8pucW6u4zDbeQJMYoQsNYLOA8dMD:fxNhD0Bpuau4zeQJUNMOA8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 8	3292	rundll32.exe	66
PID 3292 wrote to memory of 8	3292	rundll32.exe	66
PID 3292 wrote to memory of 8	3292	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\TestDriveUnlimited_2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\TestDriveUnlimited_2.dll,#1
  2⤵
  PID:8