0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
145s
max time network
184s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/TestDriveUnlimited_BNK.dll
Size

196KB
MD5

732565ce78f88b4f60b6fd326cde7199
SHA1

e6fbab1d5301264c9ea1a2189e937d5da932d30a
SHA256

d6574e46d1f1c2e85cb8b74a974f65d9dcdc93012817416fa00dd9f85fe23804
SHA512

55a3175466947edf4d1b45ebaae838d9fe33eaa42e66516ddfdd08aaab89cae72bd9b55931404060dfa15dfd49fac7c95f194cad8eafd6ca3658119c43a95817
SSDEEP

3072:JfVxTZe6jv0/kreDdi8pucW6u4zDbeQJMYoQsNYLOA8dMD:fxNhD0Bpuau4zeQJUNMOA8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 3844	2016	rundll32.exe	66
PID 2016 wrote to memory of 3844	2016	rundll32.exe	66
PID 2016 wrote to memory of 3844	2016	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\TestDriveUnlimited_BNK.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\TestDriveUnlimited_BNK.dll,#1
  2⤵
  PID:3844