0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
54s
max time network
182s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/XPandRally.dll
Size

84KB
MD5

190e725c323c17c0d0df54dfe22956ba
SHA1

6cadd75408fe950110d7bfe112ff44b95a9e5c96
SHA256

89b069e44bec4b3274267c78ee0288b4924d4e29438b852dc9fdfbe815cd7527
SHA512

220577b0a4e34c113b366bd343cc8d954475d39581391081f88f5de5d9249cb7a693e1046ae9943a79fb54e7490db8074e64f2563c13d3ab70ed117681c54d15
SSDEEP

1536:OCDDB8K1ak5Wf/8PkDbvwcOhO9JCcnFbclOA58:OsDaEv5i/8ErgO9JCcniOA58

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 2320	3288	rundll32.exe	66
PID 3288 wrote to memory of 2320	3288	rundll32.exe	66
PID 3288 wrote to memory of 2320	3288	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\XPandRally.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\XPandRally.dll,#1
  2⤵
  PID:2320