0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
51s
max time network
181s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/gtaiv.dll
Size

212KB
MD5

b9946e093122e6b107707599b657b7d8
SHA1

170febd32731c6821b938db9bc071ec226847f0f
SHA256

f1860ba89b4eda492f83dc487b2ecdb480f79e4b516d64c1d84a22811151cbae
SHA512

18a16c900a07d398e658c96bbd362b3ce75791c8eef4f9d2c9e48aa98f19596ebc7d06a6bd9e6a02be3abaad9a7b5a784f1dd3cb0fe0351a535220c9c0139e49
SSDEEP

3072:YG8lLIVCqIoOh/tRYTlAz9BSPc2JN5hPtGqs5oJWGbxKZwTUHunOgIFvr3T/7oCN:Y5l8elET6SU2fhPtQ5oqmOgIqCt64

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4176	4388	rundll32.exe	66
PID 4388 wrote to memory of 4176	4388	rundll32.exe	66
PID 4388 wrote to memory of 4176	4388	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\gtaiv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\gtaiv.dll,#1
  2⤵
  PID:4176