0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
54s
max time network
180s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Engines/D3D9.dll
Size

64KB
MD5

f1461c0a3260ade45828a696c47be3bb
SHA1

dfe043ad0573295c21dc7f32638b27338e807c29
SHA256

3926936523a8fe0ded6bdffd18324e2c8f5a918831647644773bdabfe0632696
SHA512

774d9e17ed5a3315f3ccdbdbb4b6bfedbd1a8b7d829f654afcb93b29ee78bb82911c1f19983edf262e70761f22b996b2cd5060e037ef48831edf36e6797f3d5d
SSDEEP

768:s3Vf15PlOQm84dYjhotdn9tnJK6seteMwb3ply5fEqPMq8UbOAzHct:stvt3cChoXJKateL45cqPhOAzHq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 5056	3576	rundll32.exe	66
PID 3576 wrote to memory of 5056	3576	rundll32.exe	66
PID 3576 wrote to memory of 5056	3576	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Engines\D3D9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Engines\D3D9.dll,#1
  2⤵
  PID:5056