0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
49s
max time network
170s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/nfsshift.dll
Size

152KB
MD5

a7f8747a5f6ce5977255f9ec844f5f99
SHA1

78939968dd675555f31ed8c45c837a258df9d340
SHA256

6e0d7d4ca441ff8dd6c4a581114f7e2814aa6b03d9befb03c71f65c310083318
SHA512

9b94b4c466bd7b63bb97976fc35baa8a1faf4b4e17f2ecc265f6ae6cbd81fe29c59bb47b35d421561656efbd2a589d5e8fb365dcc55a9f2026eb45f2d1483811
SSDEEP

3072:RXDu2dEVr99K6YNIWRfVS+Mmtoy90x0OVuidURl0AfSFIum2YN8OgEUZ:9uyMNdYiySKB2Y+OgEw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1632	1384	rundll32.exe	66
PID 1384 wrote to memory of 1632	1384	rundll32.exe	66
PID 1384 wrote to memory of 1632	1384	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\nfsshift.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\nfsshift.dll,#1
  2⤵
  PID:1632