0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
52s
max time network
180s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/rFactorGMT.dll
Size

136KB
MD5

4ea5e1b0d497a6db59dfb63f3de2b4a1
SHA1

f60a61690c4bedf382690422a555d5913003dc39
SHA256

3ad53282f8ba520e821cfc19fe8fe25418b247666ce3e122af93838b2607bf8e
SHA512

625e4ade55f8bd0962f13e4e7209bd68d21ed7ac5d712e0db50e5029bcece5a660b69c4ee9ac3a48d2ea9f45cbcc79c20c9a17a83705795b474a8ff353c225b7
SSDEEP

1536:s3YhWVYxjvmjdBm6x3oii+k2BeXwxwpqAK1KrQlx6gD2P7OLagoPftOABg:UC5xZ+YzaeywprKMrCx6EogytOAi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 4996	4328	rundll32.exe	66
PID 4328 wrote to memory of 4996	4328	rundll32.exe	66
PID 4328 wrote to memory of 4996	4328	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\rFactorGMT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\rFactorGMT.dll,#1
  2⤵
  PID:4996