0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
55s
max time network
182s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/wavefrontobj.dll
Size

84KB
MD5

0588976fbee01d2931e825903a7dee24
SHA1

2f1fce928584ae0fe79bd3b283d1118be16d39c4
SHA256

3ca5f739fd39f43075ef5de0c25588b5d57c778f4a6b1af053b9a1bb866a1701
SHA512

ef0a74bade9ac7c3150320f9ace7e695c80fa4ce02df3f2e1d407ece2089188cc6eca770c0bd141990ecefcda95480744ab8ab684825cb48f7e8b8387ff334e7
SSDEEP

1536:KhOVVhKGI6QmHWn6g1J5NFbFEYHFof7zV0pKOAjt2R:KhOVV8G4m2NBb2SFKipKOAjt2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 3844	2016	rundll32.exe	66
PID 2016 wrote to memory of 3844	2016	rundll32.exe	66
PID 2016 wrote to memory of 3844	2016	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\wavefrontobj.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\wavefrontobj.dll,#1
  2⤵
  PID:3844