0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
142s
max time network
182s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08-05-2023 18:25

Target

ZModeler.2.2.6/Plugins/CreateTools.dll
Size

120KB
MD5

f43398c16e8189d30d719c2767ae9246
SHA1

bafbff31a651403ec5f4b414beb86cf86dcd93ab
SHA256

f71248f81917137f5b7d5a76bf324e2db41f76523effc403c21eed15d9950c66
SHA512

c054b96219bfdbe8758f96f69aa0cd64827c0a76ead102908b199a99b37d1c42f1ed2089c94796f061e843677f754aa81113a6d3d408fefe9f743e912d8c06ff
SSDEEP

1536:PoJQau1wGCFl2EeZ/1Yd0jkF03vPHvmyUa/H0ubvKmRCQpOAPlbKr:wJXLeEZd0jkEy8zOAPlO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1672	1520	rundll32.exe	66
PID 1520 wrote to memory of 1672	1520	rundll32.exe	66
PID 1520 wrote to memory of 1672	1520	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\CreateTools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\CreateTools.dll,#1
  2⤵
  PID:1672