0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
56s
max time network
182s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Plugins/DisplayTools.dll
Size

96KB
MD5

13934a37229509e20925fc23364826b8
SHA1

19dcc42ee9acfe90381e6c28bdc0debd1d2df03c
SHA256

c7528f2e7e49d734479af53d423817f17e70b98a2683dd4cbfff84214300eae5
SHA512

ecd66f8360ec12023caeeebc41c4405714dd384409e81e955768cae3e013b1e3916b8024f9ff236b979592478044899460a9f493b268945a7d11f623fc364a1d
SSDEEP

1536:Ma0xLe2yWQe+P5Im3FoyDEv2G0mlaXNpD7QOA532vN:MaiuWQe+P5RTDEv2mlUN+OA5G

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 5096	4404	rundll32.exe	66
PID 4404 wrote to memory of 5096	4404	rundll32.exe	66
PID 4404 wrote to memory of 5096	4404	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\DisplayTools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\DisplayTools.dll,#1
  2⤵
  PID:5096