0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841 | Triage

Analysis

max time kernel
52s
max time network
181s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Sharing

Report Analysis Logs

General

Target

ZModeler.2.2.6/Plugins/EditingLevels.dll
Size

116KB
MD5

0b04e2dfbc6818dda37ed7e5dbda7b72
SHA1

7aea1bba4e2c324783611a89bafef1e2a57882fb
SHA256

14d9d2384fffa2cc190c7b4d6bdc70e172dd8ddb6f09b6884a001693fc274f25
SHA512

3190d4b9bdb0292e75ee2cb64b0f6deeced0c40b55c830165fd554fcb3c19a7924399a356fe659055a1d2466380611e695ecb71c62e3e0e11e259bdcfa4b777d
SSDEEP

3072:fpxZT63N09rJfAX8DOEvLe2fmmMtb5OAaTv:fpzWNqr102emQOAaTv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 3552	632	rundll32.exe	66
PID 632 wrote to memory of 3552	632	rundll32.exe	66
PID 632 wrote to memory of 3552	632	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\EditingLevels.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\EditingLevels.dll,#1
  2⤵
  PID:3552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads