0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841 | Triage

Analysis

max time kernel
50s
max time network
181s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Sharing

Report Analysis Logs

General

Target

ZModeler.2.2.6/Plugins/FFD.dll
Size

104KB
MD5

c529729c66f0c7fa27d31ad688ad0f1f
SHA1

c4c3ae4206ded288f68077fd4946f1e9a0627089
SHA256

97060aba8217c19f63f580562ad5ff02c32edd184d89884714f944255aafe704
SHA512

46761402528df1850b08a833ce51b3db2e8363fbde1832a611077e806d57a2c863eeca494f510fa8543fa779849e356bccf647bf74fb6f3153d6d325273f6d69
SSDEEP

1536:RdQ0/imUx2qLirswgkHJcYJANOuNFiOARL7:RdQ06mUxnLipRHJcYJAN4OARn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1488	1268	rundll32.exe	66
PID 1268 wrote to memory of 1488	1268	rundll32.exe	66
PID 1268 wrote to memory of 1488	1268	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\FFD.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\FFD.dll,#1
  2⤵
  PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads