0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841 | Triage

Analysis

max time kernel
53s
max time network
180s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Sharing

Report Analysis Logs

General

Target

ZModeler.2.2.6/Plugins/Lights.dll
Size

136KB
MD5

f63f8cae198ca7e9fe6a6737cd377a20
SHA1

1cf0a082f00543852c84dedd6e92026b00046ee8
SHA256

790758b1a930e38d80144861d2452bf0760a14728395bd2908dfcd9a904575fe
SHA512

b0c73852eaaa5e94280f9a835dc626b6eb0dafed2fdb0909e9706d9c8517197176714bc7b9d97d6cc9ecba43fa23c64c79c1c9f71870413ae3254c6c5c7184f8
SSDEEP

3072:UFHIpBLP5WKWKjfTBfrjUiFfI+OAil8z:SopWKlxHUilZOAiS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 3616	3692	rundll32.exe	66
PID 3692 wrote to memory of 3616	3692	rundll32.exe	66
PID 3692 wrote to memory of 3616	3692	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\Lights.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\Lights.dll,#1
  2⤵
  PID:3616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads