0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841 | Triage

Analysis

max time kernel
164s
max time network
180s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08-05-2023 18:25

Sharing

Report Analysis Logs

General

Target

ZModeler.2.2.6/Plugins/ModifyTools.dll
Size

452KB
MD5

68bf7b2d7fa958963f01faed0775f104
SHA1

258a87618e0284aae3a0f5893d1264715d24e76a
SHA256

a53b1ec20e35b054257c53c9ba2bb9ef5d49c4dd7f7a69c8cd7cb5c961ca0796
SHA512

d7923954e884284d0496ef89ca47b22b8d763a86290c5915e575f52780dadd21f3261cf164586206d365dc3b3d534979eb5ffabae1c6228c116b378ef4d8fcf0
SSDEEP

6144:7ZSOGCgLt3yitoYQ5fNorCcHyF6BRklTCfOAciCMGwG:IvpykFByFne/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1892	1808	rundll32.exe	66
PID 1808 wrote to memory of 1892	1808	rundll32.exe	66
PID 1808 wrote to memory of 1892	1808	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\ModifyTools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\ModifyTools.dll,#1
  2⤵
  PID:1892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads