0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
54s
max time network
182s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Plugins/SelectTools.dll
Size

168KB
MD5

1f7d92e95ef3ae6e6d0aca922a400153
SHA1

75be8da990b79d02957caefec12c4d79fe3820b0
SHA256

008c8cfdc0caf43e312be2403e2a3097f56e8c86aa9897cf73488ceb9c391160
SHA512

000c6a83dff252a5d391681c4338922fd764e3d95f1643b7cf64e573632b4fe904b0a2c5c53ad8363f921255268a4407b8faaa3db734ba37be469a8a6bacf33b
SSDEEP

3072:EbII/j8gbHAV7tMaX8+pdyfHipGsmMNRfDmJOAD+LYB:UfFHoE+pfpGsmulDmJOAD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4372	4184	rundll32.exe	66
PID 4184 wrote to memory of 4372	4184	rundll32.exe	66
PID 4184 wrote to memory of 4372	4184	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\SelectTools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\SelectTools.dll,#1
  2⤵
  PID:4372