0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
52s
max time network
179s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/3ds.dll
Size

100KB
MD5

80c02121e0ffff492cd4c4ece886e7a2
SHA1

1d40b305f7c86fb579dabeb2b4bd20de153aa0c1
SHA256

422024fcf0796bf730448b6f31a2f94f15722ef922b1048f33e41594b75cfb38
SHA512

39317da784fd4b0bc9a80e141e4a61be8d37a16d4a626fe7dcd35bfe40aacd8e84ccc0fc447ed4307f1fa3de5e96006e889c2099f4e17bcb018e74755c622b70
SSDEEP

1536:LvnixD6i8SpAObqUyBMPDTcobnLgxg+7pXNczilAlfKtOAuQunj0o:I9p/qlm5bn5+7pXmWBtOAuQCYo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 3552	632	rundll32.exe	66
PID 632 wrote to memory of 3552	632	rundll32.exe	66
PID 632 wrote to memory of 3552	632	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\3ds.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\3ds.dll,#1
  2⤵
  PID:3552