0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841 | Triage

Analysis

max time kernel
53s
max time network
180s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08-05-2023 18:25

Sharing

Report Analysis Logs

General

Target

ZModeler.2.2.6/Plugins/Skeleton.dll
Size

156KB
MD5

09c285f22a722930ee2aa72b205925a3
SHA1

6810adc7c3d15b7831feaef4ebcd8be63d50c08c
SHA256

4d32212e381650c880f416e9a0aece08dd869186377e8942cfa90857f92306ba
SHA512

b9613903a7169e9d4d1e34daf9f49f4e89e3b062600e126f5d21a768f3f5c5975e14bf300d77534035221ab7ea5891e0b27033999a9949dcd7a0a372fe952ed0
SSDEEP

3072:7d5tXRD3hbXcYssamHPhFwCfI4BOA3M/G7Nze:7f9RjhbXcIFwCfPOA3MSe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4672	4120	rundll32.exe	66
PID 4120 wrote to memory of 4672	4120	rundll32.exe	66
PID 4120 wrote to memory of 4672	4120	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\Skeleton.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Plugins\Skeleton.dll,#1
  2⤵
  PID:4672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads