0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841 | Triage

Analysis

max time kernel
54s
max time network
169s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08-05-2023 18:25

Sharing

Report Analysis Logs

General

Target

ZModeler.2.2.6/Filters/BattleField2.dll
Size

52KB
MD5

37713fbac81e362fc8c91e31c4e3418e
SHA1

aad042d9beb4b3501f85fdd068e014c151533305
SHA256

50ccda7f75b70650857dfc4c9c6f9a4d81cd0813fb72670c12afb2993a2181a8
SHA512

f9a3b6201df323dde8556bb4d94c069e2d4970a1b95e103dc2fbd37bc8fb510ee7b847cb972f908e4a17978944950d458adbbfc47a010625c162d943541c9368
SSDEEP

768:Fb7Cu2rHs/EBbL7I1XgL9fYUG64YAOdXbOAMBqs:I7jcEBbLE6LGe4YndLOAM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1632	1384	rundll32.exe	66
PID 1384 wrote to memory of 1632	1384	rundll32.exe	66
PID 1384 wrote to memory of 1632	1384	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\BattleField2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\BattleField2.dll,#1
  2⤵
  PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads