0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
55s
max time network
184s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08-05-2023 18:25

Target

ZModeler.2.2.6/Filters/ConvoyPMG.dll
Size

112KB
MD5

63fc66f5953e44de6db18197c458fb51
SHA1

1027bfd6e80366d1b74c76c213f1992c988634b8
SHA256

4cd90fc9da1223ae574e05930b90ceac26f7c0b1e6700e7cb3a861d7a2192be3
SHA512

cdb265a6c3b99a14bddbb7ebcb4786e33c6622bee65ee1892a385505b52687e55714d45b91fcb7aea30459850e8a2ff6930b668ad202a8d181bdf17c3c5dd836
SSDEEP

1536:SMNjT4Lx86rcx2Z39iFBjEbLc1S+dd82279xhszeOAS47r:SMiTrXgEYdd8QzeOAS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 5096	4404	rundll32.exe	66
PID 4404 wrote to memory of 5096	4404	rundll32.exe	66
PID 4404 wrote to memory of 5096	4404	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\ConvoyPMG.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\ConvoyPMG.dll,#1
  2⤵
  PID:5096