0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
53s
max time network
185s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/Emergency3_v3o.dll
Size

56KB
MD5

0f5706316c37d01f6561600ed10e5999
SHA1

75e1a5557491da1fff43411d1495ad491831af2f
SHA256

649aa6c96c4880a9531e16bb152c70df90a4d878e370281a1468cdf85509e1f1
SHA512

51106efb851d7d95f344139d7b825a144f9856a2a4e7ff1cbfbdf11e389c24dc4b9a7978eec59d6d2e4de45244a680b08684c1de49bd8e1fdea75fdba68492cd
SSDEEP

768:Nw4PBG6zEzI67dsQ+HJUIQJdgO+caJf9zyK7bOAWC:Nw4pjZ67dv+HqTZ/ad9z7vOAWC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 4524	2248	rundll32.exe	66
PID 2248 wrote to memory of 4524	2248	rundll32.exe	66
PID 2248 wrote to memory of 4524	2248	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\Emergency3_v3o.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\Emergency3_v3o.dll,#1
  2⤵
  PID:4524