0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
164s
max time network
180s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/FlatOut.dll
Size

96KB
MD5

8c09e3603bda4dfaedfd0a69b5cd5645
SHA1

1b4807e71e9c4a2d9ac90af2d32b98adfeaa80db
SHA256

d7718d95afd925d1ddbf0e761ab31d2157bc1ddb03861218eeb74f2dd42c42ed
SHA512

51a4d2c883b9cde72a9d944f9256c18ad5833016f8a231e7c3ed95b851da0802cb0ff8bb2a9220ac93f08d79e21f12dee93e0b1a545795e54c4ed0c3cd4d2732
SSDEEP

1536:vqkexZh08saOw2OmBWjMchyNwFL/1fxqwlbqI8OAQi:vqk8XsaOwuBWjMchyNwZ/1llT8OAQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1920	1808	rundll32.exe	66
PID 1808 wrote to memory of 1920	1808	rundll32.exe	66
PID 1808 wrote to memory of 1920	1808	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\FlatOut.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\FlatOut.dll,#1
  2⤵
  PID:1920