0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
52s
max time network
178s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/GTA_SanAndreas_DFF.dll
Size

136KB
MD5

4f0668f536a21ebb252bb9fd0c7db82b
SHA1

8344d2eb157c6eeeb11ec5a666491cb5916dd110
SHA256

f8f1228bdf27510fc3d1cf8e462ac4d7508b432d3daef528254adc9fbdec199e
SHA512

e48654162d7bd9c4b3aa1f2f1382568cbe0964fd825abf5154dbe2926efebca4666cb7901925cc1dd1fc5d71777bea04e803d464a160ef304ab87ed512931eac
SSDEEP

3072:U4QYYem5IJ+jTprOvmxICnwrpB4RDjW5OAjHj:U4KJ5C+jFrOu+uwV8DgOAjD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 2004	4324	rundll32.exe	66
PID 4324 wrote to memory of 2004	4324	rundll32.exe	66
PID 4324 wrote to memory of 2004	4324	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\GTA_SanAndreas_DFF.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\GTA_SanAndreas_DFF.dll,#1
  2⤵
  PID:2004