0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
53s
max time network
178s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08/05/2023, 18:25

Target

ZModeler.2.2.6/Filters/LockOn.dll
Size

92KB
MD5

9bc4d8e66257088f3c456ebf54fc24df
SHA1

2435e151bca516a0b3e180621092323fb65d71ea
SHA256

195128e79d9073e13222953bb62428a1f702d8b4be92e7d725c0580627ac45e3
SHA512

431f9d10ddb7a9bc2be08a9b64ee26d0e074c33be46f72985db3ad0377386a044031847c1d49efc27f8a2246ee503f78310dc0dbf2bf97f2e6082ed2d783891a
SSDEEP

1536:myQNTnF2B0T8QGkxhOTTDs9tys34HdGJkMTX8lPXvL9LOAxw0+:muiGiuDs9YHdG6M7ORLOAxl+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4484	4148	rundll32.exe	66
PID 4148 wrote to memory of 4484	4148	rundll32.exe	66
PID 4148 wrote to memory of 4484	4148	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\LockOn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\LockOn.dll,#1
  2⤵
  PID:4484