As the name suggests, "snapshots" are read-only and so cannot be altered. You could either copy/rsync the modified file/s to the live location, or do a rollback to a particular snapshot:
You can clone the snapshot (so its clone become writable, not the snapshot itself!) and you even can promote a snapshot to a "parent" filesystem (reverse parent-child).
As others have mentioned, would "zfs diff ..." be useful?
* https://www.thegeekdiary.com/how-to-identify-zfs-snapshot-di...
As the name suggests, "snapshots" are read-only and so cannot be altered. You could either copy/rsync the modified file/s to the live location, or do a rollback to a particular snapshot:
* https://www.thegeekdiary.com/solaris-zfs-how-to-create-renam...
If the machine is compromised in some way, you could reinstall and do a "zfs send-recv" of a pool from a remote system.