0f0eefc7cea45d05d3a7b9f05c4e902bd4508b286e460c046af3df417c32d841

Analysis

max time kernel
165s
max time network
180s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
08-05-2023 18:25

Target

ZModeler.2.2.6/Filters/juiced2.dll
Size

68KB
MD5

ad40938163bd44264f3671dd8f902a20
SHA1

645f0adcd85032b4d1b2626d77be78ca88fff874
SHA256

120ad8f21333983bbc0be5699ae1af04c5a9600eaed10d0b80a0185379213f7d
SHA512

e4b841280eac57b4ae9114e3155d150d47eeb1e0d9584384ab0b41cd591bf91b977a5e95fbb7c56773cb03193bc3814a91f2edd3b0b37c629abe93d9910975bc
SSDEEP

768:UvU0wn/89xf3+O8HZF5lslmylm5scBWLaydRDDuoqhRDD8bOAb3qP:UvJ8Kv+O8HbTsoylm5scBUdw0OAbaP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 4476	1820	rundll32.exe	66
PID 1820 wrote to memory of 4476	1820	rundll32.exe	66
PID 1820 wrote to memory of 4476	1820	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\juiced2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZModeler.2.2.6\Filters\juiced2.dll,#1
  2⤵
  PID:4476