12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
357s
max time network
371s
platform
windows7_x64
resource
win7-20230712-es
resource tags

arch:x64arch:x86image:win7-20230712-eslocale:es-esos:windows7-x64systemwindows
submitted
02/08/2023, 23:39

Target

Common Files/Codec.dll
Size

24KB
MD5

66f748fd01bc1af9cd8bb82c900d0b25
SHA1

bd3662ccf559bf218bd77720a55a86ae04856828
SHA256

431a79d0eab0958b64de1f6ad4c1c3be92239a24285c9c5f3ab7184073363ca4
SHA512

36b2eddeb776b706ee95697d530677e0b88fafb163b56b38690b07632d9c8dfa456348cd3e26a99ed77bee4856056e867456b59d1ad98e98e6c7418a9199641e
SSDEEP

384:eBdFkb5qRi3QU0FQ6C2tYSc7FFr9dLgIrZM+JrDcPTDJDl82rEVjcXeOs:GFkb5qRiSJYXPLgIrZMQrDcPJyjwXL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2668	1512	rundll32.exe	28
PID 1512 wrote to memory of 2668	1512	rundll32.exe	28
PID 1512 wrote to memory of 2668	1512	rundll32.exe	28
PID 1512 wrote to memory of 2668	1512	rundll32.exe	28
PID 1512 wrote to memory of 2668	1512	rundll32.exe	28
PID 1512 wrote to memory of 2668	1512	rundll32.exe	28
PID 1512 wrote to memory of 2668	1512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Codec.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Codec.dll",#1
  2⤵
  PID:2668

memory/2668-54-0x0000000001EC0000-0x0000000001FD3000-memory.dmp

Filesize
1.1MB

Download
memory/2668-55-0x0000000000260000-0x0000000000312000-memory.dmp

Filesize
712KB

Download
memory/2668-56-0x0000000002010000-0x0000000002131000-memory.dmp

Filesize
1.1MB

Download