12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
426s
max time network
443s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02-08-2023 23:39

Target

Common Files/Codec.dll
Size

24KB
MD5

66f748fd01bc1af9cd8bb82c900d0b25
SHA1

bd3662ccf559bf218bd77720a55a86ae04856828
SHA256

431a79d0eab0958b64de1f6ad4c1c3be92239a24285c9c5f3ab7184073363ca4
SHA512

36b2eddeb776b706ee95697d530677e0b88fafb163b56b38690b07632d9c8dfa456348cd3e26a99ed77bee4856056e867456b59d1ad98e98e6c7418a9199641e
SSDEEP

384:eBdFkb5qRi3QU0FQ6C2tYSc7FFr9dLgIrZM+JrDcPTDJDl82rEVjcXeOs:GFkb5qRiSJYXPLgIrZMQrDcPJyjwXL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 3772	4276	rundll32.exe	85
PID 4276 wrote to memory of 3772	4276	rundll32.exe	85
PID 4276 wrote to memory of 3772	4276	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Codec.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Codec.dll",#1
  2⤵
  PID:3772