d34a15e7ce2c08273e48a5138890d27821f6c32a8112e7d2f7f3a6f7d3a61911

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:51

Target

MediaCoder/codecs/drv13260.dll
Size

100KB
MD5

738841fd8c4c708bcb79a5a2b734713c
SHA1

9fe1a1821c326e2546deda0b21d3f8e2f20faa98
SHA256

93d1bdc988067375fb3fe203d9688429dd7399cb69d17ef3b314b21dcfb07ccd
SHA512

0d55f2f0e57b2a458828e0def52da895916cf5dc2d865418b254a4d7df00ce0c96aa0738db2f056ca5f56984a4d8808da5e48dd91390de627b681d651662ff8e
SSDEEP

1536:N5reeEcdd9INF7s+NYVRh15TTVVuRh15TTVVIZiuATGMV+D8sX7RV0QTstcc7Xsc:naVyI3LNsZuh8VTEcc7cc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28
PID 2232 wrote to memory of 1904	2232	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv13260.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaCoder\codecs\drv13260.dll,#1
  2⤵
  PID:1904