4e68a591b4ed8ffe693619f7d98b7af388357eaf2d8005cf15b3fb5697fe69ce

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 21:41

Target

GSMCodec.dll
Size

48KB
MD5

217c9db91722f0be0419fc33d9ab443c
SHA1

df5cf70f07209b1226dc277868d2701c93f21d3e
SHA256

cfe4d77f07d613e06f9837249f4cb3d01aa167a065ec81c5fdc432961cb8b377
SHA512

a9ac64406525918aa0ca2c29f878410e18cc53022c05c88fdb2a9367d4b6e362c5fecc2e3641b66b2d0a52c21b79e98859b8f34d895ea87100924fbca2d6c83e
SSDEEP

768:3kozqlQFiba52PKylkD+oRKIXgjLniUrTJPl7RXNjZNLzxznztzjzJzfzlzbzBz5:3OSQ/7TJPl7RXNjZNLzxznztzjzJzfzP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3044	2808	rundll32.exe	28
PID 2808 wrote to memory of 3044	2808	rundll32.exe	28
PID 2808 wrote to memory of 3044	2808	rundll32.exe	28
PID 2808 wrote to memory of 3044	2808	rundll32.exe	28
PID 2808 wrote to memory of 3044	2808	rundll32.exe	28
PID 2808 wrote to memory of 3044	2808	rundll32.exe	28
PID 2808 wrote to memory of 3044	2808	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GSMCodec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GSMCodec.dll,#1
  2⤵
  PID:3044