435506cbe66bebdfdf9a2a94b1e8f483fdf108ab308129a6eb8dfd56a8bc77bc

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 08:02

Target

$SYSDIR/Codecs/$0.dll
Size

30KB
MD5

1bc3c1608ac94cf3fb4575dc96610fe0
SHA1

02a953629b0e272d8a9bbf5dacbb03402853bc8a
SHA256

64f426601f824c9ec361755cb157d5f80499b8bbf4a29455bfca1fb65f2aae5c
SHA512

63881bcdf359f22de1a7582d943ec241ab2fe32fd68e202befd940c4e2ee86092797bc2de4514685d122235465fcc992cb0b5c1b9899869f9ca5840bcd8bec05
SSDEEP

384:VAxUaGAn0AYDK/Eaium7FJt/O28ELjgIaK+v14RgQa2OIA9qtKYe8jLgDu7mTqZ/:VaQFDKAz5/uEYKBqUcYeILdKOcuG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1948 wrote to memory of 1728	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1728	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1728	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1728	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1728	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1728	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1728	1948	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Codecs\$0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Codecs\$0.dll,#1
2⤵
PID:1728

memory/1728-0-0x00000000009C0000-0x0000000000A00000-memory.dmp

Filesize
256KB

Download
memory/1728-1-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/1728-2-0x00000000749F0000-0x0000000074A00000-memory.dmp

Filesize
64KB

Download
memory/1728-3-0x0000000074190000-0x000000007487E000-memory.dmp

Filesize
6.9MB

Download
memory/1728-4-0x0000000074190000-0x000000007487E000-memory.dmp

Filesize
6.9MB

Download