435506cbe66bebdfdf9a2a94b1e8f483fdf108ab308129a6eb8dfd56a8bc77bc

Analysis

max time kernel
91s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 08:02

Target

$SYSDIR/Codecs/$0.dll
Size

30KB
MD5

1bc3c1608ac94cf3fb4575dc96610fe0
SHA1

02a953629b0e272d8a9bbf5dacbb03402853bc8a
SHA256

64f426601f824c9ec361755cb157d5f80499b8bbf4a29455bfca1fb65f2aae5c
SHA512

63881bcdf359f22de1a7582d943ec241ab2fe32fd68e202befd940c4e2ee86092797bc2de4514685d122235465fcc992cb0b5c1b9899869f9ca5840bcd8bec05
SSDEEP

384:VAxUaGAn0AYDK/Eaium7FJt/O28ELjgIaK+v14RgQa2OIA9qtKYe8jLgDu7mTqZ/:VaQFDKAz5/uEYKBqUcYeILdKOcuG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1100 wrote to memory of 1812	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1812	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1812	1100	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Codecs\$0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Codecs\$0.dll,#1
2⤵
PID:1812

memory/1812-0-0x0000000002E70000-0x0000000002E80000-memory.dmp

Filesize
64KB

Download
memory/1812-1-0x0000000002F30000-0x0000000002F40000-memory.dmp

Filesize
64KB

Download
memory/1812-2-0x0000000075760000-0x0000000075770000-memory.dmp

Filesize
64KB

Download
memory/1812-3-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/1812-4-0x00000000059B0000-0x0000000005F54000-memory.dmp

Filesize
5.6MB

Download
memory/1812-5-0x0000000005500000-0x0000000005592000-memory.dmp

Filesize
584KB

Download
memory/1812-7-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download