3343644e85fc33f8cd3b97e0f7275053f1c272932379c61b3c0d3c620a23a4ee

Resubmissions

08/02/2024, 19:42

08/02/2024, 19:33

max time kernel
126s
max time network
131s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
08/02/2024, 19:33

Target

Korepi/vivoxsdk.dll
Size

10.6MB
MD5

49c587d64530b5a31b246c791643abe5
SHA1

fb5afe2fe639f7b9d05d36b258c64fe20b1d1f19
SHA256

6f6b8cdf286f7f1aec5245834fb8a8afcd6f9c764a6988b1b738df828fea2c89
SHA512

90775234fa17f192445bde2b106e7ba7158ddc6e000400b9cb1fd0b095a2210e97d17b15d9ca398062d51eeac820536492da993172aa40d32306aa4aafe86666
SSDEEP

196608:ETXSBFCzbnyZnn5QiIfAnXYmgLyGR6FuvFaEWmys2LRVfrgt4fKIo4McwOJI/:ErSBwzbnyZTeAnIlLyZGP2TTgXIoHrx/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4692	4160	rundll32.exe	73
PID 4160 wrote to memory of 4692	4160	rundll32.exe	73
PID 4160 wrote to memory of 4692	4160	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\vivoxsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\vivoxsdk.dll,#1
  2⤵
  PID:4692