3343644e85fc33f8cd3b97e0f7275053f1c272932379c61b3c0d3c620a23a4ee

Resubmissions

08-02-2024 19:42

08-02-2024 19:33

max time kernel
92s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08-02-2024 19:42

Target

Korepi/vivoxsdk.dll
Size

10.6MB
MD5

49c587d64530b5a31b246c791643abe5
SHA1

fb5afe2fe639f7b9d05d36b258c64fe20b1d1f19
SHA256

6f6b8cdf286f7f1aec5245834fb8a8afcd6f9c764a6988b1b738df828fea2c89
SHA512

90775234fa17f192445bde2b106e7ba7158ddc6e000400b9cb1fd0b095a2210e97d17b15d9ca398062d51eeac820536492da993172aa40d32306aa4aafe86666
SSDEEP

196608:ETXSBFCzbnyZnn5QiIfAnXYmgLyGR6FuvFaEWmys2LRVfrgt4fKIo4McwOJI/:ErSBwzbnyZTeAnIlLyZGP2TTgXIoHrx/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4816	3328	rundll32.exe	83
PID 3328 wrote to memory of 4816	3328	rundll32.exe	83
PID 3328 wrote to memory of 4816	3328	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\vivoxsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\vivoxsdk.dll,#1
  2⤵
  PID:4816