ccc65cc16770cf1f444219f00680f9fe6234d543107e98413bb06c68aea92e86

Analysis

max time kernel
140s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2024 08:09

Target

Korepi/vivoxsdk.dll
Size

10.6MB
MD5

49c587d64530b5a31b246c791643abe5
SHA1

fb5afe2fe639f7b9d05d36b258c64fe20b1d1f19
SHA256

6f6b8cdf286f7f1aec5245834fb8a8afcd6f9c764a6988b1b738df828fea2c89
SHA512

90775234fa17f192445bde2b106e7ba7158ddc6e000400b9cb1fd0b095a2210e97d17b15d9ca398062d51eeac820536492da993172aa40d32306aa4aafe86666
SSDEEP

196608:ETXSBFCzbnyZnn5QiIfAnXYmgLyGR6FuvFaEWmys2LRVfrgt4fKIo4McwOJI/:ErSBwzbnyZTeAnIlLyZGP2TTgXIoHrx/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 4376	4180	rundll32.exe	84
PID 4180 wrote to memory of 4376	4180	rundll32.exe	84
PID 4180 wrote to memory of 4376	4180	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\vivoxsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\vivoxsdk.dll,#1
  2⤵
  PID:4376