1c6df026b501c1bd0bd7538d1ad29c41565ee60a9441ae183f00d5409e0b48b4

Analysis

max time kernel
3s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
09/02/2024, 08:52

Target

Minty/vivoxsdk.dll
Size

10.6MB
MD5

49c587d64530b5a31b246c791643abe5
SHA1

fb5afe2fe639f7b9d05d36b258c64fe20b1d1f19
SHA256

6f6b8cdf286f7f1aec5245834fb8a8afcd6f9c764a6988b1b738df828fea2c89
SHA512

90775234fa17f192445bde2b106e7ba7158ddc6e000400b9cb1fd0b095a2210e97d17b15d9ca398062d51eeac820536492da993172aa40d32306aa4aafe86666
SSDEEP

196608:ETXSBFCzbnyZnn5QiIfAnXYmgLyGR6FuvFaEWmys2LRVfrgt4fKIo4McwOJI/:ErSBwzbnyZTeAnIlLyZGP2TTgXIoHrx/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 5188	2548	rundll32.exe	76
PID 2548 wrote to memory of 5188	2548	rundll32.exe	76
PID 2548 wrote to memory of 5188	2548	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Minty\vivoxsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Minty\vivoxsdk.dll,#1
  2⤵
  PID:5188