4d4c6e971e2c8635ffdcc310998c0ab3b72595cc6589754666554da4128c4862

Analysis

max time kernel
135s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2024 09:00

Target

Akebi/vivoxsdk.dll
Size

10.6MB
MD5

49c587d64530b5a31b246c791643abe5
SHA1

fb5afe2fe639f7b9d05d36b258c64fe20b1d1f19
SHA256

6f6b8cdf286f7f1aec5245834fb8a8afcd6f9c764a6988b1b738df828fea2c89
SHA512

90775234fa17f192445bde2b106e7ba7158ddc6e000400b9cb1fd0b095a2210e97d17b15d9ca398062d51eeac820536492da993172aa40d32306aa4aafe86666
SSDEEP

196608:ETXSBFCzbnyZnn5QiIfAnXYmgLyGR6FuvFaEWmys2LRVfrgt4fKIo4McwOJI/:ErSBwzbnyZTeAnIlLyZGP2TTgXIoHrx/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 776 wrote to memory of 3680	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 3680	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 3680	776	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Akebi\vivoxsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Akebi\vivoxsdk.dll,#1
2⤵
PID:3680