0bfeb9c0d367f6caf4a1dd78b9855a3074930d1197012fbb3ca546b77200e108 | Triage

Resubmissions

05-07-2024 16:45

240705-t9gyys1hrn 10

05-07-2024 16:32

240705-t2a6fa1gnn 10

Analysis

max time kernel
429s
max time network
432s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
05-07-2024 16:32

Sharing

Report Analysis Logs

General

Target

vivoxsdk.dll
Size

3.9MB
MD5

2e61c567d528d08cef62b718cb8aa82f
SHA1

43d40774fc9495f9be27f8176b6d1816241237de
SHA256

a887805bf1286725ab930359086fb3302124f5ff81b2d9f43633dc02b97c7577
SHA512

17c9d4fe2d03e2723f37534701238688443041fe75ac77e7cfd8aa1b4a3885fb92dcdb23186a7415119e91def9e6fb6fdd27a7cf2fb810a32ed236ba2230d2b0
SSDEEP

98304:vkp0f3BzK7rh8Kg5IILhzkxJ4dFumlwtDCv49rMe3G0MxVp:cCf3tK7rh8Kg5IILhzhlVp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1824 wrote to memory of 1360	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1360	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1360	1824	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vivoxsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vivoxsdk.dll,#1
2⤵
PID:1360

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...