0bfeb9c0d367f6caf4a1dd78b9855a3074930d1197012fbb3ca546b77200e108

Resubmissions

05/07/2024, 16:45

05/07/2024, 16:32

max time kernel
429s
max time network
432s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
05/07/2024, 16:32

Target
vivoxsdk.dll
Size 3.9MB
Sample240705-t2a6fa1gnn
SHA256 a887805bf1286725ab930359086fb3302124f5ff81b2d9f43633dc02b97c7577
MD5 2e61c567d528d08cef62b718cb8aa82f
SHA1 43d40774fc9495f9be27f8176b6d1816241237de
SHA512 17c9d4fe2d03e2723f37534701238688443041fe75ac77e7cfd8aa1b4a3885fb92dcdb23186a7415119e91def9e6fb6fdd27a7cf2fb810a32ed236ba2230d2b0
SSDEEP 98304:vkp0f3BzK7rh8Kg5IILhzkxJ4dFumlwtDCv49rMe3G0MxVp:cCf3tK7rh8Kg5IILhzhlVp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1360	1824	rundll32.exe	80
PID 1824 wrote to memory of 1360	1824	rundll32.exe	80
PID 1824 wrote to memory of 1360	1824	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vivoxsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vivoxsdk.dll,#1
  2⤵
  PID:1360