7c0b7f0a258f8d17a0ca27c5e03ce84f35cc3bd433f3a77b1b7fd58f061c8a91 | Triage

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 16:18

Sharing

Report Analysis Logs

General

Target

vivoxsdk.dll
Size

3.9MB
MD5

2e61c567d528d08cef62b718cb8aa82f
SHA1

43d40774fc9495f9be27f8176b6d1816241237de
SHA256

a887805bf1286725ab930359086fb3302124f5ff81b2d9f43633dc02b97c7577
SHA512

17c9d4fe2d03e2723f37534701238688443041fe75ac77e7cfd8aa1b4a3885fb92dcdb23186a7415119e91def9e6fb6fdd27a7cf2fb810a32ed236ba2230d2b0
SSDEEP

98304:vkp0f3BzK7rh8Kg5IILhzkxJ4dFumlwtDCv49rMe3G0MxVp:cCf3tK7rh8Kg5IILhzhlVp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2808 wrote to memory of 2688	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 2688	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 2688	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 2688	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 2688	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 2688	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 2688	2808	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vivoxsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vivoxsdk.dll,#1
2⤵
PID:2688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads