7c0b7f0a258f8d17a0ca27c5e03ce84f35cc3bd433f3a77b1b7fd58f061c8a91

Analysis

max time kernel
144s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
05/07/2024, 16:18

Target
vivoxsdk.dll
Size 3.9MB
Sample240705-tsahjs1flk
SHA256 a887805bf1286725ab930359086fb3302124f5ff81b2d9f43633dc02b97c7577
MD5 2e61c567d528d08cef62b718cb8aa82f
SHA1 43d40774fc9495f9be27f8176b6d1816241237de
SHA512 17c9d4fe2d03e2723f37534701238688443041fe75ac77e7cfd8aa1b4a3885fb92dcdb23186a7415119e91def9e6fb6fdd27a7cf2fb810a32ed236ba2230d2b0
SSDEEP 98304:vkp0f3BzK7rh8Kg5IILhzkxJ4dFumlwtDCv49rMe3G0MxVp:cCf3tK7rh8Kg5IILhzhlVp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3064	4852	rundll32.exe	80
PID 4852 wrote to memory of 3064	4852	rundll32.exe	80
PID 4852 wrote to memory of 3064	4852	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vivoxsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vivoxsdk.dll,#1
  2⤵
  PID:3064