7c0b7f0a258f8d17a0ca27c5e03ce84f35cc3bd433f3a77b1b7fd58f061c8a91 | Triage

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 16:27

Sharing

Report Analysis Logs

General

Target

vivoxsdk.dll
Size

3.9MB
MD5

2e61c567d528d08cef62b718cb8aa82f
SHA1

43d40774fc9495f9be27f8176b6d1816241237de
SHA256

a887805bf1286725ab930359086fb3302124f5ff81b2d9f43633dc02b97c7577
SHA512

17c9d4fe2d03e2723f37534701238688443041fe75ac77e7cfd8aa1b4a3885fb92dcdb23186a7415119e91def9e6fb6fdd27a7cf2fb810a32ed236ba2230d2b0
SSDEEP

98304:vkp0f3BzK7rh8Kg5IILhzkxJ4dFumlwtDCv49rMe3G0MxVp:cCf3tK7rh8Kg5IILhzhlVp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 3060	2400	rundll32.exe	30
PID 2400 wrote to memory of 3060	2400	rundll32.exe	30
PID 2400 wrote to memory of 3060	2400	rundll32.exe	30
PID 2400 wrote to memory of 3060	2400	rundll32.exe	30
PID 2400 wrote to memory of 3060	2400	rundll32.exe	30
PID 2400 wrote to memory of 3060	2400	rundll32.exe	30
PID 2400 wrote to memory of 3060	2400	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vivoxsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vivoxsdk.dll,#1
  2⤵
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads