71e54b829631b93adc102824a4d3f99c804581ead8058b684df25f1c9039b738 | Triage™

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220331-en
submitted
06/04/2022, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
avast_update.dll
Size 1.6MB
Sample220406-amc7psfde5
SHA256 71e54b829631b93adc102824a4d3f99c804581ead8058b684df25f1c9039b738
MD5 b284363026bd2eef844085d6826d63ed
SHA1 94143d6470da270fc2a623c264ea1b939fa0ad58
SHA512 efcc636c53d7989ecf93e21dc5e8fbfa3017c45ac675c00b2cee68178f255b2a877f15ac8358019301dfbb2c742f515b978df84785d76b2cbdabc38b5cf46e70
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
1	876	rundll32.exe
2	876	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 876	1940	rundll32.exe	28
PID 1940 wrote to memory of 876	1940	rundll32.exe	28
PID 1940 wrote to memory of 876	1940	rundll32.exe	28
PID 1940 wrote to memory of 876	1940	rundll32.exe	28
PID 1940 wrote to memory of 876	1940	rundll32.exe	28
PID 1940 wrote to memory of 876	1940	rundll32.exe	28
PID 1940 wrote to memory of 876	1940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avast_update.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\avast_update.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/876-55-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Download