71e54b829631b93adc102824a4d3f99c804581ead8058b684df25f1c9039b738 | Triage™

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
06/04/2022, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
avast_update.dll
Size 1.6MB
Sample220406-amc7psfde5
SHA256 71e54b829631b93adc102824a4d3f99c804581ead8058b684df25f1c9039b738
MD5 b284363026bd2eef844085d6826d63ed
SHA1 94143d6470da270fc2a623c264ea1b939fa0ad58
SHA512 efcc636c53d7989ecf93e21dc5e8fbfa3017c45ac675c00b2cee68178f255b2a877f15ac8358019301dfbb2c742f515b978df84785d76b2cbdabc38b5cf46e70
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	904	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 904	2352	rundll32.exe	80
PID 2352 wrote to memory of 904	2352	rundll32.exe	80
PID 2352 wrote to memory of 904	2352	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avast_update.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\avast_update.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads