5044dc59bf63400c7977395c73fba541eb79d5effb4a52c3784dbebd96e8e5b7

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 01:21

Target

$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/aegen.dll
Size

742KB
MD5

163ea96ca0a9b9f7469dd128fe5bce04
SHA1

60f4a01001fe4ad3b2aea24ce0b535a7d863f333
SHA256

519de6c5006127a5f4174c6f6a13d87cf30a2e866bc1eb95545d67a2ec0292f2
SHA512

b088619bcb30e2f91c5ab4c6a2777a0b163e60f33ec6475a2b00d1c711f6fa86f621f8475026adf71adf3ca863911686e03cf98bf913412ac5f8e4b269fffbc1
SSDEEP

12288:dgIV1xhEHTAr7c218TOVDkAIx7RdvpkqpApOxvwwacO71fYl59y+mFTV:/lEzAr7cU8TUIAIBvpkqpApV7cy1y96b

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3580	4004	rundll32.exe	97
PID 4004 wrote to memory of 3580	4004	rundll32.exe	97
PID 4004 wrote to memory of 3580	4004	rundll32.exe	97

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aegen.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aegen.dll",#1
  2⤵
  PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:8
1⤵
PID:2548