5044dc59bf63400c7977395c73fba541eb79d5effb4a52c3784dbebd96e8e5b7

Analysis

max time kernel
138s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 01:21

Target

$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/aeheur.dll
Size

10.9MB
MD5

d3f86394440e679a8be729c2af168169
SHA1

3c50ae00ca1c65b71f6f01c18a1507c03207df5a
SHA256

23bfdb21548d8b0da6b1d63167c44207a3fe7f613bf36406168c667bb7d0a4f5
SHA512

40abd780623276742f4ff5e89135e1223e3f7226cfb8af66f87646bcbb46c46e23eebe1a4bf3e4e0603622fb803d91d4c7f25c31283cddacc9037335a436c936
SSDEEP

98304:9/P/JUX4fQyJVTL4sxamHxu0dcSgrz/2FJEncELaq855k0rmMxzuIi5dYPnu62QX:nmN1C1Nn7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 3408	2036	rundll32.exe	88
PID 2036 wrote to memory of 3408	2036	rundll32.exe	88
PID 2036 wrote to memory of 3408	2036	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aeheur.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aeheur.dll",#1
  2⤵
  PID:3408