7a75c2c9695157772541cd426d057ff382d011a2791bcc3e511d94592ab0dbb7

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 17:34

Target

$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aeemu.dll
Size

411KB
MD5

a77547ea30c7e99dbf395e2135d5ee55
SHA1

2383bfff89a586aae2a4e99072b5b740d7115240
SHA256

daf4f56cffc30b604d238df30e96332dba84447399597cc7bfb94ab02cddec63
SHA512

ab99353214ee63b3d89dab90722fd4026f76959e7e96085ac93a457f53df9378bfbd35ec33bf7aaee0870d0a7b8ecff4601b5b360465a60d10591204cf953eef
SSDEEP

12288:ATDo2ZqPL80e/tkut8TNPpCXKQN7f4w8TMf5DTCi5xSfkpW+KV79mgAs3n5GPo:A/o2ZqPL80e/tkut8TNPpCXKQN7f4w8f

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3036 wrote to memory of 4156	3036	rundll32.exe	rundll32.exe
PID 3036 wrote to memory of 4156	3036	rundll32.exe	rundll32.exe
PID 3036 wrote to memory of 4156	3036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.0\aeemu.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.0\aeemu.dll",#1
  2⤵
  PID:4156