7a75c2c9695157772541cd426d057ff382d011a2791bcc3e511d94592ab0dbb7 | Triage

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06-05-2024 17:34

Sharing

Report Analysis Logs

General

Target

$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aehelp.dll
Size

295KB
MD5

4fd11be4967e66290090f0acbb402e09
SHA1

bdfe8f35e5dc8044e64850496c7f45d30327519c
SHA256

f4cca57e7310c76ee4741132e5391089f4182caa0c13dad46c2e04022fd83cad
SHA512

f9726ebace35fc1371c9eb0967bd1e834c413adbdce50815ab7d28deaf65c9170f879920ad703dcc524fde34cef8dad30818548ac4b7b04d54d11c3b9c07ce7b
SSDEEP

6144:Zg6abREzUxcSgulWoteQYMLIWlaDhDLVH:O69zPFglksadDBH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2512 wrote to memory of 3064	2512	rundll32.exe	28
PID 2512 wrote to memory of 3064	2512	rundll32.exe	28
PID 2512 wrote to memory of 3064	2512	rundll32.exe	28
PID 2512 wrote to memory of 3064	2512	rundll32.exe	28
PID 2512 wrote to memory of 3064	2512	rundll32.exe	28
PID 2512 wrote to memory of 3064	2512	rundll32.exe	28
PID 2512 wrote to memory of 3064	2512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.0\aehelp.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.0\aehelp.dll",#1
  2⤵
  PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads