7a75c2c9695157772541cd426d057ff382d011a2791bcc3e511d94592ab0dbb7

Analysis

max time kernel
135s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 17:34

Target

$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aelibinf.dll
Size

78KB
MD5

b871e50964730df56ba2782bcff46d97
SHA1

c50a71ed3cbd0c3a362b34d80e69260cfa67f1f8
SHA256

00da20e602fa16db217f0e947e810230bd9ddf859b902d32d9c1fde813be9f33
SHA512

478f05df9dde5950b211ab3ceb14391352114d75de3abf80070ffe569bcd7b32f930f28321b9667b72933955db2f366f03892cef130780990ef85f438019ec2a
SSDEEP

768:VVH0SGm8JSMfeHbSUSGE3MSE+RenTksudO6mlGDOtnLiG0VtnDI37XKd0YI2HAKq:VVXUeHbxv89suQlAVtDD0YHgKvghR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4828 wrote to memory of 2940	4828	rundll32.exe	rundll32.exe
PID 4828 wrote to memory of 2940	4828	rundll32.exe	rundll32.exe
PID 4828 wrote to memory of 2940	4828	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.0\aelibinf.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.0\aelibinf.dll",#1
  2⤵
  PID:2940