7a75c2c9695157772541cd426d057ff382d011a2791bcc3e511d94592ab0dbb7

Analysis

max time kernel
135s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 17:34

Target

$APPDATA/TotalAV/updates/SAVAPI 8.0.0/aebb.dll
Size

70KB
MD5

f81983581bdb64f2b9234ad881b9c7c1
SHA1

a12e1674498d3859f5e867d1c958b3a72047bf62
SHA256

cbcf727bb8b75864509ca1c7d68d4ef51d64a18b15b3e1145f94cd50f29746cc
SHA512

03fa42f9fc249be0c2269a076ec95b50e7d323587f5b1b4325549dd010eb2500b0ef8713d1e40c99a6de89abf30a3fc8a01b2d9f77bf224b5a51b2826bb53754
SSDEEP

768:9YYeKlKHPrmWYGQvredEzQiWidVtj44H6Kd3SVI2HAK2P3hh+:3PGQvrd5LtxHZcHgKW3hh+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1660 wrote to memory of 3140	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 3140	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 3140	1660	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.0\aebb.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 8.0.0\aebb.dll",#1
  2⤵
  PID:3140