b9a83fd92044028d1dd0264b972c95c2cb7564e8bbf480b245c8bf28a1dcb51e

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 11:37

Target

$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aecore.dll
Size

310KB
MD5

2a4261a7dde3fdfd43793ca431890f84
SHA1

8be893f9fd941dc0971498587f52228e2e9d69b0
SHA256

1eff4b5bafa7a567f756a85297733802215bd9135e627e0cc6255c65dc87ca22
SHA512

e0e584174d61387e88adb6e5a618461a71039de773666f557fd19ad4c6300d8b9bfce505b032efcfdf443ded1e97678c2e504b4e893209ffb246add683b26abf
SSDEEP

6144:xwIt+l+nab5lgF9KqSUuYM5hXLbnlaAcQkwYxhTsEaq:rtqVYF9KqSUuZhXLbnlwhTsEv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
948	2216	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 2216	952	rundll32.exe	28
PID 952 wrote to memory of 2216	952	rundll32.exe	28
PID 952 wrote to memory of 2216	952	rundll32.exe	28
PID 952 wrote to memory of 2216	952	rundll32.exe	28
PID 952 wrote to memory of 2216	952	rundll32.exe	28
PID 952 wrote to memory of 2216	952	rundll32.exe	28
PID 952 wrote to memory of 2216	952	rundll32.exe	28
PID 2216 wrote to memory of 948	2216	rundll32.exe	29
PID 2216 wrote to memory of 948	2216	rundll32.exe	29
PID 2216 wrote to memory of 948	2216	rundll32.exe	29
PID 2216 wrote to memory of 948	2216	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 11.0.1\aecore.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 11.0.1\aecore.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 220
    3⤵
    - Program crash
    PID:948