b9a83fd92044028d1dd0264b972c95c2cb7564e8bbf480b245c8bf28a1dcb51e

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 11:37

Target

$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aecrypto.dll
Size

163KB
MD5

e824d826c0ebb30047aaa308fe03b6c9
SHA1

1778f29052920ddc7ef192761123013cb7f648d2
SHA256

8cb77f5fccdae7f9661b81454437928fa697a8d2c2cef8f61a3772cc766d6d10
SHA512

774111704c1d7680bce109e7fe5b2f91f415e5ff62432f8e52ba6c2a2b8986aa17c8487e0f0562818fe8d0f12af76d29965fc24a1f612eb71f149ecf60f0537a
SSDEEP

3072:YVuJFpYwK3LS25lBkL3zijjk+omocplwyew0CCNMCDLZ:GuJ43eAIEjkwdHMZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1984	2124	rundll32.exe	85
PID 2124 wrote to memory of 1984	2124	rundll32.exe	85
PID 2124 wrote to memory of 1984	2124	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 11.0.1\aecrypto.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\TotalAV\updates\SAVAPI 11.0.1\aecrypto.dll",#1
  2⤵
  PID:1984