b0db11cb8d232f65a27118734a477a2b3d3f0d5e8170f966ba82309cd437c114 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 11:47

Sharing

Report Analysis Logs

General

Target

AVG Anti-Spyware/engine.dll
Size

437KB
MD5

db265d17b40f4dae581a9bc9c2d6c6ca
SHA1

5918f64c3b0df10712a0c1969fa5934af538e93c
SHA256

1771d53e33724eed8887c2aa908a61ece1817d576547bc794f04f5f53e95b310
SHA512

1ac4409326370eb6359bf00051c804577052510e608c28570f0acd3057d39433e963bfcbfe172d31e86107b2041b0e753c78d3b56e13a83c4ad44a78c5c9d3b5
SSDEEP

12288:yXeAhXtY9cRR9nyrRz0gxGASj3JQuqfnTJRP:yuAhO6Vyt4H3JNq/TJRP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 2160	4684	rundll32.exe	83
PID 4684 wrote to memory of 2160	4684	rundll32.exe	83
PID 4684 wrote to memory of 2160	4684	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AVG Anti-Spyware\engine.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AVG Anti-Spyware\engine.dll",#1
  2⤵
  PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads