5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
145s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 08:11

Target

$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/aedroid.dll
Size

2.7MB
MD5

8facd0e1b34b24d3b7adb3b9be3375dd
SHA1

f7ac09b72c91a8c54e266b7f6b68b2e40366d026
SHA256

12bfedbe10041d39020e9a15c4cc3d4b557a7d4fffe40cf2d75caecf5f1ed1ab
SHA512

55fba8645835c69fe6e93da395de726bbcc0b3dd0049b5e4673f811cb92bc911a8bf1f6706a0922548635aa81d8aef95c3779cf827e52e70f851fa0be6a0c502
SSDEEP

49152:2bnUI0myoyI4rlfff/MtGcMnrjD4LTQXJfRI14Ka8eGAp7dp9sCais5jDY5rGjS/:OnUI0myoyI4rlfff/MtGcMnrjD4LTQXv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1368 wrote to memory of 3060	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 3060	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 3060	1368	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aedroid.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aedroid.dll",#1
  2⤵
  PID:3060