5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
130s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 08:11

Target

$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/aegen.dll
Size

742KB
MD5

163ea96ca0a9b9f7469dd128fe5bce04
SHA1

60f4a01001fe4ad3b2aea24ce0b535a7d863f333
SHA256

519de6c5006127a5f4174c6f6a13d87cf30a2e866bc1eb95545d67a2ec0292f2
SHA512

b088619bcb30e2f91c5ab4c6a2777a0b163e60f33ec6475a2b00d1c711f6fa86f621f8475026adf71adf3ca863911686e03cf98bf913412ac5f8e4b269fffbc1
SSDEEP

12288:dgIV1xhEHTAr7c218TOVDkAIx7RdvpkqpApOxvwwacO71fYl59y+mFTV:/lEzAr7cU8TUIAIBvpkqpApV7cy1y96b

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 4676	3520	rundll32.exe	84
PID 3520 wrote to memory of 4676	3520	rundll32.exe	84
PID 3520 wrote to memory of 4676	3520	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aegen.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aegen.dll",#1
  2⤵
  PID:4676