Analysis

  • max time kernel
    117s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    11-07-2024 08:11

General

  • Target

    $APPDATA/ScanGuard/updates/SAVAPI 11.0.1/aemobile.dll

  • Size

    369KB

  • MD5

    b132b36c0b53839ee1c0fc8198170157

  • SHA1

    3e7394ee8d3c4c0f36e00466fe0191ede592c01b

  • SHA256

    3137d3d95d1caa59d349645ab8087d6b0c7cc3321873789c738553d4471143c6

  • SHA512

    1bba22a77ceaa59c00cf0d10a7afced2161985d8baae94c9cfe0cd5171464f49c53113b4ba8a027cb727aa242a23f79c1cf19a4df821ef6ac00f7a7c2ecd155e

  • SSDEEP

    6144:pHfeO55RAQ9JUDSzFPCMhgFaaIembdw2p52s5dEy/ZAuvGnAQyFuDlXDG:dh3RAQ9FFPRImxw2fZiy/ZAu4DU

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aemobile.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aemobile.dll",#1
      2⤵
        PID:1992

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.