5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 08:11

Target

$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/aecore.dll
Size

310KB
MD5

2a4261a7dde3fdfd43793ca431890f84
SHA1

8be893f9fd941dc0971498587f52228e2e9d69b0
SHA256

1eff4b5bafa7a567f756a85297733802215bd9135e627e0cc6255c65dc87ca22
SHA512

e0e584174d61387e88adb6e5a618461a71039de773666f557fd19ad4c6300d8b9bfce505b032efcfdf443ded1e97678c2e504b4e893209ffb246add683b26abf
SSDEEP

6144:xwIt+l+nab5lgF9KqSUuYM5hXLbnlaAcQkwYxhTsEaq:rtqVYF9KqSUuZhXLbnlwhTsEv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4820 4688 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4820	4688	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4152 wrote to memory of 4688	4152	rundll32.exe	rundll32.exe
PID 4152 wrote to memory of 4688	4152	rundll32.exe	rundll32.exe
PID 4152 wrote to memory of 4688	4152	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aecore.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aecore.dll",#1
  2⤵
  PID:4688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 600
    3⤵
    - Program crash
    PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4688 -ip 4688
1⤵
PID:2156