5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 08:11

Target

$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/aecrypto.dll
Size

163KB
MD5

e824d826c0ebb30047aaa308fe03b6c9
SHA1

1778f29052920ddc7ef192761123013cb7f648d2
SHA256

8cb77f5fccdae7f9661b81454437928fa697a8d2c2cef8f61a3772cc766d6d10
SHA512

774111704c1d7680bce109e7fe5b2f91f415e5ff62432f8e52ba6c2a2b8986aa17c8487e0f0562818fe8d0f12af76d29965fc24a1f612eb71f149ecf60f0537a
SSDEEP

3072:YVuJFpYwK3LS25lBkL3zijjk+omocplwyew0CCNMCDLZ:GuJ43eAIEjkwdHMZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4604	4260	rundll32.exe	84
PID 4260 wrote to memory of 4604	4260	rundll32.exe	84
PID 4260 wrote to memory of 4604	4260	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aecrypto.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aecrypto.dll",#1
  2⤵
  PID:4604