Name: aswrundll.exe
Description: This process is used by AVAST antivirus to run and execute any modules
Author: Eli Salem
Created: '2019-03-19'
Commands:
  - Command: '"C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll"'
    Description: Load and execute modules using aswrundll
    Usecase: Execute malicious modules using aswrundll.exe
    Category: Execute
    Privileges: Any
    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Full_Path:
- Path: 'C:\Program Files\Avast Software\Avast\aswrundll'
Code_Sample: 
- Code: '["C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" "C:\Users\module.dll"]'
Resources:
 - Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research
Acknowledgement:
  - Person: Eli Salem 
    handle: 'https://www.linkedin.com/in/eli-salem-954728150'