6bd6cd1c6bcfe0790fc8f5d50afa96c0b0d300c823952d98c68154e178bc5083

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 18:44

Target
ATKEX.dll
Size 84KB
Sample240122-xdf9bschc2
SHA256 c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb
MD5 e68562f63265e1a70881446b4b9dc455
SHA1 da16ef9367bde3ce892b1a0e33bc179d8acdceb3
SHA512 6bedea10a5b50f6e93e8566c18970c8ad1b8dfc7d5961069fc5d5216dcdded0b2a2ad8dd91f4ad80f8604d573a343c126df238ee5c448cdc26b899077957a674
SSDEEP 1536:C3zQ0q8XqIh06v0UQpTcX+CZntb9lviEossWVcd+u8Nc15TCvOM:UqhIh06vKpTcX+El2+uKc15TCF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2956	2888	rundll32.exe	17
PID 2888 wrote to memory of 2956	2888	rundll32.exe	17
PID 2888 wrote to memory of 2956	2888	rundll32.exe	17
PID 2888 wrote to memory of 2956	2888	rundll32.exe	17
PID 2888 wrote to memory of 2956	2888	rundll32.exe	17
PID 2888 wrote to memory of 2956	2888	rundll32.exe	17
PID 2888 wrote to memory of 2956	2888	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ATKEX.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ATKEX.dll,#1
  2⤵
  PID:2956