006c3e59e32dc5f56cfa6b911e4e4fc171d681e614f3ec48edf232460814d31f | Triage

Analysis

max time kernel
141s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 18:44

Sharing

Report Analysis Logs

General

Target

ATKEX.dll
Size

84KB
MD5

e68562f63265e1a70881446b4b9dc455
SHA1

da16ef9367bde3ce892b1a0e33bc179d8acdceb3
SHA256

c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb
SHA512

6bedea10a5b50f6e93e8566c18970c8ad1b8dfc7d5961069fc5d5216dcdded0b2a2ad8dd91f4ad80f8604d573a343c126df238ee5c448cdc26b899077957a674
SSDEEP

1536:C3zQ0q8XqIh06v0UQpTcX+CZntb9lviEossWVcd+u8Nc15TCvOM:UqhIh06vKpTcX+El2+uKc15TCF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 4256	3664	rundll32.exe	88
PID 3664 wrote to memory of 4256	3664	rundll32.exe	88
PID 3664 wrote to memory of 4256	3664	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ATKEX.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ATKEX.dll,#1
  2⤵
  PID:4256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads