28dc274e4f75b88e22a58a0672e4abaf15f9660f939dbd49a8db443a7e8891a6 | Triage

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-02-2024 16:11

Sharing

Report Analysis Logs

General

Target

ATKEX.dll
Size

53KB
MD5

ed5b3b3a04e3ccc8ddc41e0691c6af38
SHA1

7ab5dc0750fa4d5953bf45b9de4b5261458b69fa
SHA256

9b0f2a4833461caabd4d44c53c31b719c80b7f44a92cff5c0fb01d83f7fa43cb
SHA512

ae89fa6db3ba270e0ba1cae0d0457441500dfc78a50a40b7d3a2e3fae99529690e3aaa05c8821115a0a4e41197a4a650a2a8b25f92fbcb50eed7a639119cd8ad
SSDEEP

768:G8HLbpnzrRiu5m+e8a0LrvGhvkkQCHyunDEDhcvS2nzmcSSSSw:G8rbpnzrdm+eiLjKvkKS4rJzTSSSSw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 4760	1244	rundll32.exe	33
PID 1244 wrote to memory of 4760	1244	rundll32.exe	33
PID 1244 wrote to memory of 4760	1244	rundll32.exe	33

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ATKEX.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ATKEX.dll,#1
  2⤵
  PID:4760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads