177eb704df67eb4982a6f125fb2b57342e80db27f9bfeea8ff76d8e8ef318801

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 01:05 UTC

Target

resources/binaries/apex-internal.dll
Size

3.4MB
MD5

8d450b22c2ad0c9a80da223dd91121c4
SHA1

b628576d24864d5c8173b273135014e22a1d80e2
SHA256

dd70c29c44c8759e05f90b9f3836eaef86afb2a484c572b586f982810ab4931b
SHA512

3eed8b5e4230b1391884a1dcf85e74e49af84c7c04adbe72148a31e396504317120cd5bf914b233975a9e3d87140270b7d771e5c936ec1a17ce6e2375468cf04
SSDEEP

49152:5SCUu4hXFAzTwZeKzUCa13eSfvMnmjWWMDP2OQyXmkTiZGY:5SS9EXa13NW2WXmkTWGY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1148	3016	rundll32.exe	28
PID 3016 wrote to memory of 1148	3016	rundll32.exe	28
PID 3016 wrote to memory of 1148	3016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\binaries\apex-internal.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3016 -s 152
  2⤵
  PID:1148