cd7c3f2c5f79c619b75afa181ed0c7e7215025a8ea514a2680f8e30bb424aef8

Analysis

max time kernel
181s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 19:01

Target

Notificacion/ATKEX.dll
Size

84KB
MD5

e68562f63265e1a70881446b4b9dc455
SHA1

da16ef9367bde3ce892b1a0e33bc179d8acdceb3
SHA256

c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb
SHA512

6bedea10a5b50f6e93e8566c18970c8ad1b8dfc7d5961069fc5d5216dcdded0b2a2ad8dd91f4ad80f8604d573a343c126df238ee5c448cdc26b899077957a674
SSDEEP

1536:C3zQ0q8XqIh06v0UQpTcX+CZntb9lviEossWVcd+u8Nc15TCvOM:UqhIh06vKpTcX+El2+uKc15TCF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4904 wrote to memory of 2880	4904	rundll32.exe	rundll32.exe
PID 4904 wrote to memory of 2880	4904	rundll32.exe	rundll32.exe
PID 4904 wrote to memory of 2880	4904	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Notificacion\ATKEX.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Notificacion\ATKEX.dll,#1
2⤵
PID:2880