c0747c10be35b8c1072a360c7759228b17f35d2ec890154020c716d572b00fbd

Analysis

max time kernel
360s
max time network
361s
platform
windows7_x64
resource
win7-20240221-es
resource tags

arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
submitted
26/04/2024, 22:54

Target

CITACION DEMANDA/ATKEX.dll
Size

84KB
MD5

e68562f63265e1a70881446b4b9dc455
SHA1

da16ef9367bde3ce892b1a0e33bc179d8acdceb3
SHA256

c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb
SHA512

6bedea10a5b50f6e93e8566c18970c8ad1b8dfc7d5961069fc5d5216dcdded0b2a2ad8dd91f4ad80f8604d573a343c126df238ee5c448cdc26b899077957a674
SSDEEP

1536:C3zQ0q8XqIh06v0UQpTcX+CZntb9lviEossWVcd+u8Nc15TCvOM:UqhIh06vKpTcX+El2+uKc15TCF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2260	2164	rundll32.exe	28
PID 2164 wrote to memory of 2260	2164	rundll32.exe	28
PID 2164 wrote to memory of 2260	2164	rundll32.exe	28
PID 2164 wrote to memory of 2260	2164	rundll32.exe	28
PID 2164 wrote to memory of 2260	2164	rundll32.exe	28
PID 2164 wrote to memory of 2260	2164	rundll32.exe	28
PID 2164 wrote to memory of 2260	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\ATKEX.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\ATKEX.dll",#1
  2⤵
  PID:2260