1741be55d741c6d4cba3d685241aa1f10c05517bc6dab5392ce4b4f945ff184e

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 22:26

Target

WebEx/atkbctl.dll
Size

24KB
MD5

120fbc0bb16a0a9200e400f54c1f20b8
SHA1

3d064165d6228acf83afc8c88be9e6901e88d65e
SHA256

2c1214f6612611656b65b14f9505c68d6835272d5b2de374474592c4720f266a
SHA512

31e607f6e4717a9f20d116c0a91874d90ddc81159482e44bbe577d1c42580ca4df5b2728c9c28bdb0e264709179f6c7da185791c414c73809803189653b9c7d2
SSDEEP

48:a70gxYAokXz+NLB/6U03yQtXynZiZpiXON88fsslV0zONZG+VlgAc16rUcsnIevP:Kx4LUNXyCoON88fRAzONZGERcd2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1468	2832	rundll32.exe	28
PID 2832 wrote to memory of 1468	2832	rundll32.exe	28
PID 2832 wrote to memory of 1468	2832	rundll32.exe	28
PID 2832 wrote to memory of 1468	2832	rundll32.exe	28
PID 2832 wrote to memory of 1468	2832	rundll32.exe	28
PID 2832 wrote to memory of 1468	2832	rundll32.exe	28
PID 2832 wrote to memory of 1468	2832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebEx\atkbctl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebEx\atkbctl.dll,#1
  2⤵
  PID:1468