18fb1efac7a965e3be1b7c090324e291fcdaba65ec213619d245aa4aa54387ba | Triage

Analysis

max time kernel
137s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 14:05

Sharing

Report Analysis Logs

General

Target

api-ms-win-core-handle-l1-1-0.dll
Size

17KB
MD5

18fd51821d0a6f3e94e3fa71db6de3af
SHA1

7d9700e98ef2d93fdbf8f27592678194b740f4e0
SHA256

dba84e704ffe5fcd42548856258109dc77c6a46fd0b784119a3548ec47e5644b
SHA512

4009b4d50e3cb17197009ac7e41a2351de980b2c5b79c0b440c7fe4c1c3c4e18f1089c6f43216eaa262062c395423f3ad92ca494f664636ff7592c540c5ef89d
SSDEEP

384:4W1hWypFm0GftpBjTnom3S4tOlDCEY5kD:zvViFoUtQ1Y5kD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1968	2484	rundll32.exe	80
PID 2484 wrote to memory of 1968	2484	rundll32.exe	80
PID 2484 wrote to memory of 1968	2484	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-handle-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-handle-l1-1-0.dll,#1
  2⤵
  PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads