18fb1efac7a965e3be1b7c090324e291fcdaba65ec213619d245aa4aa54387ba | Triage

Analysis

max time kernel
139s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 14:05

Sharing

Report Analysis Logs

General

Target

api-ms-win-core-interlocked-l1-1-0.dll
Size

18KB
MD5

cfe87d58f973daeda4ee7d2cf4ae521d
SHA1

fd0aa97b7cb6e50c6d5d2bf2d21d757040b5204a
SHA256

4997fda5d0e90b8a0ab7da314cb56f25d1450b366701c45c294d8dd3254de483
SHA512

40eb68deb940bbe1b835954183eea711994c434de0abbdea0b1a51db6233a12e07827ad4a8639ae0baf46dd26c168a775ffe606c82cbe47bae655c7f28ab730b
SSDEEP

384:l5iYsFqW1hWfsngm0GftpBjWfshFIvgCcm3SHlg+0Ix:loZngViwfsh6gxfx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3716	4984	WerFault.exe	39

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4984	4260	rundll32.exe	39
PID 4260 wrote to memory of 4984	4260	rundll32.exe	39
PID 4260 wrote to memory of 4984	4260	rundll32.exe	39

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-interlocked-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-interlocked-l1-1-0.dll,#1
  2⤵
  PID:4984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 600
    3⤵
    - Program crash
    PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4984 -ip 4984
1⤵
PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads