271de5aed87a398dedf889c16d7927e90f07facb4774a073cd4f365073fe51f8 | Triage

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-it
resource tags

arch:x64arch:x86image:win10v2004-20240226-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
05-03-2024 14:02

Sharing

Report Analysis Logs

General

Target

api-ms-win-crt-time-l1-1-0.dll
Size

13KB
MD5

a440776e10098f3a8ef1c5eaca72958e
SHA1

7b8662714f6e44fb29a4224a038e4127964003e9
SHA256

40d8bc312ac7bca072703e5f0852228cde418f89ba9ad69551aa7a80a2b30316
SHA512

b043cd020d184a239510b2607c94210dc5fdc5d2a2b9285836bdce8934cc86a1cc3f47a2f520b15db84f755ac2e7c67e0247099648d292bbd5fb76f683d928df
SSDEEP

192:uamDOWOhWKT71ojDBQABJUBXqnajL1dHx3tKCJAH:l/WOhWLDBRJUtlXBtpOH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 5024	4548	rundll32.exe	88
PID 4548 wrote to memory of 5024	4548	rundll32.exe	88
PID 4548 wrote to memory of 5024	4548	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-time-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-time-l1-1-0.dll,#1
  2⤵
  PID:5024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads