0acb4b0b9141522ba0daf85ea29ea2c2808426ef241a5bac4c9141116ebf63ba | Triage

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2024 11:51

Sharing

Report Analysis Logs

General

Target

api-ms-win-crt-time-l1-1-0.dll
Size

20KB
MD5

1fa7c2b81cdfd7ace42a2a9a0781c946
SHA1

f5b7117d18a7335228829447e3eccc7b806ef478
SHA256

cafdb772a1d7acf0807478fdba1e00fd101fc29c136547b37131f80d21dacffd
SHA512

339cdaf8de445cf05bc201400d65bb9037ea7a3782ba76864842adb6fbe5445d06863227dd774ab50e6f582b75886b302d5dd152aff1825cf90e4f252398ace0
SSDEEP

384:UzW2hWEgbCA0GftpBjJ6EKz3lvQyURz8X:y28i36bdvU2X

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 3236	4744	rundll32.exe	94
PID 4744 wrote to memory of 3236	4744	rundll32.exe	94
PID 4744 wrote to memory of 3236	4744	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-time-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-time-l1-1-0.dll,#1
  2⤵
  PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=2536,i,8161505972217706694,705854963991409854,262144 --variations-seed-version /prefetch:8
1⤵
PID:4128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads