cdd9213c986f4dcc1f2c07f584d564c6a3ba00c9c27fe016bf51fd70ff0ef973 | Triage

Analysis

max time kernel
64s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 23:01

Sharing

Report Analysis Logs

General

Target

api-ms-win-crt-utility-l1-1-0.dll
Size

11KB
MD5

a0a883e26be6800508162e2a898148d9
SHA1

4f79892e7766cb7831211864978575598c86a11b
SHA256

9753ae83536767c73e340c36c5f1610bc76a3e67e033b07503ec31431cba7b90
SHA512

70904f2fd074073aebcf665178b34cf7f0f42ced7223ca296f7f202f6fa0175ace2832d9802f5bff4d67891ca09ae14fac47420d69107e72aa44b541a190f6c3
SSDEEP

192:jfHQduLWOhWnT71ojDBQABJcGqnajMHxxBNT06YeOh0:jf9WOhW0DBRJcGlI66YeOi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 3508	1508	rundll32.exe	84
PID 1508 wrote to memory of 3508	1508	rundll32.exe	84
PID 1508 wrote to memory of 3508	1508	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-utility-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-utility-l1-1-0.dll,#1
  2⤵
  PID:3508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads