2ed73364a84581e67b5ce98ee8f69ddc03f49a202a94f367e9855b50eb8ae9a4 | Triage

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:31

Sharing

Report Analysis Logs

General

Target

api-ms-win-crt-environment-l1-1-0.dll
Size

11KB
MD5

6f1a2d17995baff500d9a2e2ea4bf493
SHA1

18de93491e362de93f9e61c00f1c94aef2d880c5
SHA256

2ed73364a84581e67b5ce98ee8f69ddc03f49a202a94f367e9855b50eb8ae9a4
SHA512

d56bf9a90f05ba17119886a82218e60b1a2c31dd05396ab4894523658c6299a353aada786b6272ce1fe88886d17ac43f0d71dbef569ddbcc71d1621ff27fe5d7
SSDEEP

192:X4zWchWqU/3XjDBQABJeQxUtpwBqnajry372Ni:ozWchWqmXjDBRJeQkqliX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 3608	2564	rundll32.exe	85
PID 2564 wrote to memory of 3608	2564	rundll32.exe	85
PID 2564 wrote to memory of 3608	2564	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-environment-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-environment-l1-1-0.dll,#1
  2⤵
  PID:3608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads