c5a44b3d265b10212fe02cc581453d1fe751d30091282e1e2217c73ab196a232 | Triage

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 15:00

Sharing

Report Analysis Logs

General

Target

api-ms-win-crt-time-l1-1-0.dll
Size

20KB
MD5

2b701510ec3d720b8ecfbdcb4ae24de7
SHA1

3c896b75e291931664c5adc16e5d5a4e04e82680
SHA256

5c63c98c800d77c09598878313971f6a03c1ce09b6f89e0387d790f0c150bcb9
SHA512

127a56c324207fb4c7623fa43c8c68a4fd8eae3eb8b3938735e017a9375ca66bd4a9c4e5d42ce400275da856a2177e8e4e600767777fcbceaec8586507aa6f7d
SSDEEP

384:UUW1hWmgYHNfPfLeEdtpBjdYGaf3uUp1x09lY5A:4+YBbeElrYhZpk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1468 wrote to memory of 4256	1468	rundll32.exe	80
PID 1468 wrote to memory of 4256	1468	rundll32.exe	80
PID 1468 wrote to memory of 4256	1468	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-time-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-time-l1-1-0.dll,#1
  2⤵
  PID:4256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads