c5a44b3d265b10212fe02cc581453d1fe751d30091282e1e2217c73ab196a232 | Triage

Analysis

max time kernel
121s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 15:00

Sharing

Report Analysis Logs

General

Target

api-ms-win-crt-locale-l1-1-0.dll
Size

18KB
MD5

62562f65937a39c28b795e1acbbda9ce
SHA1

2fb1ddd0fc9e8d1bc367a3c73f79723044f310c6
SHA256

8f5ee5bd8d46952075a04e3ee09b3da2f5d324fce433d5489f06b4ce4d4f872c
SHA512

d330c6a502b8df39c8cdab4ac2ebdf672da0581cff6c20668747d89fabeb7c045dfb2f7b1bd12f74c1c8528e718362aee1e168bdbacad758e574c75364fc276e
SSDEEP

384:GW1hWD5YHNfPfLeEdtpBjdY3FY+f35XhlMl:9MYBbeElrY3FBi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4356 wrote to memory of 112	4356	rundll32.exe	89
PID 4356 wrote to memory of 112	4356	rundll32.exe	89
PID 4356 wrote to memory of 112	4356	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-locale-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-locale-l1-1-0.dll,#1
  2⤵
  PID:112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads