88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
154s
max time network
262s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/07/2024, 02:14

Target

ExitLag/api-ms-win-core-console-l1-1-0.dll
Size

11KB
MD5

455b77e1a0d4e833095805d61feb551c
SHA1

3150cc6a40962d9b51c8badf5032628b317da06e
SHA256

9923fdb819fcc415b1b0405f91f717fbc420c2beda4162bcd2cd7521314306f0
SHA512

aad7b12cfbe014c719d30d67bff38a2d5965c7f82ea48c244f3a7dbeec7fd9567fa62dc08e6e4f8e1a6c8c69faf58fc220fe8b5f0ec483e8b060e43d807cb43a
SSDEEP

192:eMW+NhWST71ojDBQABJnqnajLQvTP+8jgi5g9:DW+NhWDDBRJnlvQyUgi5g9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 376	3588	rundll32.exe	83
PID 3588 wrote to memory of 376	3588	rundll32.exe	83
PID 3588 wrote to memory of 376	3588	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-console-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-console-l1-1-0.dll,#1
  2⤵
  PID:376