88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
148s
max time network
282s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/07/2024, 02:14

Target

ExitLag/api-ms-win-core-debug-l1-1-0.dll
Size

11KB
MD5

ebc68cc3dd2840d715a3aeb0ffaa4e16
SHA1

a6be5c5b2e81edaa818d5c085f515732c993a404
SHA256

33c615056ca40255e9eb696a42b9f372f576bd573634d933d44c3f394b0c0cf0
SHA512

88cd998a79ff3e3fdaa46bb79a11c06f076b0dcca8318c21cd99916b81f686496cce5561475df5e9e8aeb2962122a516ecda9f3adb855178a54ed47ea42813f0
SSDEEP

192:5W+NhWZT71ojDBQABJNcqnajLQvTP+8jgifB6LW:5W+NhWCDBRJ6lvQyUgif5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4272	4480	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 4480	220	rundll32.exe	83
PID 220 wrote to memory of 4480	220	rundll32.exe	83
PID 220 wrote to memory of 4480	220	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-debug-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-debug-l1-1-0.dll,#1
  2⤵
  PID:4480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 600
    3⤵
    - Program crash
    PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4480 -ip 4480
1⤵
PID:324