88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b | Triage

Analysis

max time kernel
148s
max time network
277s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09-07-2024 02:14

Sharing

Report Analysis Logs

General

Target

ExitLag/api-ms-win-core-file-l1-2-0.dll
Size

11KB
MD5

04c39b760247c6eed86854f657833347
SHA1

9490b9dcd3f91b06fa7f3028dc5df5b4a22d4fbc
SHA256

f56b749c01cc82118ffe538674df22a1f4ef7a07e94e559d25f55ce104e7b095
SHA512

5a5c9e8a1e41c4fb9aa6c0a50b60d14e4e727d951eadc3c1d475a905ea5fa5fcee8f801163206ed2a8ff651506cebcce9611afafbb3c7952ce9790f6e292e2b6
SSDEEP

192:gW+NhWsT71ojDBQABJJslqnajxcRGlP6ZqgCJ:gW+NhWBDBRJulll7P6glJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 2284	1284	rundll32.exe	83
PID 1284 wrote to memory of 2284	1284	rundll32.exe	83
PID 1284 wrote to memory of 2284	1284	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-file-l1-2-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-file-l1-2-0.dll,#1
  2⤵
  PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads