88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
152s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09-07-2024 02:14

Target

ExitLag/api-ms-win-core-file-l2-1-0.dll
Size

11KB
MD5

8403e7b9ec4b0c4f6c9bf0ec93687c77
SHA1

7581e7d872ec9c00f33bdac9690e55096db30172
SHA256

a8b79e230a81102735996500dd00d34bfa77955c11d87c0f9c967ec85003e116
SHA512

a1017a6115c9375ae0ee5ccc40dcf354dbe1ed3067c027c99f3d4b4045c9ad50ecb833e587579153f6b819abd27399bfe8f47bd0b898b1f1c901ab3d4a8bc146
SSDEEP

192:YfW+NhWtT71ojDBQABJiz2DHqnajxcRGlP6Zqoclg:YfW+NhW2DBRJiz2DHll7P6goeg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4508	2360	rundll32.exe	83
PID 2360 wrote to memory of 4508	2360	rundll32.exe	83
PID 2360 wrote to memory of 4508	2360	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-file-l2-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-file-l2-1-0.dll,#1
  2⤵
  PID:4508