88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
147s
max time network
277s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/07/2024, 02:14

Target

ExitLag/api-ms-win-core-handle-l1-1-0.dll
Size

11KB
MD5

dd6f5fceace7754b97bf159f838d1456
SHA1

171581f074af0a5f0a8f103eeea5035989ec59b7
SHA256

688e7ec3dc88bc8f5a07a8e7ce5ae84206362014133bd2eb2c32e0f97f18a692
SHA512

4dd6b846a488a3b2587a6b5a41932d62fff33b3415781802b69d18111497b730150f00c49b5da75b0d23931a63bba66c782063056865c2998cac02604e7e5dfe
SSDEEP

192:gW+NhWarT71ojDBQABJGhoqnajLQvTP+8jgia2DR:gW+NhWjDBRJ7lvQyUgia2DR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 2340	4628	rundll32.exe	83
PID 4628 wrote to memory of 2340	4628	rundll32.exe	83
PID 4628 wrote to memory of 2340	4628	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-handle-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-handle-l1-1-0.dll,#1
  2⤵
  PID:2340