88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
151s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09-07-2024 02:14

Target

ExitLag/api-ms-win-core-heap-l1-1-0.dll
Size

11KB
MD5

50d7a05d11fbff779142e0cf21638d75
SHA1

6ec7600bb774802878b61e2ffc91069a0a5413b6
SHA256

06939eee1edd5c14433ebe6d09927aa5b5de31c4261be856b8280c45aa5a7d83
SHA512

480b62c6c44e9324c9f18340411abd34fb78445e2916a669154f2ee0ec60c0611f9257f43021476e0c25ea1804f7520f737da2b65c00969d95f36572931fdaac
SSDEEP

192:sdS6laW+NhWFT71ojDBQABJyMnXqnajL1dHx3tKPDGYM:WlaW+NhWeDBRJ5XlXBtgy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 2100	3752	rundll32.exe	83
PID 3752 wrote to memory of 2100	3752	rundll32.exe	83
PID 3752 wrote to memory of 2100	3752	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-heap-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-heap-l1-1-0.dll,#1
  2⤵
  PID:2100