88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
92s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20240708-es
resource tags

arch:x64arch:x86image:win10v2004-20240708-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09-07-2024 02:14

Target

ExitLag/api-ms-win-core-interlocked-l1-1-0.dll
Size

11KB
MD5

1f99f93d8400d1c959398d7bd7c4634c
SHA1

dcab8b80226fcfc5b187defbd62ec612cf269184
SHA256

14ee656a35ca2f558d2ace117b89bd2c66c14d66e8c06f2c2d8a108cfe144145
SHA512

d4a4a0d26ebccb9d34ab44c33b86fd6f47a2c3670ab45223318b909f177e5d3e80413d72afc9bdec580c6c09ffebabcf07f06e5c00c69fcc3dfd1478fac4478f
SSDEEP

192:EUlYsFeW+NhWPT71ojDBQABJyXKqnajLQvTP+8jgi4gq3:EUlYsFeW+NhWMDBRJ7lvQyUgi4gY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	4824	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 4824	544	rundll32.exe	82
PID 544 wrote to memory of 4824	544	rundll32.exe	82
PID 544 wrote to memory of 4824	544	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-interlocked-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-interlocked-l1-1-0.dll,#1
  2⤵
  PID:4824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 600
    3⤵
    - Program crash
    PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4824 -ip 4824
1⤵
PID:3972