88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
90s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/07/2024, 02:14

Target

ExitLag/api-ms-win-core-libraryloader-l1-1-0.dll
Size

11KB
MD5

cfc52941f153679f1d45b35fedbd4354
SHA1

da139d384784ba14136abace0b4df6e4133bd349
SHA256

cd308855617d79ad3f3b0c62fad601a4d9741c84d5e2466f0911891fee6314fc
SHA512

984055843ce4c5f5b04c58dee75163905f179ffb0ab64cbb077d6ae94b3297f84ba4a2b06dd7ee5f947fad56eca32cbc0ca72923d503429a561e298e0ec808c1
SSDEEP

192:evuBL3BOW+NhWLdT71ojDBQABJnC1fNMqnajxcRGlP6Zqi1:evuBL3BOW+NhWaDBRJ6Mll7P6gK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 4596	3468	rundll32.exe	83
PID 3468 wrote to memory of 4596	3468	rundll32.exe	83
PID 3468 wrote to memory of 4596	3468	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-libraryloader-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-libraryloader-l1-1-0.dll,#1
  2⤵
  PID:4596