88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
155s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09-07-2024 02:14

Target

ExitLag/api-ms-win-core-localization-l1-2-0.dll
Size

13KB
MD5

2e2c78125c66cde5859559f5e6167034
SHA1

f00e9cdd8da93106fb3bc060e64c643e2274a598
SHA256

9bf2bff3adcb1fb5707794b18320d7113f45446dd505eee43abbf8835cd73a44
SHA512

9bc9158284dedd0dff361b7f4ec3bf32b2915d4aeaff5a8d8ed51ccdc1e34ea5d3781343c489614eebd02323d6926a865ab94d3efd6ef6f34779364ac1752e1e
SSDEEP

384:nVOMw3zdp3bwjGjue9/0jCRrndbVW+NhWUDBRJUll7P6gQn:nVOMwBprwjGjue9/0jCRrndblN11PMYn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 3544	4184	rundll32.exe	83
PID 4184 wrote to memory of 3544	4184	rundll32.exe	83
PID 4184 wrote to memory of 3544	4184	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-localization-l1-2-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-localization-l1-2-0.dll,#1
  2⤵
  PID:3544