88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
148s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/07/2024, 02:14

Target

ExitLag/api-ms-win-core-processenvironment-l1-1-0.dll
Size

12KB
MD5

50cc7b996c5e9bdd1f159644dc2381d3
SHA1

21199e6c5618a17639f81730cb5ade84afe45bd0
SHA256

b874626950c6fccc3a40bdb4e7a500ea075fa470bc6d039815d4a46543bed118
SHA512

59281048fff8e12b1d100353a40387ddf0e89aff11c73ca7ff8ca2c8e30239df228b7aad8d0e3a0cf3f97204752e8f4d07decc80e15c6f69983e4d75eaeec610
SSDEEP

192:rkjW+NhWbT71ojDBQABJZmqnajxcRGlP6Zqqa:rkjW+NhWoDBRJZmll7P6gz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	4612	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 4612	3332	rundll32.exe	83
PID 3332 wrote to memory of 4612	3332	rundll32.exe	83
PID 3332 wrote to memory of 4612	3332	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-processenvironment-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-processenvironment-l1-1-0.dll,#1
  2⤵
  PID:4612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 600
    3⤵
    - Program crash
    PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4612 -ip 4612
1⤵
PID:1748