88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
151s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/07/2024, 02:14

Target

ExitLag/api-ms-win-core-processthreads-l1-1-0.dll
Size

13KB
MD5

41c1254486f5fef46fb60cb21d33d34a
SHA1

1faa3c90eeecc84426d03a98913713726a50ed63
SHA256

43b50d32d193c6a80fd5ed7834e8f7e43028190f9296f1388f21fe44b859e453
SHA512

bf885135ec940a87b7269d6848de017f5db507b74041f0a0c9d6231dc87775dff68be9ab3ee086e8294944fefb3ffe53a35b25fe58e064cf679ba9c1cf3bb2f3
SSDEEP

384:sTk1JzNcKSIhW+NhWKDBRJtClvQyUgiapZ:s6cKS6NT1PevU1EZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	540	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 540	4428	rundll32.exe	82
PID 4428 wrote to memory of 540	4428	rundll32.exe	82
PID 4428 wrote to memory of 540	4428	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-processthreads-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-processthreads-l1-1-0.dll,#1
  2⤵
  PID:540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 600
    3⤵
    - Program crash
    PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 540 -ip 540
1⤵
PID:3468