88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
152s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/07/2024, 02:14

Target

ExitLag/api-ms-win-core-profile-l1-1-0.dll
Size

10KB
MD5

79d33e5228b3b252ed2a219e655e53c2
SHA1

c1976653938e588ab1fd729b0a49f9f6d3b0efa5
SHA256

e219155cd9ecb43c476bf047c3210f39ce03c52040b40e1adfc27a5a592ac809
SHA512

afe7e116f1f885f0f8ce2008f72e83aa320060b57d29745ebcb364d54f8af17933c3aeac10851af9ded9b3fe49b2963aad31186f055c33a305cca38266cdcfd8
SSDEEP

192:sgUuW+NhWWT71ojDBQABJo0UXqnajL1dHx3tKPDG2:sg7W+NhWXDBRJ10lXBtgH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4400	4452	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 4452	4744	rundll32.exe	83
PID 4744 wrote to memory of 4452	4744	rundll32.exe	83
PID 4744 wrote to memory of 4452	4744	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-profile-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-profile-l1-1-0.dll,#1
  2⤵
  PID:4452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 600
    3⤵
    - Program crash
    PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4452 -ip 4452
1⤵
PID:2640