88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
93s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09-07-2024 02:14

Target

ExitLag/api-ms-win-core-rtlsupport-l1-1-0.dll
Size

10KB
MD5

0d2ac475f748e064aed7aafb7cb29f51
SHA1

a8b988f0ab05953cb42fac4d13cda09e71c9a433
SHA256

455d83c66f24f6ddb906e14824e8aa58e77d8125468e3cadf57fdbd8711bb382
SHA512

f4cf0c00ad106f937338052aaa1109aaf5987c827d1ccc8dde33d8c87c3340c732ff78511abea2678ae42b1ba0a40939e57da9cb0165d9be994955c5d8b25e22
SSDEEP

192:EG1W+NhWVT71ojDBQABJUsiu6qnajLQvTP+8jgijD6x:EG1W+NhWuDBRJclvQyUgijDC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
228	3780	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3780	4044	rundll32.exe	83
PID 4044 wrote to memory of 3780	4044	rundll32.exe	83
PID 4044 wrote to memory of 3780	4044	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-rtlsupport-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-rtlsupport-l1-1-0.dll,#1
  2⤵
  PID:3780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 600
    3⤵
    - Program crash
    PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3780 -ip 3780
1⤵
PID:2272