88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
233s
max time network
252s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/07/2024, 02:14

Target

ExitLag/api-ms-win-core-string-l1-1-0.dll
Size

11KB
MD5

fe86e5aec761423ea5cc2f1931668b6b
SHA1

7c5f0dda14ac4c292755774fcc123497dd9ecbfb
SHA256

070c693db64b910555313e5d904cf2d4d1c5907a66899acc30b80628c535d994
SHA512

61874b272ebef1b15afe8bb9ace32cf364bb3df10221a4cd0b83c523d815ebce608b055de89556fdfb6a770cd0f477726ef8cef9a94652b43c408b6048c4bca1
SSDEEP

192:apMyMv5W+NhWGT71ojDBQABJNYFqnajxcRGlP6ZqSmbbZA:pyMv5W+NhWHDBRJNmll7P6gSmbm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4132	3992	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3992	1148	rundll32.exe	90
PID 1148 wrote to memory of 3992	1148	rundll32.exe	90
PID 1148 wrote to memory of 3992	1148	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-string-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-string-l1-1-0.dll,#1
  2⤵
  PID:3992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 600
    3⤵
    - Program crash
    PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3992 -ip 3992
1⤵
PID:1432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --field-trial-handle=2872,i,17743955589867904268,13122632177464372916,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
1⤵
PID:4868