88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
142s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/07/2024, 02:14

Target

ExitLag/api-ms-win-core-synch-l1-2-0.dll
Size

11KB
MD5

fd9c6d2e90b3cf9c0d72f59b66ea1989
SHA1

92be1c1c7bc81e2eaeb22fdce5946a0fb08e45f2
SHA256

05482dbb67f005e0b61bbd44ce04818254ffecb765f836324bbcb3dd174524fe
SHA512

423ca76afb7dc56a15ad245396b823ed338173d8ba23d91ec86d5743ebc53833c3a5a2b6ccd9599580d9afdd5250294be48d07a7c1a13d89607cbd8266df8b50
SSDEEP

192:wttZ3IW+NhWuT71ojDBQABJCxXqnajL1dHx3tKPDGHqH:ctZ3IW+NhWfDBRJCdlXBtgkqH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	3088	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3088	2808	rundll32.exe	83
PID 2808 wrote to memory of 3088	2808	rundll32.exe	83
PID 2808 wrote to memory of 3088	2808	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-synch-l1-2-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\api-ms-win-core-synch-l1-2-0.dll,#1
  2⤵
  PID:3088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 600
    3⤵
    - Program crash
    PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3088 -ip 3088
1⤵
PID:3700