64690e666518ea5fa250cb3f58b626537af21b4ccc4d58a1eebdf0bf11f10077 | Triage

Analysis

max time kernel
124s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 13:43

Sharing

Report Analysis Logs

General

Target

api-ms-win-crt-utility-l1-1-0.dll
Size

18KB
MD5

e6fca8ae3857c28204e707307e1f3075
SHA1

0ea224a34c59a459ad3737953e03e4e129f6b44d
SHA256

379bc10b9c36971478a697477289f70ac92c04fea76a46da028cda51f780750b
SHA512

824e7af9f1d87eb9e0b5c105d4209ee7dd2e42a7d399b3e8297ef77a6d28584603c418565d208873a6ebb56a5f469a2d8c946c2a2f51be24d28c4012ec7edba4
SSDEEP

384:lfVW1hWTgYHNfPfLeEdtpBjdYcdf3Bp1x09lYK:lfs5YBbeElrYcdZpI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3384 wrote to memory of 3000	3384	rundll32.exe	83
PID 3384 wrote to memory of 3000	3384	rundll32.exe	83
PID 3384 wrote to memory of 3000	3384	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-utility-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-utility-l1-1-0.dll,#1
  2⤵
  PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads