64690e666518ea5fa250cb3f58b626537af21b4ccc4d58a1eebdf0bf11f10077 | Triage

Analysis

max time kernel
113s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 13:43

Sharing

Report Analysis Logs

General

Target

api-ms-win-crt-process-l1-1-0.dll
Size

18KB
MD5

fc29239610c95c2e37b2b73d080a2936
SHA1

f00d92dd1c9f2ce05fb10b81c0d41fa2cd269170
SHA256

f6a7bb53d6fd9886098a237e1985a5b314693fef57e8580dfb22d33de1dfaff9
SHA512

b79b259a37f80936bccce6d9c7b809e1ccee117d4f327347a735d9cf4eb5ff22a1d4a824c5ba2a36474db4e6cd239e14cf98d2181b635a655c38ac0d7cf08785
SSDEEP

384:wKwW1hWh8nw0YHNfPfLeEdtpBjdY/f3/8pUcl3CR:RtbYBbeElrY/H8pUd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3652 wrote to memory of 1724	3652	rundll32.exe	83
PID 3652 wrote to memory of 1724	3652	rundll32.exe	83
PID 3652 wrote to memory of 1724	3652	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-process-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-process-l1-1-0.dll,#1
  2⤵
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads