4e45113bdfa91deb6cddf6579f40a2471ce152e3fb4b934ccae1a207a1cad724

Analysis

max time kernel
45s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 08:41

Target

变速精灵2.11免费版/NTPerf.dll
Size

24KB
MD5

a5cba2e9c18cce02f0207d3c73034b9b
SHA1

8c1d40eb2b0b3995352c6de2a0574c03a6822d07
SHA256

d224e2318b4fcce2871d30d1b5e3f370f47f02999aa884324b0457f3d32f6e68
SHA512

bbe73a0af9c76dc6958d500a0acd3ed98a3d94d82641c3776a5c6207ebc0e635d3120f6ad95d20d7753d8884cb8a9d9f7379ebd5d2f197474627939d7b62ac18
SSDEEP

96:Q9Y6/nkA/mu3N98KqtIYYd4naBCfaC6aaR26faC6tKdZLNuL5XnYy3q:Q9Z/lXutIfp0iC6a626iC6tgtNcXYy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\NTPerf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\变速精灵2.11免费版\NTPerf.dll,#1
  2⤵
  PID:1396

memory/1396-54-0x0000000000000000-mapping.dmp

Download
memory/1396-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download