5ea85ac874b09f5b8d48f1490926fa2997ea570a6c62ecdd901f883dd24dc792 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 22:31

Sharing

Report Analysis Logs

General

Target

NTPerf.dll
Size

29KB
MD5

3ef2826c29ec2c0933987d2dadb50389
SHA1

35ce1d65370f1eac82bb12e9c1452752315a46ab
SHA256

c5a9d9e945cb6a3fb924ce4544021db1ed8e64115eb2df07f35ceebeaeba89a7
SHA512

dde01a863adfd14f9d411dac86b4602f4075261d84db966bc11bdda8860ba92d8dc52f83fe71e3edaee7c08a02defb9e53008c8470d57439b5e8b5066f73439c
SSDEEP

192:0R95/lXOd04Al2G2HuDNcXsy1PxO4SLvYivihh8iEqnN8+V:Et+el2G2Oxccy1ZOLLvYivcos8+V

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2476	2144	rundll32.exe	28
PID 2144 wrote to memory of 2476	2144	rundll32.exe	28
PID 2144 wrote to memory of 2476	2144	rundll32.exe	28
PID 2144 wrote to memory of 2476	2144	rundll32.exe	28
PID 2144 wrote to memory of 2476	2144	rundll32.exe	28
PID 2144 wrote to memory of 2476	2144	rundll32.exe	28
PID 2144 wrote to memory of 2476	2144	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NTPerf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NTPerf.dll,#1
  2⤵
  PID:2476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads