5ea85ac874b09f5b8d48f1490926fa2997ea570a6c62ecdd901f883dd24dc792

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 22:31

Target
NTPerf.dll
Size 29KB
Sample240213-2ffg2aae9z
SHA256 c5a9d9e945cb6a3fb924ce4544021db1ed8e64115eb2df07f35ceebeaeba89a7
MD5 3ef2826c29ec2c0933987d2dadb50389
SHA1 35ce1d65370f1eac82bb12e9c1452752315a46ab
SHA512 dde01a863adfd14f9d411dac86b4602f4075261d84db966bc11bdda8860ba92d8dc52f83fe71e3edaee7c08a02defb9e53008c8470d57439b5e8b5066f73439c
SSDEEP 192:0R95/lXOd04Al2G2HuDNcXsy1PxO4SLvYivihh8iEqnN8+V:Et+el2G2Oxccy1ZOLLvYivcos8+V
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 800	1564	rundll32.exe	84
PID 1564 wrote to memory of 800	1564	rundll32.exe	84
PID 1564 wrote to memory of 800	1564	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NTPerf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NTPerf.dll,#1
  2⤵
  PID:800