f1eefd45fbc4d58d58623c04ece836cefc3ce1caa20ff5e2b2597ee79098c3ca

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 06:08

Target

deskperf.dll
Size

39KB
MD5

3dbc0ea1e042f3970e054a4e3ea2a179
SHA1

321943b15134a4cde92463d4745a111890da6def
SHA256

f1eefd45fbc4d58d58623c04ece836cefc3ce1caa20ff5e2b2597ee79098c3ca
SHA512

90dce14a634b63252482bcab199a7c5af06b4490e7953911d73ff73cc2e478481b1552b16a18fe8f96b9f8f0ea2850004145b365a03634dc03c781f739c9a963
SSDEEP

384:oPEcGl2YmH3AEoxpNXKVntmKYQD1CRigGmjdR8dkdXS+bExM4GHvCEBJpLH81RC8:AbntmKYQ8R/dRhdigBJlHYRCyYDVH7u

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28
PID 2040 wrote to memory of 1292	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\deskperf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\deskperf.dll,#1
  2⤵
  PID:1292