5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 10:49

Target

Plugins/PerfMon.dll
Size

88KB
MD5

77c1bb511ba882dd1f6b68a8fa6a3e16
SHA1

308c7edd447932f3e62e444cb1b7a16351d826fb
SHA256

8f3f7bf9f290190ded0ccacf21e5027eea14e31ef2eba59a7bc0cfccd8701325
SHA512

2a1350b8103c770142b078d915e3e979bf3fe52a93d42ada3fd47ee014a1eb9b1075ab068c44f6449312b3b02300714beb3fb8396917e3817c8ae5d29fb57919
SSDEEP

1536:770aS0fsW1AYcdO/L3a+XRIArIPb2YvJAeMfrw1X+pB17S/sk2O+xWU0G:770aHWOxRIAgSYxAeKHpBNSOxWU0G

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 2112	572	rundll32.exe	28
PID 572 wrote to memory of 2112	572	rundll32.exe	28
PID 572 wrote to memory of 2112	572	rundll32.exe	28
PID 572 wrote to memory of 2112	572	rundll32.exe	28
PID 572 wrote to memory of 2112	572	rundll32.exe	28
PID 572 wrote to memory of 2112	572	rundll32.exe	28
PID 572 wrote to memory of 2112	572	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\PerfMon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\PerfMon.dll,#1
  2⤵
  PID:2112