4510e3a1bc236ad9bd1ae3b60ee2050c3ef245887d63f14c6d67530f3ed62ee9

Analysis

max time kernel
298s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 06:57

Target
perfctrl.dll
Size 48KB
Sample260805-hrdb9sfc78
SHA256 4510e3a1bc236ad9bd1ae3b60ee2050c3ef245887d63f14c6d67530f3ed62ee9
MD5 1f548f09a7cdc6390878ea6156e673ea
SHA1 4c0f61fb580e98a1162fe109136f55d490b3da40
SHA512 15fd5f25524688c2c097608f4057724e34523b9450b4a7b189250adf0be869bf5e28255c24a86ae14f052dd033398b09ecb0fce66e88e6f02db916b321979304
SSDEEP 768:ByL+6KWzlNB6dHUKdTNZPwTHpw9HIi4xzqmFdXjkDZYWvb6TMd1pPoEkW:BYtKWLSTNhwVwdIi4NfZZ+3pPoEk
TLSH
T10123290A32A504B5E1239A35C8F39E25E7B3F8126376974F0268526F1FA33D1963D739
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Toolkit\conf.ini	rundll32.exe
File created	C:\Program Files (x86)\Toolkit\perfctrl.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Toolkit\perfctrl.dll	rundll32.exe
File created	C:\Program Files (x86)\Toolkit\Toolkit.exe	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 2556	4784	rundll32.exe	87
PID 4784 wrote to memory of 2556	4784	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\perfctrl.dll,#1
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  PID:2556