78ca941981136f8de181216770bc32154be849c0d172314744f96c0ce8df9ed1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 16:28

Target
Tenio/June.dll
Size 842KB
Sample240404-tysw3sda98
SHA256 79987a7c9ee35d6d06a493ffc25b57e68faf813fcbf85dab37f5a793df5ce149
MD5 5eb113f738e9c38dfafb24264c79b9e8
SHA1 eb7328370f436f6962281dc627b487384ce0364a
SHA512 63596d2457be2ce81e89a1fd94d81d290a68f2cdf87904f567691dcd96b7d7e45b4b32a39857d4ec1e851182cadab71804538fdd356b16e9fde85e5711d1b95c
SSDEEP 24576:xka69uMlhRpJT0wbl4lFVunw0ToZIcj8TBi+:B83JoFVAToZCT5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 640	4888	rundll32.exe	86
PID 4888 wrote to memory of 640	4888	rundll32.exe	86
PID 4888 wrote to memory of 640	4888	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tenio\June.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tenio\June.dll,#1
  2⤵
  PID:640