e66d33caff1a5048e4a5b05e52de6b92957aadd9663265afe495965f9769a725 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$_2_/TenioDL.dll
Size

550KB
MD5

6e4ce3db3b79a958a0272220e3e1085c
SHA1

a62471b23fe8af07c31a46f9e77d42a950c8ef59
SHA256

ca6fc3ba36a8c7f55ea38e6a25f02202eca2f49152be5731eb75724b5b95f21f
SHA512

8a9d85871347b610f09af6128a3480f0703edda77a91f36d5e992eec6f6d28c1b4fe9258269fdd48e970a668c5edc74c166d23680cb18f12e154f607d2ec7aff
SSDEEP

12288:adsPgjGIDHtuYsTNQD40ZE1MCFUGdNRBjlr4hFap5kYWTb+Uf:aZjjZECG794hFm5kDT6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL.dll,#1
  2⤵
  PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads