e06e7863d70d633589135d5f8801a19b09280d6bfb34cb3dec65d74ebebf6633 | Triage

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 23:31

Sharing

Report Analysis Logs

General

Target

$_2_/TenioDL/TenioDL.dll
Size

261KB
MD5

a162db275914a5c7adcebf845af9fd07
SHA1

92b24aa4047876c0b7109ad5b0b595de3369fdc2
SHA256

923f5a90bc36564cb8f8b4107e3f0a46b797d9fa737e8533c8b9acc183c78162
SHA512

e4190800e07cb71b812e3e74d0a83a13fd5b3c5d764cb4c6deb49100a7040f48c55d518809c9d4ae20564b7ba2419a02c0ab716d3ac540e141f6ef440a267da2
SSDEEP

6144:ddefgHzZ+ApbWHTrc5Gh3wZmWTBc9sODOJ1gAowU7Oa5Y:ddUgTjbWzrcstwZmWTmEjgAowKY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2184	2872	rundll32.exe	83
PID 2872 wrote to memory of 2184	2872	rundll32.exe	83
PID 2872 wrote to memory of 2184	2872	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\TenioDL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\TenioDL.dll,#1
  2⤵
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads