e06e7863d70d633589135d5f8801a19b09280d6bfb34cb3dec65d74ebebf6633

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 23:31

Target

$_2_/TenioDL/atl80.dll
Size

94KB
MD5

3c7def3cbbca6284867aa4621d5d8a54
SHA1

4bd9852f1f063b9fd1e1829b756d381e14609fa7
SHA256

db18738202dcda842dce505ecd0b858d7b4c55886cac29827305f0dc3839143a
SHA512

1f9e89114a579bbb0c175d5fb587d58a923a0f556361b2f6c5ae3ffeb139539733e46edb3df1627fa630d5bc80cdf5ff311ca75754ca306345569cd48f51f2c4
SSDEEP

1536:RCYlLTNQQ/Nucs4hRKF+HnLoRsV1TlWh8XhylIjwaCi6imXmwxCU4tkm:R7LTNzNup4hAQHnLP+VXmwxCtk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 2596	3180	rundll32.exe	83
PID 3180 wrote to memory of 2596	3180	rundll32.exe	83
PID 3180 wrote to memory of 2596	3180	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\atl80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\atl80.dll,#1
  2⤵
  PID:2596