e06e7863d70d633589135d5f8801a19b09280d6bfb34cb3dec65d74ebebf6633

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 23:31

Target

$_2_/TenioDL/msvcp80.dll
Size

536KB
MD5

4c8a880eabc0b4d462cc4b2472116ea1
SHA1

d0a27f553c0fe0e507c7df079485b601d5b592e6
SHA256

2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08
SHA512

6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c
SSDEEP

12288:Q1HyurvZ0JPjuTtSu86th1n/hUgiW6QR7t5j3Ooc8NHkC2eo:Q1HyurvZ0liTwuhtjnj3Ooc8NHkC2eo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 1028	464	rundll32.exe	84
PID 464 wrote to memory of 1028	464	rundll32.exe	84
PID 464 wrote to memory of 1028	464	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\msvcp80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\msvcp80.dll,#1
  2⤵
  PID:1028