e06e7863d70d633589135d5f8801a19b09280d6bfb34cb3dec65d74ebebf6633

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 23:31

Target

$_2_/TenioDL/p2pdata.dll
Size

293KB
MD5

0a8116b1e43842e3c80283f92995d40b
SHA1

ea38ce4eb1e6f80ff3e94afa87ac8ae7e5133018
SHA256

5a6d5c77bd731243ae23161bf9717fd93a505d944a32233595e55a16507d82a8
SHA512

294dd800fb7e2c7e9721369cb02293fdd4da33a7ce4cb97801a70f80f229a195400a0c143d3ca4b815f7e990a755c0fc85998a82c81913857d843ec6dc3a2fcf
SSDEEP

6144:ibQk1vx1qHv/cFOxd2KQZA9py7iO/B1eO+fhNiOAeXHqf:wQk1vxqrdFQZA9py7L/XeO+f3DHqf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	1636	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1636	1956	rundll32.exe	30
PID 1956 wrote to memory of 1636	1956	rundll32.exe	30
PID 1956 wrote to memory of 1636	1956	rundll32.exe	30
PID 1956 wrote to memory of 1636	1956	rundll32.exe	30
PID 1956 wrote to memory of 1636	1956	rundll32.exe	30
PID 1956 wrote to memory of 1636	1956	rundll32.exe	30
PID 1956 wrote to memory of 1636	1956	rundll32.exe	30
PID 1636 wrote to memory of 3068	1636	rundll32.exe	31
PID 1636 wrote to memory of 3068	1636	rundll32.exe	31
PID 1636 wrote to memory of 3068	1636	rundll32.exe	31
PID 1636 wrote to memory of 3068	1636	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\p2pdata.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\p2pdata.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 240
    3⤵
    - Program crash
    PID:3068