e06e7863d70d633589135d5f8801a19b09280d6bfb34cb3dec65d74ebebf6633

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 23:31

Target

$_2_/TenioDL/p2pdata.dll
Size

293KB
MD5

0a8116b1e43842e3c80283f92995d40b
SHA1

ea38ce4eb1e6f80ff3e94afa87ac8ae7e5133018
SHA256

5a6d5c77bd731243ae23161bf9717fd93a505d944a32233595e55a16507d82a8
SHA512

294dd800fb7e2c7e9721369cb02293fdd4da33a7ce4cb97801a70f80f229a195400a0c143d3ca4b815f7e990a755c0fc85998a82c81913857d843ec6dc3a2fcf
SSDEEP

6144:ibQk1vx1qHv/cFOxd2KQZA9py7iO/B1eO+fhNiOAeXHqf:wQk1vxqrdFQZA9py7L/XeO+f3DHqf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	4544	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4544	2420	rundll32.exe	83
PID 2420 wrote to memory of 4544	2420	rundll32.exe	83
PID 2420 wrote to memory of 4544	2420	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\p2pdata.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\p2pdata.dll,#1
  2⤵
  PID:4544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 632
    3⤵
    - Program crash
    PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4544 -ip 4544
1⤵
PID:2668