e06e7863d70d633589135d5f8801a19b09280d6bfb34cb3dec65d74ebebf6633

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 23:31

Target

$_2_/TenioDL/p2phttp.dll
Size

153KB
MD5

14d39f3db649d39bea3e14db860e6d9f
SHA1

20f134b305dee5415263f9b9a8963e4759740146
SHA256

397f93340bc59f3c00f7054c58ec63b8b0b4512b0a5c4c8b658699357fbc6296
SHA512

69a6028bf7e74e4c1d4916593b7ff1c3173ea98e0d9ce52087f9bc276c8fddb1e8c8c245a2a6aa0c7e44ba5e7112483f8419407b5a45b5e33ba52490a3dcd436
SSDEEP

3072:iNlosWW4RKBz/hJqyFyDydHr4r71/nLjeUacHOAnRE2:OosEuqysOFrqeUaSOAn+2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2300	2136	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2136	2472	rundll32.exe	30
PID 2472 wrote to memory of 2136	2472	rundll32.exe	30
PID 2472 wrote to memory of 2136	2472	rundll32.exe	30
PID 2472 wrote to memory of 2136	2472	rundll32.exe	30
PID 2472 wrote to memory of 2136	2472	rundll32.exe	30
PID 2472 wrote to memory of 2136	2472	rundll32.exe	30
PID 2472 wrote to memory of 2136	2472	rundll32.exe	30
PID 2136 wrote to memory of 2300	2136	rundll32.exe	32
PID 2136 wrote to memory of 2300	2136	rundll32.exe	32
PID 2136 wrote to memory of 2300	2136	rundll32.exe	32
PID 2136 wrote to memory of 2300	2136	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\p2phttp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\p2phttp.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 248
    3⤵
    - Program crash
    PID:2300