e06e7863d70d633589135d5f8801a19b09280d6bfb34cb3dec65d74ebebf6633 | Triage

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 23:31

Sharing

Report Analysis Logs

General

Target

$_2_/TenioDL/p2phttp.dll
Size

153KB
MD5

14d39f3db649d39bea3e14db860e6d9f
SHA1

20f134b305dee5415263f9b9a8963e4759740146
SHA256

397f93340bc59f3c00f7054c58ec63b8b0b4512b0a5c4c8b658699357fbc6296
SHA512

69a6028bf7e74e4c1d4916593b7ff1c3173ea98e0d9ce52087f9bc276c8fddb1e8c8c245a2a6aa0c7e44ba5e7112483f8419407b5a45b5e33ba52490a3dcd436
SSDEEP

3072:iNlosWW4RKBz/hJqyFyDydHr4r71/nLjeUacHOAnRE2:OosEuqysOFrqeUaSOAn+2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1544	3040	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3040	2884	rundll32.exe	83
PID 2884 wrote to memory of 3040	2884	rundll32.exe	83
PID 2884 wrote to memory of 3040	2884	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\p2phttp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\p2phttp.dll,#1
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 636
    3⤵
    - Program crash
    PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3040 -ip 3040
1⤵
PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads