e06e7863d70d633589135d5f8801a19b09280d6bfb34cb3dec65d74ebebf6633 | Triage

Analysis

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 23:31

Sharing

Report Analysis Logs

General

Target

$_2_/TenioDL/TenioDL.dll
Size

261KB
MD5

a162db275914a5c7adcebf845af9fd07
SHA1

92b24aa4047876c0b7109ad5b0b595de3369fdc2
SHA256

923f5a90bc36564cb8f8b4107e3f0a46b797d9fa737e8533c8b9acc183c78162
SHA512

e4190800e07cb71b812e3e74d0a83a13fd5b3c5d764cb4c6deb49100a7040f48c55d518809c9d4ae20564b7ba2419a02c0ab716d3ac540e141f6ef440a267da2
SSDEEP

6144:ddefgHzZ+ApbWHTrc5Gh3wZmWTBc9sODOJ1gAowU7Oa5Y:ddUgTjbWzrcstwZmWTmEjgAowKY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30
PID 2556 wrote to memory of 2508	2556	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\TenioDL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\TenioDL\TenioDL.dll,#1
  2⤵
  PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads