02f76fb499372f61236a0f380c9c5fc1c47b668c47f47d0a2cddf8ca22d07535 | Triage

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 17:53

Sharing

Report Analysis Logs

General

Target

ProxyHunter/protocol/ftp.dll
Size

128KB
MD5

543030a4289de72770bff837cb003715
SHA1

14dcd473ffc53baf64e8fe3b35c3c27fe6a335f0
SHA256

466f957dc0370a8459f7e78abf7be6344debea363427d845128cd87d91e3d209
SHA512

5288a445de14d9c9a06b1c714bd6b3434181113418005e0877112388e0243eb49f255f1f73f408212f39390e78e5e09217bb73422c131f31dc0c1a9d8175156b
SSDEEP

3072:lCxs4cGijlMbkWhojt9zCW6oujlgFjz57:lCxseizcojHzZSg/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 1952	3836	rundll32.exe	82
PID 3836 wrote to memory of 1952	3836	rundll32.exe	82
PID 3836 wrote to memory of 1952	3836	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ProxyHunter\protocol\ftp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ProxyHunter\protocol\ftp.dll,#1
  2⤵
  PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads