02f76fb499372f61236a0f380c9c5fc1c47b668c47f47d0a2cddf8ca22d07535 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 17:53

Sharing

Report Analysis Logs

General

Target

ProxyHunter/protocol/telnet.dll
Size

120KB
MD5

72cfb5447df21059bd6386701cd31c10
SHA1

7b5e8e86f4886bae5485cd56a367c5aa55643d96
SHA256

263696bb4e3b7cdcab2bfa2ee46695035ef92d66d8d5ce2ad49aeae7a652e321
SHA512

b5059a7b9699cfc3d3ababb4eb99a4ec4da72b46230cf23b448f87f232de008915ea1447c084ac034edb44e1cea393e7c6fedb281c75929924ec771379892f88
SSDEEP

3072:hts5LRxooW1rdgb5siwL7jZoCRBVhp+SMyy:htiWD7j7Vho

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28
PID 2644 wrote to memory of 2184	2644	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ProxyHunter\protocol\telnet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ProxyHunter\protocol\telnet.dll,#1
  2⤵
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads