02f76fb499372f61236a0f380c9c5fc1c47b668c47f47d0a2cddf8ca22d07535 | Triage

Analysis

max time kernel
139s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 17:53

Sharing

Report Analysis Logs

General

Target

ProxyHunter/protocol/telnet.dll
Size

120KB
MD5

72cfb5447df21059bd6386701cd31c10
SHA1

7b5e8e86f4886bae5485cd56a367c5aa55643d96
SHA256

263696bb4e3b7cdcab2bfa2ee46695035ef92d66d8d5ce2ad49aeae7a652e321
SHA512

b5059a7b9699cfc3d3ababb4eb99a4ec4da72b46230cf23b448f87f232de008915ea1447c084ac034edb44e1cea393e7c6fedb281c75929924ec771379892f88
SSDEEP

3072:hts5LRxooW1rdgb5siwL7jZoCRBVhp+SMyy:htiWD7j7Vho

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1304	1572	rundll32.exe	92
PID 1572 wrote to memory of 1304	1572	rundll32.exe	92
PID 1572 wrote to memory of 1304	1572	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ProxyHunter\protocol\telnet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ProxyHunter\protocol\telnet.dll,#1
  2⤵
  PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3772,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
1⤵
PID:1872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads