f90743bd25176b40182071c82abbd77a0669fdaeea719fd0c9798435ce23d0e5 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 22:28

Sharing

Report Analysis Logs

General

Target

Eric's TelNet98 v14.0-SSH/Data.dll
Size

1.6MB
MD5

7cf2ac92e41c4facc660a1c763915258
SHA1

a71a761ffdad2e2bae8a7bbdd5e8f54f6a5910b6
SHA256

053d8dc3c6ebedee90ddd6cc04877188f4d2221ba8eb14b1d0acc44ec97b633b
SHA512

2243f38ebdc40bd21b941f12b76cf51694bfbabac33f707274acdce8bf6b79aa0da3c4c3850d943ec40f7c3d75fa2a0a588bb8da2e1ef323146bdbd2bfc86510
SSDEEP

49152:LhLubOFfPUmv8p6tbAbU9riA9+dMFP7BqD:dLubOFnUWEbIikMyP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral7/memory/2116-0-0x0000000002110000-0x000000000262D000-memory.dmp	upx
behavioral7/memory/2116-2-0x0000000002110000-0x000000000262D000-memory.dmp	upx
behavioral7/memory/2116-1-0x0000000002110000-0x000000000262D000-memory.dmp	upx
behavioral7/memory/2116-3-0x0000000002110000-0x000000000262D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Eric's TelNet98 v14.0-SSH\Data.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Eric's TelNet98 v14.0-SSH\Data.dll",#1
  2⤵
  PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-0-0x0000000002110000-0x000000000262D000-memory.dmp

Filesize
5.1MB

Download
memory/2116-2-0x0000000002110000-0x000000000262D000-memory.dmp

Filesize
5.1MB

Download
memory/2116-1-0x0000000002110000-0x000000000262D000-memory.dmp

Filesize
5.1MB

Download
memory/2116-3-0x0000000002110000-0x000000000262D000-memory.dmp

Filesize
5.1MB

Download