746de725b958eb6dc30b836114a79cb0071fda04a15dcc938a6ced5586de25d0 | Triage

Analysis

max time kernel
167s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 09:38

Sharing

Report Analysis Logs

General

Target

ipacc/HtmlPeek.dll
Size

228KB
MD5

cd7a5a5ea24919d661c9c058eaa8aed8
SHA1

b2c4f5d5437655875b329726d8521614287fd6f0
SHA256

602ba0d3d7706689343da9e9d5c9df063eebafbecddc7c9cb4eee7799177d26f
SHA512

bf45c637a5bc688829576e5fc2827e58d4b883921a72ff9dbe68fa7dff10c7f15eb18a6f62b0a64e554ae7f7012ed9afd436945bee68f6d9927c949f6b396c83
SSDEEP

6144:AdHDWxiYy4kM22ikvRW4h8CsBHji4NYJ:Fi+kWi2sFj

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\com\PopShow.dll rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3336 wrote to memory of 3556	3336	rundll32.exe	rundll32.exe
PID 3336 wrote to memory of 3556	3336	rundll32.exe	rundll32.exe
PID 3336 wrote to memory of 3556	3336	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ipacc\HtmlPeek.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3336

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ipacc\HtmlPeek.dll,#1
2⤵
- Drops file in System32 directory
PID:3556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3556-132-0x0000000000000000-mapping.dmp

Download
memory/3556-133-0x0000000000E00000-0x0000000000E3E000-memory.dmp

Filesize
248KB

Download