4c92997d0ef696acfb50633416902e6b7b3cccca6fd98721bd2658c846fd9576 | Triage

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 14:44

Sharing

Report Analysis Logs

General

Target

mtkjw/HtmlView.dll
Size

212KB
MD5

4c9e8f81bf741a61915d0d4fc49d595e
SHA1

d033008b3a0e5d3fc8876e0423ee5509ecb3897c
SHA256

951d725f4a12cd4ff713ca147fa3be08a02367db6731283c3f1ba30445990129
SHA512

cf2c6f8f471c8a5aad563bc257035515860689b73ce343599c7713de8bc8338a031a722f366e005bc1907d6fc97b68b8b415e8ff05b7324fb1040c5dc02315d7
SSDEEP

3072:oQuAhdg7cWLmDYvGdVEJy7vsdbIzL66ou+jcmNrW65uxIoPNH3yjedlj:27ODYvmEc7PV7JE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2960	2820	rundll32.exe	28
PID 2820 wrote to memory of 2960	2820	rundll32.exe	28
PID 2820 wrote to memory of 2960	2820	rundll32.exe	28
PID 2820 wrote to memory of 2960	2820	rundll32.exe	28
PID 2820 wrote to memory of 2960	2820	rundll32.exe	28
PID 2820 wrote to memory of 2960	2820	rundll32.exe	28
PID 2820 wrote to memory of 2960	2820	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mtkjw\HtmlView.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mtkjw\HtmlView.dll,#1
  2⤵
  PID:2960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads