22c0b4d6f880bbdb4d5e3df7295bcbd36f8ada3f0978a3d3f6f01eebedc31752 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 11:57

Sharing

Report Analysis Logs

General

Target

MshtmlDac.dll
Size

62KB
MD5

025edd1a0caed7c0539b8fe1dc44aafc
SHA1

06defae26351aaba89ccdf23025da8ddb5689cd4
SHA256

22c0b4d6f880bbdb4d5e3df7295bcbd36f8ada3f0978a3d3f6f01eebedc31752
SHA512

538f7190f1b8b7557528ba539eef23e35efa3a5cbf7e0b227eb4331c71b1dcf22e2db2ed266f226114d543f1ef0ba3ae0f51268b8cbe76e2e10dafec7ea66c7a
SSDEEP

768:IILfkvX9TUoyt5JqzsQj4nUDCYzrOiuevFR24cEajE//0mYOkh9d3ijoG:b8vXRUoyJQjDpzrOihFRpajEUd3i0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 876	2392	rundll32.exe	28
PID 2392 wrote to memory of 876	2392	rundll32.exe	28
PID 2392 wrote to memory of 876	2392	rundll32.exe	28
PID 2392 wrote to memory of 876	2392	rundll32.exe	28
PID 2392 wrote to memory of 876	2392	rundll32.exe	28
PID 2392 wrote to memory of 876	2392	rundll32.exe	28
PID 2392 wrote to memory of 876	2392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MshtmlDac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MshtmlDac.dll,#1
  2⤵
  PID:876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads