67e68d1933e87f680f063203e7e243c33deba2dfdbcd2bb08e9205d3fff26fb8 | Triage

Analysis

max time kernel
13s
max time network
24s
platform
windows7_x64
resource
win7v20210408
submitted
30-07-2021 07:53

Sharing

Report Analysis Logs

General

Target

2222-main/OTC.dll
Size

8.7MB
MD5

cbac1eb2d0f808c9a1ace63379888580
SHA1

f502e21059146f8fffba5cd84f5dccd5c8b22677
SHA256

8afbfe7db1165a9c6be977be0d2455d9287ebd9c64688ac0bbcc3e1a9872cff3
SHA512

1d1e3bff24d61b58f9e81d037f6b1a58101bb4c12a6550da0d61486f34978a5744535033e4100ba929e49fe970f92c7c30a385f7398ab30a2e21873b3aa6f715

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1020 wrote to memory of 2032	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 2032	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 2032	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 2032	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 2032	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 2032	1020	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 2032	1020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2222-main\OTC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2222-main\OTC.dll,#1
  2⤵
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-60-0x0000000000000000-mapping.dmp

Download
memory/2032-61-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download