67e68d1933e87f680f063203e7e243c33deba2dfdbcd2bb08e9205d3fff26fb8 | Triage

Analysis

max time kernel
12s
max time network
129s
platform
windows10_x64
resource
win10v20210410
submitted
30-07-2021 07:53

Sharing

Report Analysis Logs

General

Target

2222-main/OTC2.dll
Size

3.0MB
MD5

0c10a107fc8686a7e74c4aa1f21c70da
SHA1

ce1fa117d53e87b3b4bdaaf828f3c2eba5bb10b7
SHA256

a2a7ec38150a186831d5d967b4b8321356d30e190eaf0c17d13033aa244fe93e
SHA512

de3cf3b0e26c6feb6177e9f197f73c015b4b8d744aa1bec75eb295c1feaeaa2f02493dc61ccc12e8e54b0c29f43fbab1a4d19ee5b3b47223e6d05e897fc584f2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3872 wrote to memory of 4072	3872	rundll32.exe	rundll32.exe
PID 3872 wrote to memory of 4072	3872	rundll32.exe	rundll32.exe
PID 3872 wrote to memory of 4072	3872	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2222-main\OTC2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3872

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2222-main\OTC2.dll,#1
2⤵
PID:4072

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4072-114-0x0000000000000000-mapping.dmp

Download