Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2023, 16:51

General

  • Target

    otc2legacy1.dll

  • Size

    32.0MB

  • MD5

    37923a2464a0de6acbc234193598498f

  • SHA1

    5e616e742c7b9cb538927540edbe76234bde5f0b

  • SHA256

    b91cfd8ada00477fcd49b40cc257eebe0ead1f2b6836078d8dc5df9a845f8a7e

  • SHA512

    a0be3a3381f12a82f3025413748b13fb223cff0d8774dedb686a1aecf4724e321a10938d8e303d08a83ba2ba19b9e450a1c2207523374de3e1d6fac4081426de

  • SSDEEP

    196608:30dk1oOVc2xUMFC/ynUCy5PlzgOgLAd5VuS/pJdJvC8MBAFokMlucABs:kemOO2KZ/yUC6NzI5yPK8MBAFokMcS

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\otc2legacy1.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4304
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\otc2legacy1.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4632
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 568
        3⤵
        • Program crash
        PID:2308
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4632 -ip 4632
    1⤵
      PID:4132

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4632-0-0x0000000000680000-0x0000000000681000-memory.dmp

            Filesize

            4KB

          • memory/4632-1-0x0000000073100000-0x0000000075104000-memory.dmp

            Filesize

            32.0MB

          • memory/4632-2-0x0000000073100000-0x0000000075104000-memory.dmp

            Filesize

            32.0MB