67e68d1933e87f680f063203e7e243c33deba2dfdbcd2bb08e9205d3fff26fb8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 18:51

Target

2222-main/OTC2.dll
Size

3.0MB
MD5

0c10a107fc8686a7e74c4aa1f21c70da
SHA1

ce1fa117d53e87b3b4bdaaf828f3c2eba5bb10b7
SHA256

a2a7ec38150a186831d5d967b4b8321356d30e190eaf0c17d13033aa244fe93e
SHA512

de3cf3b0e26c6feb6177e9f197f73c015b4b8d744aa1bec75eb295c1feaeaa2f02493dc61ccc12e8e54b0c29f43fbab1a4d19ee5b3b47223e6d05e897fc584f2
SSDEEP

49152:mKWDDGuqiucb2sdcdk3YZ/8/RRLMSaYzRoRNUvoOFMHYs1j230xrT9Ezqq:Euuqiucb2sadHZ/8/PYYzR8NUvoOFMF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3212 wrote to memory of 3752	3212	rundll32.exe	rundll32.exe
PID 3212 wrote to memory of 3752	3212	rundll32.exe	rundll32.exe
PID 3212 wrote to memory of 3752	3212	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2222-main\OTC2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2222-main\OTC2.dll,#1
  2⤵
  PID:3752