Resubmissions
03-04-2024 06:34
240403-hb3bfsab7v 303-04-2024 06:29
240403-g9cm1sag36 303-04-2024 06:18
240403-g2ms1saa5y 3Analysis
-
max time kernel
191s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-04-2024 06:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
optsatadc.dll
Resource
win7-20240221-en
1 signatures
300 seconds
Behavioral task
behavioral2
Sample
optsatadc.dll
Resource
win10v2004-20240226-en
1 signatures
300 seconds
General
-
Target
optsatadc.dll
-
Size
396KB
-
MD5
df5958459f89d775687190650de4f08b
-
SHA1
4d3a703db690e975540d6d29cdab2f75fbbcb61c
-
SHA256
1122cf610bbd39b4bbae11f2e93bcbefb371aa301aac45da7ef7e5f6963ac8f4
-
SHA512
7c7bacee56cefbf3d44a5fe2c570c2eb12a800402133032419d2886f119fb0a098526f76b73174e9c1537569852a7f7c2a095589e5dc2f8ac1ddb7b832346ea9
-
SSDEEP
12288:PFFIBSCdHo3p5CJHj9wc3gXERHTYKNviwl:7IBSCdHo3p5C9BwtyHTYMX
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2168 wrote to memory of 2580 2168 rundll32.exe rundll32.exe PID 2168 wrote to memory of 2580 2168 rundll32.exe rundll32.exe PID 2168 wrote to memory of 2580 2168 rundll32.exe rundll32.exe PID 2168 wrote to memory of 2580 2168 rundll32.exe rundll32.exe PID 2168 wrote to memory of 2580 2168 rundll32.exe rundll32.exe PID 2168 wrote to memory of 2580 2168 rundll32.exe rundll32.exe PID 2168 wrote to memory of 2580 2168 rundll32.exe rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2580-0-0x0000000073120000-0x0000000074192000-memory.dmpFilesize
16.4MB
-
memory/2580-1-0x00000000720A0000-0x0000000073112000-memory.dmpFilesize
16.4MB
-
memory/2580-2-0x0000000073120000-0x0000000074192000-memory.dmpFilesize
16.4MB
-
memory/2580-3-0x0000000073120000-0x0000000074192000-memory.dmpFilesize
16.4MB