1122cf610bbd39b4bbae11f2e93bcbefb371aa301aac45da7ef7e5f6963ac8f4 | Triage

Resubmissions

03-04-2024 06:34

240403-hb3bfsab7v 3

03-04-2024 06:29

240403-g9cm1sag36 3

03-04-2024 06:18

240403-g2ms1saa5y 3

Analysis

max time kernel
191s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-04-2024 06:18

Sharing

Report Analysis Logs

General

Target

optsatadc.dll
Size

396KB
MD5

df5958459f89d775687190650de4f08b
SHA1

4d3a703db690e975540d6d29cdab2f75fbbcb61c
SHA256

1122cf610bbd39b4bbae11f2e93bcbefb371aa301aac45da7ef7e5f6963ac8f4
SHA512

7c7bacee56cefbf3d44a5fe2c570c2eb12a800402133032419d2886f119fb0a098526f76b73174e9c1537569852a7f7c2a095589e5dc2f8ac1ddb7b832346ea9
SSDEEP

12288:PFFIBSCdHo3p5CJHj9wc3gXERHTYKNviwl:7IBSCdHo3p5C9BwtyHTYMX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2168 wrote to memory of 2580	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2580	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2580	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2580	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2580	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2580	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2580	2168	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\optsatadc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\optsatadc.dll,#1
2⤵
PID:2580

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2580-0-0x0000000073120000-0x0000000074192000-memory.dmp

Filesize
16.4MB

Download
memory/2580-1-0x00000000720A0000-0x0000000073112000-memory.dmp

Filesize
16.4MB

Download
memory/2580-2-0x0000000073120000-0x0000000074192000-memory.dmp

Filesize
16.4MB

Download
memory/2580-3-0x0000000073120000-0x0000000074192000-memory.dmp

Filesize
16.4MB

Download