48d75213df96f594a6d84b0c9346338d7569ff5a9558174998dca5f2f43919af | Triage

Analysis

max time kernel
140s
max time network
265s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2024 23:00

Sharing

Report Analysis Logs

General

Target

OFFICE2016/admin/octca.dll
Size

124KB
MD5

8362426e1c47489ab141db1f52e2e4b6
SHA1

1a4f7eb0d3f9f0ea74b477f75bbb7fc07f83f7e5
SHA256

fba05af9a65969f28d0d02fe01feb0af432c9eea38e00e33cfd4676a2ec5a43e
SHA512

47fe87a1674fdca65deffbc3b29b2c0642351e26f17b370912f216e29daaedab7140b3ef830616cc43426acda1c58669f170ecb2811a503c3fed5efe13370ce5
SSDEEP

3072:gpjd7gDeiv4uMfoVszU0FyvX62NFVlAYl8L4ZzP:OgDexuEzU0Sl1g4ZD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 836 wrote to memory of 5112	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 5112	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 5112	836	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OFFICE2016\admin\octca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OFFICE2016\admin\octca.dll,#1
2⤵
PID:5112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...