ecbe045bf81b35513bc63ebb2da748896b6f367ea3547a71f045682d1b406325 | Triage

Resubmissions

14-05-2023 18:33

230514-w7dvmafb3w 3

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-05-2023 18:33

Sharing

Report Analysis Logs

General

Target

UbitaExploit.exe
Size

223KB
MD5

ee76439a30cb79aca453729cd1bfd9f0
SHA1

005d8e674cd9f0860a6c75a02f171a2f86bbdfcf
SHA256

ecbe045bf81b35513bc63ebb2da748896b6f367ea3547a71f045682d1b406325
SHA512

091723664e2a8d7f76ad6575dbfacf9cd5ea7c268cae8d4c6d47a691020b5796098e8b0ac5a800620ea9a45f64ff1a2524c9198046f6e907f68052d9b5e5e806
SSDEEP

6144:3EDIbMk+2DuTguPGVUTgFGQduAQ4FDGhJz:S2DuTguPBgkQ0A67z

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	2036	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1988	2036	UbitaExploit.exe	28
PID 2036 wrote to memory of 1988	2036	UbitaExploit.exe	28
PID 2036 wrote to memory of 1988	2036	UbitaExploit.exe	28
PID 2036 wrote to memory of 1988	2036	UbitaExploit.exe	28

C:\Users\Admin\AppData\Local\Temp\UbitaExploit.exe
"C:\Users\Admin\AppData\Local\Temp\UbitaExploit.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 628
  2⤵
  - Program crash
  PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-54-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2036-55-0x0000000004640000-0x0000000004680000-memory.dmp

Filesize
256KB

Download