cc3fbfa0fa74fbc726e44e82698122ef072faba171c51b65c769b79b359d6790 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 22:19

Sharing

Report Analysis Logs

General

Target

$TEMP/UbiKey.dll
Size

53KB
MD5

b89218255384b587056cb1e948c295d5
SHA1

0b13185c5152a221bc69cf27bccdc8cc9aeb1c7a
SHA256

03810ba96b08824141ef982dcdb76c42ef8bd7f91c852ff26120a0b82fba99cb
SHA512

48b181547448507c39465942ded6d18da9ff318fbc3abff042d18f70043a471050546b3e0b387b5d689e69baec5a027fb234c935d3068eeee867dc7d4a8b857f
SSDEEP

768:ILcTKhfunFddZJP+OrMnnPFi06LI5NgW3hqFW:LTKoF1JPlrMnnPw0wW3hq8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2628	1672	rundll32.exe	28
PID 1672 wrote to memory of 2628	1672	rundll32.exe	28
PID 1672 wrote to memory of 2628	1672	rundll32.exe	28
PID 1672 wrote to memory of 2628	1672	rundll32.exe	28
PID 1672 wrote to memory of 2628	1672	rundll32.exe	28
PID 1672 wrote to memory of 2628	1672	rundll32.exe	28
PID 1672 wrote to memory of 2628	1672	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\UbiKey.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\UbiKey.dll,#1
  2⤵
  PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads