cc3fbfa0fa74fbc726e44e82698122ef072faba171c51b65c769b79b359d6790 | Triage

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 22:19

Sharing

Report Analysis Logs

General

Target

$TEMP/UbiKey.dll
Size

53KB
MD5

b89218255384b587056cb1e948c295d5
SHA1

0b13185c5152a221bc69cf27bccdc8cc9aeb1c7a
SHA256

03810ba96b08824141ef982dcdb76c42ef8bd7f91c852ff26120a0b82fba99cb
SHA512

48b181547448507c39465942ded6d18da9ff318fbc3abff042d18f70043a471050546b3e0b387b5d689e69baec5a027fb234c935d3068eeee867dc7d4a8b857f
SSDEEP

768:ILcTKhfunFddZJP+OrMnnPFi06LI5NgW3hqFW:LTKoF1JPlrMnnPw0wW3hq8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5036	2112	WerFault.exe	67

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 2112	4960	rundll32.exe	67
PID 4960 wrote to memory of 2112	4960	rundll32.exe	67
PID 4960 wrote to memory of 2112	4960	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\UbiKey.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\UbiKey.dll,#1
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 632
    3⤵
    - Program crash
    PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2112 -ip 2112
1⤵
PID:228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads