cc3fbfa0fa74fbc726e44e82698122ef072faba171c51b65c769b79b359d6790 | Triage

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 22:19

Sharing

Report Analysis Logs

General

Target

$TEMP/UbiKeyWin32.dll
Size

57KB
MD5

27ac04ae932f911c29ec56c7e75b7b82
SHA1

342459632c0af7d7142475abb3f82b9269f11a1c
SHA256

743097d53417609448988f4498d05c780feee5d946b20d6ada023d1597864eb8
SHA512

1b233145129b05d2a3650409034825de951e7cfbf3d1f39fcd2debb1e49e916a3f6abbad7d01b424fbc54074e09c3276c48ca648aaac68244ba71ccc6e2dad57
SSDEEP

768:qT7Tpep8j6fWVJ/6L4rMnnPoEgMutIJnNgb3hAj:S7TgpvmJ/60rMnnPLgps+b3hAj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 456	1084	rundll32.exe	85
PID 1084 wrote to memory of 456	1084	rundll32.exe	85
PID 1084 wrote to memory of 456	1084	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\UbiKeyWin32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\UbiKeyWin32.dll,#1
  2⤵
  PID:456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads