cc3fbfa0fa74fbc726e44e82698122ef072faba171c51b65c769b79b359d6790

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 22:19

Target

$TEMP/UbikeyCrypto.dll
Size

179KB
MD5

08a32163969c7064660bcba94ead2b8b
SHA1

0c6c9d81b0612722d82e76adc3044bc905ef7db6
SHA256

dffaba416506c6691fb12a70423ef5f8b4395fdce3b522a143c9d801ecb6d327
SHA512

63d2b214078ca25c28dcf8004bf121a02d931e7c523243bf7b827f4b5d15ef0e9425abcbfe6ed78c8ca88e240f623521c4e0fc744099ecdb4cb05ba21dadcfb3
SSDEEP

3072:BcYJcuTLE6TROpLh4zZpYOKGesIbcA4pOkPUL5jZHnGkiBoPkm5nlGwpaCwpdz8Z:OYJcuTLE6YkzZ2bJZmkuoXl5pfS1PNU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 1276	244	rundll32.exe	86
PID 244 wrote to memory of 1276	244	rundll32.exe	86
PID 244 wrote to memory of 1276	244	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\UbikeyCrypto.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\UbikeyCrypto.dll,#1
  2⤵
  PID:1276