180b585699602924e45e46c6ba98ce91964d37f8e10e9859ec14542ecb45762a

Analysis

max time kernel
1562s
max time network
1570s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 16:27

Target

ubiservices.dll
Size

14.8MB
MD5

d06ec93e5877f3f2623ccaa89a349a75
SHA1

a071d570f3af7fd283e99feb95938026eadc3f1a
SHA256

068bc38fa95a55d74470e9df9da71b8106668aaa647619d83a036808f14e6e5b
SHA512

7a3b57a82375835fb14ac735f882c883731ba486025cc1e86b2bb36743e2ad367ffa417f73be7a24585375cbc89ddca876acd9b208e5eebacae78f71aec2d854
SSDEEP

49152:++QTjHVpj56LNzw2Vo/PYfGctqzyf6nPsAAYQDIsPXzqGNXGMi4oY8/wFe5IOXdh:+D+VA/MsjPGRSip1zjFuoe6e

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2496	1504	rundll32.exe	28
PID 1504 wrote to memory of 2496	1504	rundll32.exe	28
PID 1504 wrote to memory of 2496	1504	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ubiservices.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1504 -s 92
  2⤵
  PID:2496