9ccb0bc19f24b694a4129cc387279457e57671f8109937550258ffc40173423b

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04-08-2024 17:36

Target

ubiservices.dll
Size

14.8MB
MD5

d06ec93e5877f3f2623ccaa89a349a75
SHA1

a071d570f3af7fd283e99feb95938026eadc3f1a
SHA256

068bc38fa95a55d74470e9df9da71b8106668aaa647619d83a036808f14e6e5b
SHA512

7a3b57a82375835fb14ac735f882c883731ba486025cc1e86b2bb36743e2ad367ffa417f73be7a24585375cbc89ddca876acd9b208e5eebacae78f71aec2d854
SSDEEP

49152:++QTjHVpj56LNzw2Vo/PYfGctqzyf6nPsAAYQDIsPXzqGNXGMi4oY8/wFe5IOXdh:+D+VA/MsjPGRSip1zjFuoe6e

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2116 wrote to memory of 2512	2116	rundll32.exe	WerFault.exe
PID 2116 wrote to memory of 2512	2116	rundll32.exe	WerFault.exe
PID 2116 wrote to memory of 2512	2116	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ubiservices.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2116 -s 88
  2⤵
  PID:2512