Analysis

  • max time kernel
    42s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 05:39

General

  • Target

    Conficker binaries/CE18A72735FEB7A315B947DC0986009D.dll

  • Size

    61KB

  • MD5

    ce18a72735feb7a315b947dc0986009d

  • SHA1

    6d2ffc85bf7618d4327bfefdbd3bccffcae96902

  • SHA256

    a8ca6723215da21f66e66723089d64bbdd6e555011f0b287140791c207883a6b

  • SHA512

    f613d8be45b5043c1e30554b23b8b7380e529e70e5a0bb9fffcf10a310c5f4950349574fa7d52ec5dc9bd8330f3cb5ad31f7bd0242f16f96d85d7e3326bca76d

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\CE18A72735FEB7A315B947DC0986009D.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\CE18A72735FEB7A315B947DC0986009D.dll",#1
      2⤵
      • Drops file in System32 directory
      PID:908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/908-55-0x0000000075DE1000-0x0000000075DE3000-memory.dmp

    Filesize

    8KB

  • memory/908-59-0x0000000000170000-0x000000000018C000-memory.dmp

    Filesize

    112KB

  • memory/908-61-0x0000000000170000-0x000000000018C000-memory.dmp

    Filesize

    112KB