dc9d20cd3326273a57777cdcc31ee730988660b6eec9153647646e8cb9882829 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 05:39

Sharing

Report Analysis Logs

General

Target

Conficker binaries/D9CB288F317124A0E63E3405ED290765.dll
Size

61KB
MD5

d9cb288f317124a0e63e3405ed290765
SHA1

5815b13044fc9248bf7c2dba771f0e6496d9e536
SHA256

bacc62584144981a57516b1bfcb4350d511f2fe89197a7605e3cdff645416dc1
SHA512

540bdca9e84ad7efd968f3eca59a6ccd35fb5f1a6df489b06b199a7d3075e8ba305554579d2a37734a38f33d4e0886797b75d5f34319a851d68add1b180f864b

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow	pid	Process
4	1464	rundll32.exe
5	1464	rundll32.exe
7	1464	rundll32.exe

Drops file in System32 directory 2 IoCs

Processes:

rundll32.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\yozfpsbm.spj	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\yozfpsbm.spj	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1100 wrote to memory of 1464	1100	rundll32.exe	27
PID 1100 wrote to memory of 1464	1100	rundll32.exe	27
PID 1100 wrote to memory of 1464	1100	rundll32.exe	27
PID 1100 wrote to memory of 1464	1100	rundll32.exe	27
PID 1100 wrote to memory of 1464	1100	rundll32.exe	27
PID 1100 wrote to memory of 1464	1100	rundll32.exe	27
PID 1100 wrote to memory of 1464	1100	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\D9CB288F317124A0E63E3405ED290765.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\D9CB288F317124A0E63E3405ED290765.dll",#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  PID:1464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-54-0x0000000000000000-mapping.dmp

Download
memory/1464-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1464-59-0x0000000000160000-0x000000000017C000-memory.dmp

Filesize
112KB

Download
memory/1464-61-0x0000000000160000-0x000000000017C000-memory.dmp

Filesize
112KB

Download