dc9d20cd3326273a57777cdcc31ee730988660b6eec9153647646e8cb9882829

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 07:37

Target

Conficker binaries/CE18A72735FEB7A315B947DC0986009D.dll
Size

61KB
MD5

ce18a72735feb7a315b947dc0986009d
SHA1

6d2ffc85bf7618d4327bfefdbd3bccffcae96902
SHA256

a8ca6723215da21f66e66723089d64bbdd6e555011f0b287140791c207883a6b
SHA512

f613d8be45b5043c1e30554b23b8b7380e529e70e5a0bb9fffcf10a310c5f4950349574fa7d52ec5dc9bd8330f3cb5ad31f7bd0242f16f96d85d7e3326bca76d
SSDEEP

1536:Ez8Q08yoP+rK1cb/Ow7YtixPGjUb1MHvwfQ:Eg5/j1OPsJOGQ

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral11/memory/2260-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx
behavioral11/memory/2260-2-0x0000000010000000-0x0000000010017000-memory.dmp	upx
behavioral11/memory/2260-1-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\jjmyktsi.ojj	rundll32.exe
File created	C:\Windows\SysWOW64\meawwast.nwa	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\meawwast.nwa	rundll32.exe
File created	C:\Windows\SysWOW64\jjmyktsi.ojj	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2260	1600	rundll32.exe	28
PID 1600 wrote to memory of 2260	1600	rundll32.exe	28
PID 1600 wrote to memory of 2260	1600	rundll32.exe	28
PID 1600 wrote to memory of 2260	1600	rundll32.exe	28
PID 1600 wrote to memory of 2260	1600	rundll32.exe	28
PID 1600 wrote to memory of 2260	1600	rundll32.exe	28
PID 1600 wrote to memory of 2260	1600	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\CE18A72735FEB7A315B947DC0986009D.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\CE18A72735FEB7A315B947DC0986009D.dll",#1
  2⤵
  - Drops file in System32 directory
  PID:2260

C:\Windows\SysWOW64\jjmyktsi.ojj

Filesize
415B

MD5
ebf87808253b9892ef15bdfdbd1b7203

SHA1
50e024777cb712ea0aa45aa7dac2e310d9e539b6

SHA256
4a756dfd83816c8680b9def66eb282d1639436a59d19c5321bd020dd9dc8fda9

SHA512
efe3e1524932b737afe4f31cebdeafd6d10e0fcf3561555e1d5ef303e2a72dadb2d5f92c1bc15f15e27d30e32b2a92234d3a1d4c1ca4cb89893c74042b9628bf

Download Submit
memory/2260-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/2260-2-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/2260-1-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/2260-5-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/2260-6-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/2260-7-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/2260-9-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/2260-10-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/2260-11-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/2260-18-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download