dc9d20cd3326273a57777cdcc31ee730988660b6eec9153647646e8cb9882829

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 07:37

Target

Conficker binaries/D9CB288F317124A0E63E3405ED290765.dll
Size

61KB
MD5

d9cb288f317124a0e63e3405ed290765
SHA1

5815b13044fc9248bf7c2dba771f0e6496d9e536
SHA256

bacc62584144981a57516b1bfcb4350d511f2fe89197a7605e3cdff645416dc1
SHA512

540bdca9e84ad7efd968f3eca59a6ccd35fb5f1a6df489b06b199a7d3075e8ba305554579d2a37734a38f33d4e0886797b75d5f34319a851d68add1b180f864b
SSDEEP

1536:oUUmZ6gSi9/wx9+krA3XYVBAV/qNDuVb16yMNk7oPwhkL:o2gg8E53IHS2DsboyMNk7Ewhi

Score

8^/10

upx

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	2012	rundll32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral13/memory/2012-0-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral13/memory/2012-7-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral13/memory/2012-6-0x0000000010000000-0x0000000010018000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qpcsuidv.akx	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\qpcsuidv.akx	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28
PID 2104 wrote to memory of 2012	2104	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\D9CB288F317124A0E63E3405ED290765.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\D9CB288F317124A0E63E3405ED290765.dll",#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  PID:2012

memory/2012-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2012-8-0x0000000000140000-0x000000000015C000-memory.dmp

Filesize
112KB

Download
memory/2012-9-0x0000000000140000-0x000000000015C000-memory.dmp

Filesize
112KB

Download
memory/2012-7-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2012-6-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2012-4-0x0000000000140000-0x000000000015C000-memory.dmp

Filesize
112KB

Download
memory/2012-10-0x0000000000140000-0x000000000015C000-memory.dmp

Filesize
112KB

Download
memory/2012-11-0x0000000000140000-0x000000000015C000-memory.dmp

Filesize
112KB

Download