dc9d20cd3326273a57777cdcc31ee730988660b6eec9153647646e8cb9882829

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 07:37

Target

Conficker binaries/D9CB288F317124A0E63E3405ED290765.dll
Size

61KB
MD5

d9cb288f317124a0e63e3405ed290765
SHA1

5815b13044fc9248bf7c2dba771f0e6496d9e536
SHA256

bacc62584144981a57516b1bfcb4350d511f2fe89197a7605e3cdff645416dc1
SHA512

540bdca9e84ad7efd968f3eca59a6ccd35fb5f1a6df489b06b199a7d3075e8ba305554579d2a37734a38f33d4e0886797b75d5f34319a851d68add1b180f864b
SSDEEP

1536:oUUmZ6gSi9/wx9+krA3XYVBAV/qNDuVb16yMNk7oPwhkL:o2gg8E53IHS2DsboyMNk7Ewhi

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral14/memory/4900-0-0x0000000010000000-0x0000000010018000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3956 wrote to memory of 4900	3956	rundll32.exe	82
PID 3956 wrote to memory of 4900	3956	rundll32.exe	82
PID 3956 wrote to memory of 4900	3956	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\D9CB288F317124A0E63E3405ED290765.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\D9CB288F317124A0E63E3405ED290765.dll",#1
  2⤵
  PID:4900

memory/4900-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/4900-3-0x0000000000D10000-0x0000000000D2C000-memory.dmp

Filesize
112KB

Download
memory/4900-6-0x0000000000D10000-0x0000000000D2C000-memory.dmp

Filesize
112KB

Download
memory/4900-7-0x0000000000D10000-0x0000000000D2C000-memory.dmp

Filesize
112KB

Download
memory/4900-4-0x0000000000D10000-0x0000000000D2C000-memory.dmp

Filesize
112KB

Download