dc9d20cd3326273a57777cdcc31ee730988660b6eec9153647646e8cb9882829

Analysis

max time kernel
134s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 07:37

Target

Conficker binaries/223D8089F8EE82F8B05266BAECAAC61E.dll
Size

56KB
MD5

223d8089f8ee82f8b05266baecaac61e
SHA1

6ede5f34e8717b470de10e56c99adc7c47307842
SHA256

a3617214a291590239cc686f97ef76841215ab0fd70bf35696e70b8f696a78de
SHA512

48accb32d1bd0f3c43f34518aa6872c3800449589573cc32719a2a0bd9fd4ae7ab07f964f9687eef9480c88e71bbb60c7d24b94a90ababb35df05a993b55eb58
SSDEEP

1536:XIfjT2t7mOV6w9cZHC2m1FfVzxtrx7Z9+DFUf6LnhAWXKj:XI7T01iZeP3Z9ESgKj

Score

8^/10

upx

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
23	2620	rundll32.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral4/memory/2620-0-0x0000000010000000-0x0000000010016000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

rundll32.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\hybxjfrf.rki	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\hybxjfrf.rki	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4808 wrote to memory of 2620	4808	rundll32.exe	83
PID 4808 wrote to memory of 2620	4808	rundll32.exe	83
PID 4808 wrote to memory of 2620	4808	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\223D8089F8EE82F8B05266BAECAAC61E.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Conficker binaries\223D8089F8EE82F8B05266BAECAAC61E.dll",#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  PID:2620

memory/2620-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2620-2-0x0000000000FE0000-0x0000000000FFC000-memory.dmp

Filesize
112KB

Download
memory/2620-3-0x0000000000FE0000-0x0000000000FFC000-memory.dmp

Filesize
112KB

Download
memory/2620-1-0x0000000000FE0000-0x0000000000FFC000-memory.dmp

Filesize
112KB

Download
memory/2620-6-0x0000000000FE0000-0x0000000000FFC000-memory.dmp

Filesize
112KB

Download
memory/2620-7-0x0000000000FE0000-0x0000000000FFC000-memory.dmp

Filesize
112KB

Download
memory/2620-8-0x0000000000FE0000-0x0000000000FFC000-memory.dmp

Filesize
112KB

Download
memory/2620-9-0x0000000000FE0000-0x0000000000FFC000-memory.dmp

Filesize
112KB

Download