27c92fe6c131c4f41f6d524837ba073f396130658c51108f94cb514b7f571dc4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 00:41

Target

$PLUGINSDIR/lyinn.dll
Size

26KB
MD5

b7f9a167c3af210c5a0be8393b9f04e2
SHA1

8e540308abf226139bf08c61fa21598c0eb055da
SHA256

fd6451ef4e817f604a14be5ab85b5e9890a276ba877d38a9b9544c41ed4718a7
SHA512

75a44e8939f23fa143b67fbd664b81758c0718343e7cb3836b5651bd87e0533d03973b34cbb7b03b50a1fb3828fb0ddf93b205f42e0c8198bfb575088dc9b128
SSDEEP

384:CWt7vqwJ2B3uyRZ3rcg3b8WWA5oYjH8T9jwiXaqQUfkysX:1sBBH3I6WS78T5FX5fkv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4760	4800	WerFault.exe	84

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 4800	1180	rundll32.exe	84
PID 1180 wrote to memory of 4800	1180	rundll32.exe	84
PID 1180 wrote to memory of 4800	1180	rundll32.exe	84
PID 4800 wrote to memory of 1792	4800	rundll32.exe	86
PID 4800 wrote to memory of 1792	4800	rundll32.exe	86
PID 4800 wrote to memory of 1792	4800	rundll32.exe	86
PID 4800 wrote to memory of 1792	4800	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\lyinn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\lyinn.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\lyinn.dll,#1
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 732
    3⤵
    - Program crash
    PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4800 -ip 4800
1⤵
PID:4992

memory/4800-0-0x00000000750F0000-0x00000000750FA000-memory.dmp

Filesize
40KB

Download