afc11719f08090f7ecec2b979935d7d3c6c3a9810ec01d2edc18c763d7f02da7 | Triage

Analysis

max time kernel
134s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 12:09

Sharing

Report Analysis Logs

General

Target

OpenForYouyi.dll
Size

2.2MB
MD5

9023e6538859323de03668f0ea5b0543
SHA1

6aa942090213202a2476341e1ea19b530fdc62fe
SHA256

afc11719f08090f7ecec2b979935d7d3c6c3a9810ec01d2edc18c763d7f02da7
SHA512

8d74a876afc183e95bd6f91e2cbc817a89cce519baabd302af17f9e98213147fd0ca480e593b225ae54007a777736367fe6ff67863660a79cd0aa5530dccc313
SSDEEP

24576:OaUk9F7dN9/VQc5xaNHSfcb6/GqOu4vL:Ik9F7dN9/VxPfcbSG9fv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 724	4392	rundll32.exe	83
PID 4392 wrote to memory of 724	4392	rundll32.exe	83
PID 4392 wrote to memory of 724	4392	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OpenForYouyi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\OpenForYouyi.dll,#1
  2⤵
  PID:724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads