ff3afd8eb7622bca8ea7fe7eb01daa3d0c93150d2ef0780a3d97ba674390ee97 | Triage

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

luyou/http_net.dll
Size

89KB
MD5

629f361617fe5a04ebba35dbd3932694
SHA1

a01acb45bbfa92984de984e6776e1f9c341725c7
SHA256

df8c12e06f39cfe562adbe41521a9433048bb278be7c4e7970ac8b95ecc52d1e
SHA512

d2eae0410777ced8531336862731bd466444239079ee499e9a43251f6a79118e0eb38661ba38d1c25d75f1d6ea2aa7b53881eac295143d42de5be8554e8eb483
SSDEEP

1536:pDJpUaMKQkjtIvUGclW5sResntQIPcI70CNkgg45OS3qcLC9:p9pUaMk6U7l0sRNvPcIoC7g45OS3qyY

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\log\http_net.log	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2576	2828	rundll32.exe	80
PID 2828 wrote to memory of 2576	2828	rundll32.exe	80
PID 2828 wrote to memory of 2576	2828	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\http_net.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\http_net.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads