ff3afd8eb7622bca8ea7fe7eb01daa3d0c93150d2ef0780a3d97ba674390ee97 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 10:53

Sharing

Report Analysis Logs

General

Target

luyou/lycore.dll
Size

80KB
MD5

21fa8bcce5de0c2d53cf78dc486ef303
SHA1

b390153ffea3470bf16538ed2604e20e26a0c297
SHA256

28832f6a1ade188be6c77346efeb550f9086cb47db4f5796a00c9747793996e5
SHA512

0a65ff344988bc17053c28dc552872cd1fe8bad614d60dc2893a0202adef6440ed9c7461536a403d00cae50bc79898829c3b586e4a09b9cee9ae56bbcaa8fe4d
SSDEEP

1536:N50ZBrzLdrQ2YaMbWSkakq+NGxjqlgt5Z54LW:NSZJXdrQyMsq+kxjqgt5aW

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1144	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 1144	340	rundll32.exe	28
PID 340 wrote to memory of 1144	340	rundll32.exe	28
PID 340 wrote to memory of 1144	340	rundll32.exe	28
PID 340 wrote to memory of 1144	340	rundll32.exe	28
PID 340 wrote to memory of 1144	340	rundll32.exe	28
PID 340 wrote to memory of 1144	340	rundll32.exe	28
PID 340 wrote to memory of 1144	340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\lycore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\lycore.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1144-0-0x0000000034B80000-0x0000000034B90000-memory.dmp

Filesize
64KB

Download