ff3afd8eb7622bca8ea7fe7eb01daa3d0c93150d2ef0780a3d97ba674390ee97 | Triage

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

luyou/lycore.dll
Size

80KB
MD5

21fa8bcce5de0c2d53cf78dc486ef303
SHA1

b390153ffea3470bf16538ed2604e20e26a0c297
SHA256

28832f6a1ade188be6c77346efeb550f9086cb47db4f5796a00c9747793996e5
SHA512

0a65ff344988bc17053c28dc552872cd1fe8bad614d60dc2893a0202adef6440ed9c7461536a403d00cae50bc79898829c3b586e4a09b9cee9ae56bbcaa8fe4d
SSDEEP

1536:N50ZBrzLdrQ2YaMbWSkakq+NGxjqlgt5Z54LW:NSZJXdrQyMsq+kxjqgt5aW

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3784	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3784	2928	rundll32.exe	81
PID 2928 wrote to memory of 3784	2928	rundll32.exe	81
PID 2928 wrote to memory of 3784	2928	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\lycore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\lycore.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3784-0-0x0000000035480000-0x0000000035490000-memory.dmp

Filesize
64KB

Download