ff3afd8eb7622bca8ea7fe7eb01daa3d0c93150d2ef0780a3d97ba674390ee97 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 10:53

Sharing

Report Analysis Logs

General

Target

luyou/net_client.dll
Size

51KB
MD5

0de50726408ac05130df4ce8dd952f6e
SHA1

510db4ac4dc6387ea0f75429b659abb3f861fb0b
SHA256

06ec57a91376559835eee5d86b9c2b21acd588bcbbcf4cd5a350ad406fad056e
SHA512

e386795c7f109db091df89158b23ea7d89c0a0b35a24b271d4370216296e17e1bd5b2cb6f209b7e3be2a8f22013dcce93ef1adabc7f8cbeff41ac6f1f4bf59de
SSDEEP

1536:RQMtia2mY+HOT2RlmRJ3sysGZOtSXRo4Li:TLqTPR6yJZOtSXPi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2416	2768	rundll32.exe	28
PID 2768 wrote to memory of 2416	2768	rundll32.exe	28
PID 2768 wrote to memory of 2416	2768	rundll32.exe	28
PID 2768 wrote to memory of 2416	2768	rundll32.exe	28
PID 2768 wrote to memory of 2416	2768	rundll32.exe	28
PID 2768 wrote to memory of 2416	2768	rundll32.exe	28
PID 2768 wrote to memory of 2416	2768	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\net_client.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\net_client.dll,#1
  2⤵
  PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads