ff3afd8eb7622bca8ea7fe7eb01daa3d0c93150d2ef0780a3d97ba674390ee97 | Triage

Analysis

max time kernel
124s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 10:53

Sharing

Report Analysis Logs

General

Target

luyou/net_client.dll
Size

51KB
MD5

0de50726408ac05130df4ce8dd952f6e
SHA1

510db4ac4dc6387ea0f75429b659abb3f861fb0b
SHA256

06ec57a91376559835eee5d86b9c2b21acd588bcbbcf4cd5a350ad406fad056e
SHA512

e386795c7f109db091df89158b23ea7d89c0a0b35a24b271d4370216296e17e1bd5b2cb6f209b7e3be2a8f22013dcce93ef1adabc7f8cbeff41ac6f1f4bf59de
SSDEEP

1536:RQMtia2mY+HOT2RlmRJ3sysGZOtSXRo4Li:TLqTPR6yJZOtSXPi

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2280	2256	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 2256	4464	rundll32.exe	89
PID 4464 wrote to memory of 2256	4464	rundll32.exe	89
PID 4464 wrote to memory of 2256	4464	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\net_client.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\net_client.dll,#1
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 664
    3⤵
    - Program crash
    PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2256 -ip 2256
1⤵
PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1292,i,3595107284059830391,18018199024659337217,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
1⤵
PID:4104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads