ff3afd8eb7622bca8ea7fe7eb01daa3d0c93150d2ef0780a3d97ba674390ee97 | Triage

Analysis

max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 10:53

Sharing

Report Analysis Logs

General

Target

luyou/LYUI.dll
Size

477KB
MD5

791dfb1732f491ba309003725d0555b6
SHA1

1227cfb12eb6e877dd789ba867f7c50decfc5d2f
SHA256

0ac4166a3d1b811ddf66a9ccbf157e2d61cee80c2bf9cc3054d91dfa97ae3ff9
SHA512

43a84bd2c6038b406d910357b8b63538a313f2ddf95beb4f7538c9ab4f78132c2f39346c64a70700295d8fa880eea8227460154da6c962fb12e628d76ba8ae32
SSDEEP

6144:AB8OBX9TpDOdLhf+4NzB8YIBPm6ENDjkq65u4jnQpPvVO1J472X:S8OBtdqzQnUHG5u2QpPW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2168	1068	rundll32.exe	82
PID 1068 wrote to memory of 2168	1068	rundll32.exe	82
PID 1068 wrote to memory of 2168	1068	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\LYUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\LYUI.dll,#1
  2⤵
  PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads