ff3afd8eb7622bca8ea7fe7eb01daa3d0c93150d2ef0780a3d97ba674390ee97 | Triage

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 10:53

Sharing

Report Analysis Logs

General

Target

luyou/LYUpdater/CheckUpdate.dll
Size

304KB
MD5

100c64b1d83c0a48ca653b15aeb741c5
SHA1

e7e3439e7120e468fa09bfdfe6f8670d90f34a0e
SHA256

9fb945e684a9042b8b4b5e394c318e501a9fa4404167e8813699d4e7e4c31a7d
SHA512

b5d03803a0202c6a38a62ddf07c3572ca56661930425f8af050d5066d06b7ec0e6cd7dd7dce71f7a2512faf33a1f6487b20a786951783c4a5ceadd3a2a5e1a1a
SSDEEP

6144:WwFXR890lUFVU1aq1YOtXkK5j22z/vT3Z:1XR890lIa1aq1YeXkK5j22z/vbZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 2784	4052	rundll32.exe	84
PID 4052 wrote to memory of 2784	4052	rundll32.exe	84
PID 4052 wrote to memory of 2784	4052	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\LYUpdater\CheckUpdate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\LYUpdater\CheckUpdate.dll,#1
  2⤵
  PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads