65e54bf481a524882973065280be9dc5bd057fe3f8bb9abeea8a74d9d1abe418

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22-07-2023 15:21

Target

LC 1.3.1/Lunar Client Qt 1.3.1/libcrypto-1_1-x64.dll
Size

2.7MB
MD5

dcf3de145792e70012a4a5df58ad03d9
SHA1

fc433ba10170c5a22fedaaafbeb0dbd379cfd22e
SHA256

c246b0eac5994f7726689202de782b9f7c88678cf9d19250d481bb437c88fe64
SHA512

3bfb2cbe4fc5b7df782ada6cdf5a40aa1d3c528b06f154559d7de5804d8cebac376699af6489f78d024bbdb26140092b3fce103d857bd7e98d5e0d4b60320184
SSDEEP

49152:zVwAsO8nXHeus0vM6zu/IU6iFveYXpBJLKAmE7sRGtlqb5TNC3h3PDuKPftSw/Fl:0+usisQ+FvTXpBJLK9/5Ter79Sw/F31j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	2148	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2064	2148	rundll32.exe	28
PID 2148 wrote to memory of 2064	2148	rundll32.exe	28
PID 2148 wrote to memory of 2064	2148	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\LC 1.3.1\Lunar Client Qt 1.3.1\libcrypto-1_1-x64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2148 -s 92
  2⤵
  - Program crash
  PID:2064

memory/2148-53-0x000007FEF6480000-0x000007FEF6737000-memory.dmp

Filesize
2.7MB

Download