65e54bf481a524882973065280be9dc5bd057fe3f8bb9abeea8a74d9d1abe418

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22/07/2023, 15:21

Target

LC 1.3.1/Lunar Client Qt 1.3.1/libgcc_s_seh-1.dll
Size

105KB
MD5

1130dd2875e1cb8a5df7cbce5103792f
SHA1

eb6af7a8b3c793bd96937b2459ba59e04df0eaa6
SHA256

1c25cb5cab8ad14c1440f1cc0baaafde44e5bde1091597fbeee1ce3a089a259d
SHA512

e162fc20cf553ec0ec1640598a57182be7e37733dbbfab2bfc039ebdb8d8b8a3fd74dfa5915ad0b085d310032f69f44d79cb3f42ada0442046016b70009652a8
SSDEEP

1536:CcQQpjWqbh1sbMl8d4RR68AP4FopvcRJ3n0ubJ6AZg2JSQ+kgj2ZDFwlF2:3gqDsbMedKlNycRh0hAPvgyOlF2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2624	2596	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2624	2596	rundll32.exe	28
PID 2596 wrote to memory of 2624	2596	rundll32.exe	28
PID 2596 wrote to memory of 2624	2596	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\LC 1.3.1\Lunar Client Qt 1.3.1\libgcc_s_seh-1.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2596 -s 84
  2⤵
  - Program crash
  PID:2624

memory/2596-54-0x000007FEF7390000-0x000007FEF73B2000-memory.dmp

Filesize
136KB

Download
memory/2596-55-0x000007FEF7470000-0x000007FEF7486000-memory.dmp

Filesize
88KB

Download