65e54bf481a524882973065280be9dc5bd057fe3f8bb9abeea8a74d9d1abe418

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22/07/2023, 15:21

Target

LC 1.3.1/Lunar Client Qt 1.3.1/Qt5Gui.dll
Size

9.2MB
MD5

fc7d92feb89f055f7f19169e7a1f3621
SHA1

5a0f1b5fa82f419020fb38010340032971495dcd
SHA256

8bcf807aaf2419843a778994187fa4a2fe9e2d926435ed8add3e670935b3f9aa
SHA512

e97dbc3afc7875dd753c10804aa1c98abc6462f4a295ef88f9f96292a620d607f8d67fb3172a4eca72664f7c0e928e2709dfff42586f516c4ba3567fa4a334e0
SSDEEP

98304:4jXCr0pPxu7Ve0VW0I4UZYS437MU1MXUDyfK:Oyr0pv0VW0qYDLMUX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	1672	WerFault.exe	5

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1976	1672	rundll32.exe	28
PID 1672 wrote to memory of 1976	1672	rundll32.exe	28
PID 1672 wrote to memory of 1976	1672	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\LC 1.3.1\Lunar Client Qt 1.3.1\Qt5Gui.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1672 -s 228
  2⤵
  - Program crash
  PID:1976

memory/1672-54-0x0000000061940000-0x0000000062012000-memory.dmp

Filesize
6.8MB

Download
memory/1672-55-0x0000000061940000-0x0000000062012000-memory.dmp

Filesize
6.8MB

Download
memory/1672-57-0x000007FEFB330000-0x000007FEFB346000-memory.dmp

Filesize
88KB

Download
memory/1672-56-0x000007FEF7BD0000-0x000007FEF7BF2000-memory.dmp

Filesize
136KB

Download
memory/1672-58-0x000007FEF5DB0000-0x000007FEF5FA3000-memory.dmp

Filesize
1.9MB

Download
memory/1672-59-0x0000000068880000-0x0000000068EB9000-memory.dmp

Filesize
6.2MB

Download