65e54bf481a524882973065280be9dc5bd057fe3f8bb9abeea8a74d9d1abe418

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22/07/2023, 15:21

Target

LC 1.3.1/Lunar Client Qt 1.3.1/Qt5Network.dll
Size

2.6MB
MD5

94da65cb700658388a9cc3478abee446
SHA1

d6eb041d57a730ca203a00c925281bc112a99fda
SHA256

7660849b5647d0cd1c893fd0f977474df7b968bfae17cec79dbc77359f4e01f3
SHA512

d71046b4a48ee6b085d10131a4bdd77045258685d6d10cff8626e7c5ed1a02218e095dc5e3a63b57868d84ab71b41e1265b7f8cf87fe462c90e8d7ec1248e699
SSDEEP

49152:duOO43/DCdP/4O5WPkryQ/HiCn3Ihf15PA3/ITe:dtFs/dn+hPI/ge

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2552	2564	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2552	2564	rundll32.exe	28
PID 2564 wrote to memory of 2552	2564	rundll32.exe	28
PID 2564 wrote to memory of 2552	2564	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\LC 1.3.1\Lunar Client Qt 1.3.1\Qt5Network.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2564 -s 264
  2⤵
  - Program crash
  PID:2552

memory/2564-53-0x0000000069700000-0x00000000698B2000-memory.dmp

Filesize
1.7MB

Download
memory/2564-54-0x000007FEF6500000-0x000007FEF66F3000-memory.dmp

Filesize
1.9MB

Download
memory/2564-55-0x000007FEFB3F0000-0x000007FEFB412000-memory.dmp

Filesize
136KB

Download
memory/2564-56-0x000007FEFBFB0000-0x000007FEFBFC6000-memory.dmp

Filesize
88KB

Download
memory/2564-57-0x0000000068880000-0x0000000068EB9000-memory.dmp

Filesize
6.2MB

Download