5515fa3df99d2006fd8a395217ef9e4db1e6df7fb808ae9411efa668ac3a4e5c

Analysis

max time kernel
292s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2023, 03:06

Target

Lunar_Client_Qt_Setup_v2.3.0.exe
Size

6.3MB
MD5

07f4c275536d257ef8b685f144713dfe
SHA1

db8e2eeed5fe8722f0c96ab955daed2c134a78c0
SHA256

5515fa3df99d2006fd8a395217ef9e4db1e6df7fb808ae9411efa668ac3a4e5c
SHA512

12dc8a242c8d7d89f154ea3f779c3609d4cd3647f3cf16eb0fb40d559c9a7e4f6de2b6e11caa0a9168d2b384f610fac70e6f56ac039682baa66f92a3afda39dc
SSDEEP

196608:dmYjaGzeaAh/ADBRCGGKiqTIakX2uS2zt5o9S:VjJaay4OG1HU2uZPo9S

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1904	Lunar_Client_Qt_Setup_v2.3.0.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 1904	5080	Lunar_Client_Qt_Setup_v2.3.0.exe	81
PID 5080 wrote to memory of 1904	5080	Lunar_Client_Qt_Setup_v2.3.0.exe	81
PID 5080 wrote to memory of 1904	5080	Lunar_Client_Qt_Setup_v2.3.0.exe	81

C:\Users\Admin\AppData\Local\Temp\Lunar_Client_Qt_Setup_v2.3.0.exe
"C:\Users\Admin\AppData\Local\Temp\Lunar_Client_Qt_Setup_v2.3.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\is-QT1CE.tmp\Lunar_Client_Qt_Setup_v2.3.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QT1CE.tmp\Lunar_Client_Qt_Setup_v2.3.0.tmp" /SL5="$C0046,5764705,832512,C:\Users\Admin\AppData\Local\Temp\Lunar_Client_Qt_Setup_v2.3.0.exe"
  2⤵
  - Executes dropped EXE
  PID:1904

C:\Users\Admin\AppData\Local\Temp\is-QT1CE.tmp\Lunar_Client_Qt_Setup_v2.3.0.tmp

Filesize
3.1MB

MD5
a248ddfe231c830d460192e4d036b878

SHA1
d32135c7610a6ca1659f90eea8109c0212f7c908

SHA256
7bad23cb948afeac6f4d6a948c18f94372c6cdf954b4554c3d16f7a5c820a08f

SHA512
95e92a74a233bff30916aaea9b9b3894ed313eebf278d10af34bb1cec62e5fb6e2054060f813d0ccf68572b7e0571db90f3f97b3c6cac03dc127bdddea293eb3

Download Submit
memory/1904-139-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/1904-141-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1904-142-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/5080-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5080-140-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download