Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-08-2023 13:57

General

  • Target

    Lunar Client Qt/Qt5Svg.dll

  • Size

    566KB

  • MD5

    7b80103c5e287dc427a6e9435ab05f35

  • SHA1

    272f90165ff6d440e2d4ce21f69eeb44ac8a5c9b

  • SHA256

    25ad9cf13bbef3b7f7f99c8effc25aedd20dcf8b2455e4b685ebb27d510f9ecc

  • SHA512

    522037c7aa50cbf122d1e11e1b0284afe7b7f77dc6f1fafd89d803816e8ab92a98b8f9a14c2cca45bcc475405f4b6c89ba9da3973572982a903d38fd6bfff2cd

  • SSDEEP

    6144:L/C5POseyOirW00dvVLZfQGWIbZpqLf+sia1FSafmeVdtH5OMavK1qUWKarhiZ0Y:LKEsUirW0YdLub0c9l

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Lunar Client Qt\Qt5Svg.dll",#1
    1⤵
      PID:1332
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 1332 -s 512
        2⤵
        • Program crash
        PID:2308
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 184 -p 1332 -ip 1332
      1⤵
        PID:4268

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1332-133-0x0000000000220000-0x00000000008F2000-memory.dmp

        Filesize

        6.8MB

      • memory/1332-134-0x0000000000220000-0x00000000008F2000-memory.dmp

        Filesize

        6.8MB

      • memory/1332-135-0x0000000067740000-0x0000000067795000-memory.dmp

        Filesize

        340KB

      • memory/1332-136-0x00007FFEC2CB0000-0x00007FFEC2EA3000-memory.dmp

        Filesize

        1.9MB

      • memory/1332-137-0x00007FFECBB40000-0x00007FFECBB62000-memory.dmp

        Filesize

        136KB

      • memory/1332-138-0x00007FFEC7A50000-0x00007FFEC7A66000-memory.dmp

        Filesize

        88KB

      • memory/1332-139-0x0000000061DC0000-0x0000000062345000-memory.dmp

        Filesize

        5.5MB

      • memory/1332-140-0x0000000068880000-0x0000000068EB9000-memory.dmp

        Filesize

        6.2MB

      • memory/1332-141-0x0000000000220000-0x00000000008F2000-memory.dmp

        Filesize

        6.8MB