f64e37b3b56d779c7ff1d203525a5985e5c01f6779e1c2037f1cc13b5d1dc72e

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20-08-2023 13:57

Target

Lunar Client Qt/libcrypto-1_1-x64.dll
Size

2.7MB
MD5

dcf3de145792e70012a4a5df58ad03d9
SHA1

fc433ba10170c5a22fedaaafbeb0dbd379cfd22e
SHA256

c246b0eac5994f7726689202de782b9f7c88678cf9d19250d481bb437c88fe64
SHA512

3bfb2cbe4fc5b7df782ada6cdf5a40aa1d3c528b06f154559d7de5804d8cebac376699af6489f78d024bbdb26140092b3fce103d857bd7e98d5e0d4b60320184
SSDEEP

49152:zVwAsO8nXHeus0vM6zu/IU6iFveYXpBJLKAmE7sRGtlqb5TNC3h3PDuKPftSw/Fl:0+usisQ+FvTXpBJLK9/5Ter79Sw/F31j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	3040	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2668	3040	rundll32.exe	28
PID 3040 wrote to memory of 2668	3040	rundll32.exe	28
PID 3040 wrote to memory of 2668	3040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Lunar Client Qt\libcrypto-1_1-x64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3040 -s 92
  2⤵
  - Program crash
  PID:2668

memory/3040-53-0x000007FEF5E00000-0x000007FEF60B7000-memory.dmp

Filesize
2.7MB

Download