f64e37b3b56d779c7ff1d203525a5985e5c01f6779e1c2037f1cc13b5d1dc72e

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20-08-2023 13:57

Target

Lunar Client Qt/Qt5Gui.dll
Size

9.2MB
MD5

fc7d92feb89f055f7f19169e7a1f3621
SHA1

5a0f1b5fa82f419020fb38010340032971495dcd
SHA256

8bcf807aaf2419843a778994187fa4a2fe9e2d926435ed8add3e670935b3f9aa
SHA512

e97dbc3afc7875dd753c10804aa1c98abc6462f4a295ef88f9f96292a620d607f8d67fb3172a4eca72664f7c0e928e2709dfff42586f516c4ba3567fa4a334e0
SSDEEP

98304:4jXCr0pPxu7Ve0VW0I4UZYS437MU1MXUDyfK:Oyr0pv0VW0qYDLMUX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2108	2100	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2108	2100	rundll32.exe	28
PID 2100 wrote to memory of 2108	2100	rundll32.exe	28
PID 2100 wrote to memory of 2108	2100	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Lunar Client Qt\Qt5Gui.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2100 -s 228
  2⤵
  - Program crash
  PID:2108

memory/2100-54-0x0000000061940000-0x0000000062012000-memory.dmp

Filesize
6.8MB

Download
memory/2100-55-0x0000000061940000-0x0000000062012000-memory.dmp

Filesize
6.8MB

Download
memory/2100-56-0x000007FEF7F30000-0x000007FEF7F52000-memory.dmp

Filesize
136KB

Download
memory/2100-57-0x000007FEFBD50000-0x000007FEFBD66000-memory.dmp

Filesize
88KB

Download
memory/2100-58-0x000007FEF65D0000-0x000007FEF67C3000-memory.dmp

Filesize
1.9MB

Download
memory/2100-59-0x0000000068880000-0x0000000068EB9000-memory.dmp

Filesize
6.2MB

Download