4be2c63555712f390614c39f5ca3b88e5d3e05475add86c12a42f025f4abacdd | Triage

Analysis

max time kernel
0s
max time network
3s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13-11-2023 03:45

Sharing

Report Analysis Logs

General

Target

Lunar Client Qt.exe
Size

627KB
MD5

f4de80d977101d869b4e9e0272139df5
SHA1

89b12b883d26954de6141306520c4555585c7d83
SHA256

4be2c63555712f390614c39f5ca3b88e5d3e05475add86c12a42f025f4abacdd
SHA512

e7aa7332b0da45fe1a3a9d5816363925645ab71df653d6c87b243c36aee30ba6d2ee48804480e4d96994651791471be2ce1c7b429bbdc236a698f582fe638d9d
SSDEEP

12288:tgl7XuTdurj0K8FgFTRme1RuHmITrgdXc0g8:tgxk00K8FgFTceO5Tro

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2336	2136	Lunar Client Qt.exe	29
PID 2136 wrote to memory of 2336	2136	Lunar Client Qt.exe	29
PID 2136 wrote to memory of 2336	2136	Lunar Client Qt.exe	29

C:\Users\Admin\AppData\Local\Temp\Lunar Client Qt.exe
"C:\Users\Admin\AppData\Local\Temp\Lunar Client Qt.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c pause
  2⤵
  PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads