4be2c63555712f390614c39f5ca3b88e5d3e05475add86c12a42f025f4abacdd | Triage

Analysis

max time kernel
123s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 03:45

Sharing

Report Analysis Logs

General

Target

Lunar Client Qt.exe
Size

627KB
MD5

f4de80d977101d869b4e9e0272139df5
SHA1

89b12b883d26954de6141306520c4555585c7d83
SHA256

4be2c63555712f390614c39f5ca3b88e5d3e05475add86c12a42f025f4abacdd
SHA512

e7aa7332b0da45fe1a3a9d5816363925645ab71df653d6c87b243c36aee30ba6d2ee48804480e4d96994651791471be2ce1c7b429bbdc236a698f582fe638d9d
SSDEEP

12288:tgl7XuTdurj0K8FgFTRme1RuHmITrgdXc0g8:tgxk00K8FgFTceO5Tro

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 3832	3772	Lunar Client Qt.exe	87
PID 3772 wrote to memory of 3832	3772	Lunar Client Qt.exe	87

C:\Users\Admin\AppData\Local\Temp\Lunar Client Qt.exe
"C:\Users\Admin\AppData\Local\Temp\Lunar Client Qt.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c pause
  2⤵
  PID:3832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads