524753508a50c33f404a87441625e1d9967d0c1a11b31c534e2d60b838fb1589

Analysis

max time kernel
80s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 23:29

Target
cracked_lunar.exe
Size 6.7MB
Sample240608-3gkntaaa3y
SHA256 524753508a50c33f404a87441625e1d9967d0c1a11b31c534e2d60b838fb1589
MD5 a935a661746292c72c43f96a685fb148
SHA1 464e4e832670ced5441b507a85fe79a4bdeb4802
SHA512 68e9a17255eab3ad2ae27442d1921a084c882ec59b6a498fbf3e8ab3e6b06b8c78a9e33871051b5bf9e5c974cf5b381433b1fdfd3b4ba2369ca91269de52bcf3
SSDEEP 196608:Bfv8S5dQmRrdA6ly8Qnf2ODjMnGydS8GSyrDOQWl3:1l5dQOl6F3MnG38GSyrDPY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
1400	cracked_lunar.exe
1400	cracked_lunar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 1400	888	cracked_lunar.exe	92
PID 888 wrote to memory of 1400	888	cracked_lunar.exe	92

C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe
"C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:888
- C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe
  "C:\Users\Admin\AppData\Local\Temp\cracked_lunar.exe"
  2⤵
  - Loads dropped DLL
  PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2700,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:8
1⤵
PID:1848

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8882\VCRUNTIME140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI8882\base_library.zip
Size 1.7MB
SHA256 9e830533f6e67b84d9dbc502db38a6f25d3c984f1a6a195a50f838d48d5b3ba5
MD5 334e5d6e591eccd91d2121194db22815
SHA1 821d70c44dc7f25a784e9938d74e75a3471e1ad0
SHA512 bac4a1283745e5eb4db953227bbf00831c8a0c3c831f5889e0d0630841e59c8ad96c3386ce3ad48300f4754fde188212edc79b78c9c98f76bca21987c1c05866
SSDEEP 24576:6QRqL5TPAxNWlUKdcubgAnj90W0AWfhWrpdYMbP/MdGTKdm64jdfw:6QRqL2xNieTZ46/
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8882\python311.dll
Size 5.5MB
SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
MD5 9a24c8c35e4ac4b1597124c1dcbebe0f
SHA1 f59782a4923a30118b97e01a7f8db69b92d8382a
SHA512 9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b
SSDEEP 98304:JdHwQkq3AAtsPv3XXTVEspHBMp4SsPxQpe2bx:JdHwQkq3AMsPvHXSpAxQpe2V
MD5 SHA1 SHA512 SSDEEP

Submit Download