4e9bdd8415f7d5dc2d2472501a0f5a60c370a07cfc67c50cbb170db082cd4c6b

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 13:52

Target

Lunar_Client_Qt_Setup_v2.5.0.exe
Size

6.3MB
MD5

fddf771d28749f8cdbf6ee03978f88ae
SHA1

814d83e6eb5106e11621d6739be9560748e7ca35
SHA256

4e9bdd8415f7d5dc2d2472501a0f5a60c370a07cfc67c50cbb170db082cd4c6b
SHA512

258e2789d1e45c81968e6731ffa50b80406f87694616471624be9ab4ae53ba631edfab5a0d503b3403daa554a9fcafe7af88b606d430d5388027a4972423cd80
SSDEEP

196608:dYkk9OuizYS8kArCDqVWlwBoXX2FDSjXkt5o9U:LksuizYS8drCDqVOwB64DPo9U

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2664	Lunar_Client_Qt_Setup_v2.5.0.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 2664	4912	Lunar_Client_Qt_Setup_v2.5.0.exe	80
PID 4912 wrote to memory of 2664	4912	Lunar_Client_Qt_Setup_v2.5.0.exe	80
PID 4912 wrote to memory of 2664	4912	Lunar_Client_Qt_Setup_v2.5.0.exe	80

C:\Users\Admin\AppData\Local\Temp\Lunar_Client_Qt_Setup_v2.5.0.exe
"C:\Users\Admin\AppData\Local\Temp\Lunar_Client_Qt_Setup_v2.5.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\is-5UIC0.tmp\Lunar_Client_Qt_Setup_v2.5.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5UIC0.tmp\Lunar_Client_Qt_Setup_v2.5.0.tmp" /SL5="$70066,5777339,832512,C:\Users\Admin\AppData\Local\Temp\Lunar_Client_Qt_Setup_v2.5.0.exe"
  2⤵
  - Executes dropped EXE
  PID:2664

C:\Users\Admin\AppData\Local\Temp\is-5UIC0.tmp\Lunar_Client_Qt_Setup_v2.5.0.tmp

Filesize
3.1MB

MD5
27d3e69a75ed517c8e0e01c2e159b23d

SHA1
4f99d50b6e035567bf5e62c8d2150f787619b8c6

SHA256
4454f3382377dbca0f804bd611dca0786a1479a04a3832b41fa1d11a4e837722

SHA512
f493e0a544ddcc589752327121fa1dc225adda8bb4d4497999c6762b878221bd2540000695e2e7b637606390c12c6c33335daa487311ee7f36136fc5a3b4bd7d

Download Submit
memory/2664-6-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2664-8-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4912-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4912-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/4912-7-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download