0b0c3291f56d3b50b6124eba4df3f38281265391e273798fc59a56ccb8acc9a4

Analysis

Target

Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe
Size

1.6MB
MD5

d8d04a49a7ebe94d52daa21380c7f981
SHA1

c61619f51bb3ded298be6ff4f37d657c7f4dee88
SHA256

48000c42895041ab94da59597b322a9afeacac40cbd8d7654115df6eaed44708
SHA512

6aa11b73cbfc871ea23ecc136e2585de98ff2989f6ac20a9db8855df0657024990a4f87cf1dc2413fd49e66c8ce57246f7405911e1b24d22e49727a4aae035e0

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2032	3568	WerFault.exe	80
3616	3568	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3568	Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe

C:\Users\Admin\AppData\Local\Temp\Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3568
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3568 -s 1168
  2⤵
  - Program crash
  PID:2032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3568 -s 1168
  2⤵
  - Program crash
  PID:3616

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 192 -p 3568 -ip 3568
1⤵
PID:3272

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 3568 -ip 3568
1⤵
PID:2936

memory/3568-130-0x00007FF8A2C80000-0x00007FF8A3741000-memory.dmp

Filesize
10.8MB

Download
memory/3568-131-0x00007FF8A2C80000-0x00007FF8A3741000-memory.dmp

Filesize
10.8MB

Download
memory/3568-132-0x00007FF8A2C80000-0x00007FF8A3741000-memory.dmp

Filesize
10.8MB

Download