2d3a7b5239e9e027038c638e624235e904c1c9d333ebbfd3b23bd21e91a49ef7

Analysis

max time kernel
151s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2022 09:32

Target

《怪物猎人：世界》v20200109-v20210602 六十七项修改器[3DM]/Monster Hunter World v2020.exe
Size

1.6MB
MD5

eb3295617d26a4902d2c51fc8ca4c9b7
SHA1

c1cc56cac046678b5373ff473da1560b35cd4ca6
SHA256

f5e0c4f0ef809417d2fcde05fcc037308a323383226169c56912ae401e996bab
SHA512

f3fc1575075da3c875cb80e4d414a161d2c84be00febb7dacdfeab0f783117fd09984a95f5cf5863ccfa60069492a5e0313d183e01febb54b8b630ed3274eb66

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1872	1108	WerFault.exe	81
224	1108	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	Monster Hunter World v2020.exe

C:\Users\Admin\AppData\Local\Temp\《怪物猎人：世界》v20200109-v20210602 六十七项修改器[3DM]\Monster Hunter World v2020.exe
"C:\Users\Admin\AppData\Local\Temp\《怪物猎人：世界》v20200109-v20210602 六十七项修改器[3DM]\Monster Hunter World v2020.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1108
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1108 -s 1168
  2⤵
  - Program crash
  PID:1872
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1108 -s 1168
  2⤵
  - Program crash
  PID:224

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 432 -p 1108 -ip 1108
1⤵
PID:3444

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 516 -p 1108 -ip 1108
1⤵
PID:1444

memory/1108-132-0x00007FFD0A740000-0x00007FFD0B201000-memory.dmp

Filesize
10.8MB

Download
memory/1108-133-0x00007FFD0A740000-0x00007FFD0B201000-memory.dmp

Filesize
10.8MB

Download