78bc50054731163c989abe13f4e04621271d7a88a6f9dd8763d6aa20f8f3d123

Analysis

max time kernel
64s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2022, 15:26

Target

State of Decay 2 Juggernaut Edition v1.0-v26 Plus 19 Trainer.exe
Size

1.3MB
MD5

96f527b592b2cdbc8ce18f5b5e975004
SHA1

214e2e114655fc23ed59796c9a0c8bb34ed2330c
SHA256

78bc50054731163c989abe13f4e04621271d7a88a6f9dd8763d6aa20f8f3d123
SHA512

c489306c71b93678f36364606f118d6e05f0c26158903d74e83812ff6dc795b72bb948f99f77cb45271f4d18038315a5beb87d165297297c66f4ffd7749b06e0
SSDEEP

24576:UNKQhnPc5FFo8kvWRL0cgfnd5shGBL5vsfbJ7pDSQq:4PA7pkyL0cgfb08sfV7

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2416	2440	WerFault.exe	79
2920	2440	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	State of Decay 2 Juggernaut Edition v1.0-v26 Plus 19 Trainer.exe

C:\Users\Admin\AppData\Local\Temp\State of Decay 2 Juggernaut Edition v1.0-v26 Plus 19 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\State of Decay 2 Juggernaut Edition v1.0-v26 Plus 19 Trainer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2440
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2440 -s 1168
  2⤵
  - Program crash
  PID:2416
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2440 -s 1188
  2⤵
  - Program crash
  PID:2920

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 2440 -ip 2440
1⤵
PID:1996

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 2440 -ip 2440
1⤵
PID:3448

memory/2440-132-0x00007FFAAED70000-0x00007FFAAF831000-memory.dmp

Filesize
10.8MB

Download
memory/2440-133-0x00007FFAAED70000-0x00007FFAAF831000-memory.dmp

Filesize
10.8MB

Download