a9ac519ca396e0878eb15b11d7c697bc175f380b00162f4cb351239353747d3a

Resubmissions

10-02-2023 16:09

10-02-2023 16:01

max time kernel
138s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10-02-2023 16:09

Target

Dragon Ball Z Kakarot v1.03-v1.60 Plus 32 Trainer.exe
Size

1.3MB
MD5

5976447d2d9d6aca7e3df4bc0d27bfe7
SHA1

0a137d372e3123713f7c690fa2831de162ae69c8
SHA256

a9ac519ca396e0878eb15b11d7c697bc175f380b00162f4cb351239353747d3a
SHA512

6eca409e1053b23f3affc9d2d7f562ddae0c60de55183ae82b1098c896f7d1b48fa12ed39c96b0f4ca8a06ddd7aae22dbd2003b2389793a702d32528afeefa87
SSDEEP

24576:NkwWyiqAVWAvGNYn3rJ4FJXFtspAyji8GbJ7NDSIWC1:LuVuOnN4oALFV7bWC1

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1112	4840	WerFault.exe	79
1124	4840	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	Dragon Ball Z Kakarot v1.03-v1.60 Plus 32 Trainer.exe

C:\Users\Admin\AppData\Local\Temp\Dragon Ball Z Kakarot v1.03-v1.60 Plus 32 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Dragon Ball Z Kakarot v1.03-v1.60 Plus 32 Trainer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4840
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4840 -s 1164
  2⤵
  - Program crash
  PID:1112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4840 -s 1164
  2⤵
  - Program crash
  PID:1124

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 4840 -ip 4840
1⤵
PID:1592

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 508 -p 4840 -ip 4840
1⤵
PID:828

memory/4840-132-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

Filesize
10.8MB

Download
memory/4840-133-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

Filesize
10.8MB

Download