090aa99d794ed899cb5f21ce2680b5aecd06bba5d78b6054403d3420cff53577

Analysis

max time kernel
64s
max time network
105s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-10-2023 05:08

Target

MinecraftInstaller.exe
Size

32.2MB
MD5

566b6c754863b95983a0e6ed33bcb035
SHA1

86a21825e9b155bbf10503ae6bc72f197a100d4e
SHA256

090aa99d794ed899cb5f21ce2680b5aecd06bba5d78b6054403d3420cff53577
SHA512

392596753d86f66a4e691e87b4c16133914525e34e0550bc84f98610c99154ab9e2e3b5d6a8fe423bc08a54ef4212d97b94f90638760291f6ad77f1d721baac1
SSDEEP

393216:6bekuyo9nMK50UGRXLePuq2ZWy/c5zFviMKe2OHmwv9CsTmsueFFza9y:pZn/G4Gqk1cWe2iTVCMue3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	2176	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	MinecraftInstaller.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2732	2176	MinecraftInstaller.exe	29
PID 2176 wrote to memory of 2732	2176	MinecraftInstaller.exe	29
PID 2176 wrote to memory of 2732	2176	MinecraftInstaller.exe	29
PID 2176 wrote to memory of 2732	2176	MinecraftInstaller.exe	29

C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 1104
  2⤵
  - Program crash
  PID:2732

memory/2176-0-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download
memory/2176-1-0x0000000000010000-0x0000000002052000-memory.dmp

Filesize
32.3MB

Download
memory/2176-2-0x0000000006970000-0x00000000069B0000-memory.dmp

Filesize
256KB

Download
memory/2176-3-0x0000000006FA0000-0x0000000007162000-memory.dmp

Filesize
1.8MB

Download
memory/2176-5-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download
memory/2176-6-0x0000000006970000-0x00000000069B0000-memory.dmp

Filesize
256KB

Download