c3c090b5f4897bc7cb19e493b0bc528ce4ecbac8a6223c46aa3dc28a15f7f8ea

Analysis

max time kernel
119s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18-10-2023 17:48

Target

Hades v1.0-v1.38 Plus 15 Trainer x64.exe
Size

1.4MB
MD5

d6af8282fe43619a2854dcbb062e5fc5
SHA1

fa2f9972ef8fd64cdbce1764f5846aed1e644973
SHA256

41ce8c8837bc90a3097417346b5e96616a73b34cd00b1d79d90cb9bdeb29c83f
SHA512

db84040f8ee47bc14b00b1690471a1445e09633252894a31116e24b5061450dee687b47e164bdd58f019edaa2b8e233017829b5260d2e0ce7724910f63ba8734
SSDEEP

24576:N9/QSW61N8Lqpgz7R0Ahn5nRQfbJ7MiYPDS/:OeyepURPh5nRQfV7

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1152	Hades v1.0-v1.38 Plus 15 Trainer x64.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	Hades v1.0-v1.38 Plus 15 Trainer x64.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2720	1152	Hades v1.0-v1.38 Plus 15 Trainer x64.exe	27
PID 1152 wrote to memory of 2720	1152	Hades v1.0-v1.38 Plus 15 Trainer x64.exe	27
PID 1152 wrote to memory of 2720	1152	Hades v1.0-v1.38 Plus 15 Trainer x64.exe	27

C:\Users\Admin\AppData\Local\Temp\Hades v1.0-v1.38 Plus 15 Trainer x64.exe
"C:\Users\Admin\AppData\Local\Temp\Hades v1.0-v1.38 Plus 15 Trainer x64.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1152 -s 820
  2⤵
  PID:2720

memory/1152-0-0x0000000000240000-0x0000000000272000-memory.dmp

Filesize
200KB

Download
memory/1152-1-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

Filesize
9.9MB

Download
memory/1152-2-0x000000001AEB0000-0x000000001AF30000-memory.dmp

Filesize
512KB

Download
memory/1152-3-0x000000001AEB0000-0x000000001AF30000-memory.dmp

Filesize
512KB

Download
memory/1152-4-0x000000001AEB0000-0x000000001AF30000-memory.dmp

Filesize
512KB

Download
memory/1152-8-0x000000001AEB0000-0x000000001AF30000-memory.dmp

Filesize
512KB

Download
memory/1152-9-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

Filesize
9.9MB

Download