0d4b0737001b931a214fc447adf75836aca3ca69d2929510a424fee7f619dd23

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
30-10-2023 09:26

Target

Mount and Blade II Bannerlord Early Access Plus 33 Trainer Updated 2021.12.15.exe
Size

1.3MB
MD5

9d46046e8e10f24ff6df4cfc5888da51
SHA1

3633c2a6a71055280338df9608de072546811d35
SHA256

169bded3a2e34ecb9a8a8e7dc565d7171eae39dce8c851815e3c1ffcd266e510
SHA512

24012658b195d0c1887064aaac7a19fe6f64c2553487e466aec214161b160f268aae51973e1ae44b1d56b4ad75a98b6c298ff05b25d2b9932394a3ac2598bb31
SSDEEP

24576:dbxGRIUx2m+IPEq1HmlUlNOi680Jlc/bJ7MiYoDS43:dICAn+IseLPMoV71

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1192	Mount and Blade II Bannerlord Early Access Plus 33 Trainer Updated 2021.12.15.exe
1192	Mount and Blade II Bannerlord Early Access Plus 33 Trainer Updated 2021.12.15.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1192	Mount and Blade II Bannerlord Early Access Plus 33 Trainer Updated 2021.12.15.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2760	1192	Mount and Blade II Bannerlord Early Access Plus 33 Trainer Updated 2021.12.15.exe	28
PID 1192 wrote to memory of 2760	1192	Mount and Blade II Bannerlord Early Access Plus 33 Trainer Updated 2021.12.15.exe	28
PID 1192 wrote to memory of 2760	1192	Mount and Blade II Bannerlord Early Access Plus 33 Trainer Updated 2021.12.15.exe	28

C:\Users\Admin\AppData\Local\Temp\Mount and Blade II Bannerlord Early Access Plus 33 Trainer Updated 2021.12.15.exe
"C:\Users\Admin\AppData\Local\Temp\Mount and Blade II Bannerlord Early Access Plus 33 Trainer Updated 2021.12.15.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1192 -s 828
  2⤵
  PID:2760

memory/1192-0-0x0000000000340000-0x0000000000372000-memory.dmp

Filesize
200KB

Download
memory/1192-2-0x000000001AE90000-0x000000001AF10000-memory.dmp

Filesize
512KB

Download
memory/1192-1-0x000007FEF5A50000-0x000007FEF643C000-memory.dmp

Filesize
9.9MB

Download
memory/1192-3-0x000000001AE90000-0x000000001AF10000-memory.dmp

Filesize
512KB

Download
memory/1192-4-0x000000001AE90000-0x000000001AF10000-memory.dmp

Filesize
512KB

Download
memory/1192-8-0x000000001AE90000-0x000000001AF10000-memory.dmp

Filesize
512KB

Download
memory/1192-9-0x000007FEF5A50000-0x000007FEF643C000-memory.dmp

Filesize
9.9MB

Download
memory/1192-10-0x000000001AE90000-0x000000001AF10000-memory.dmp

Filesize
512KB

Download