9bbe8b385ff0c9da8db86ef66211c02cc2e7846527d32dd8f1f5b3474f76c9f4

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 20:02

Target

Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe
Size

1.9MB
MD5

bcb9dae4bdda2912eb45bb07f3745b0c
SHA1

1b0599c8e7b8b3f0467cf4eaf58eab427316eb5d
SHA256

986dadc5b09df3da82129e55f252e2bc77c8df797c9436fa2c60a2f746ddd017
SHA512

f5ae6081e2587e7fb0eb954ca11bf4cb514b5b1ea383bfb4d2036037ef66a41cadf468ba963930ec9539754598ef978ff352fcd00fcaf09fd2bf604237e290fb
SSDEEP

24576:PmhZTgxM7E85AMujElknYcq6ZwP3r1LaPECkDtGQjnEd6vVfaccDSz:Pm9EjPEaOBK/kwonPvtac

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2112	Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2824	2112	Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe	28
PID 2112 wrote to memory of 2824	2112	Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe	28
PID 2112 wrote to memory of 2824	2112	Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe	28

C:\Users\Admin\AppData\Local\Temp\Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Monster Hunter World v20200109-v20200311 Plus 67 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 840
  2⤵
  PID:2824

memory/2112-0-0x0000000000150000-0x0000000000182000-memory.dmp

Filesize
200KB

Download
memory/2112-1-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2112-2-0x0000000002140000-0x00000000021C0000-memory.dmp

Filesize
512KB

Download
memory/2112-3-0x0000000002140000-0x00000000021C0000-memory.dmp

Filesize
512KB

Download
memory/2112-4-0x0000000002140000-0x00000000021C0000-memory.dmp

Filesize
512KB

Download
memory/2112-5-0x0000000002140000-0x00000000021C0000-memory.dmp

Filesize
512KB

Download
memory/2112-9-0x0000000002140000-0x00000000021C0000-memory.dmp

Filesize
512KB

Download
memory/2112-10-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2112-11-0x0000000002140000-0x00000000021C0000-memory.dmp

Filesize
512KB

Download