feddee5718f781bbf5913dd4fe8df6b1168651ad45eb08ba446600168ad0d8ea

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:31

Target

Little Witch Nobeta Early Access Plus 13 Trainer.exe
Size

1.3MB
MD5

3bc3f0fe207dbae4f4fe0a2e8c300a4e
SHA1

85759a013a1135bf452e47e9a282e683a7538993
SHA256

6a2780b68def659a958b7873ea3ebbb792119b5884b77a32d75f5fa2bb24192b
SHA512

3efd615c17721105d69ebbed352dbbe9857575ce2759eded0f4030e0b4e650054967927ea928687246937fb6c74f6b7ad16f0c87f5ccaa66621c6e94d97454bf
SSDEEP

24576:qSpS+y3KJdg/7pfEQaFQ+Rtf3yev8kC+4KFJqsCBh56FuksRDS:qTC/gj1Ta9Rtf3yekk7S5ouks

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Little Witch Nobeta Early Access Plus 13 Trainer.exe

pid	Process
1868	Little Witch Nobeta Early Access Plus 13 Trainer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Little Witch Nobeta Early Access Plus 13 Trainer.exe

description	pid	Process
Token: SeDebugPrivilege	1868	Little Witch Nobeta Early Access Plus 13 Trainer.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Little Witch Nobeta Early Access Plus 13 Trainer.exe

description	pid	Process	procid_target
PID 1868 wrote to memory of 2948	1868	Little Witch Nobeta Early Access Plus 13 Trainer.exe	28
PID 1868 wrote to memory of 2948	1868	Little Witch Nobeta Early Access Plus 13 Trainer.exe	28
PID 1868 wrote to memory of 2948	1868	Little Witch Nobeta Early Access Plus 13 Trainer.exe	28

C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Little Witch Nobeta Early Access Plus 13 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1868 -s 840
  2⤵
  PID:2948

memory/1868-0-0x0000000000340000-0x0000000000372000-memory.dmp

Filesize
200KB

Download
memory/1868-1-0x0000000000340000-0x0000000000372000-memory.dmp

Filesize
200KB

Download
memory/1868-2-0x000007FEF63C0000-0x000007FEF6DAC000-memory.dmp

Filesize
9.9MB

Download
memory/1868-3-0x000000001AF90000-0x000000001B010000-memory.dmp

Filesize
512KB

Download
memory/1868-4-0x000000001AF90000-0x000000001B010000-memory.dmp

Filesize
512KB

Download
memory/1868-5-0x000000001AF90000-0x000000001B010000-memory.dmp

Filesize
512KB

Download
memory/1868-9-0x000000001AF90000-0x000000001B010000-memory.dmp

Filesize
512KB

Download
memory/1868-10-0x000007FEF63C0000-0x000007FEF6DAC000-memory.dmp

Filesize
9.9MB

Download