afd25d0b0690efe0e519a962e279c520d9d4f227ce6fe342436ce95373787dc4

Resubmissions

11-02-2024 19:29

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-02-2024 19:29

Target

67 options, mod required/Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe
Size

1.6MB
MD5

d8d04a49a7ebe94d52daa21380c7f981
SHA1

c61619f51bb3ded298be6ff4f37d657c7f4dee88
SHA256

48000c42895041ab94da59597b322a9afeacac40cbd8d7654115df6eaed44708
SHA512

6aa11b73cbfc871ea23ecc136e2585de98ff2989f6ac20a9db8855df0657024990a4f87cf1dc2413fd49e66c8ce57246f7405911e1b24d22e49727a4aae035e0
SSDEEP

24576:zQIQoxsvHM5QR7iv5Drj43MlCEs9jaPECkDtGQjnEdpDS5C:zQWEHfcvaWs9E/kwonQ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2420	Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2572	2420	Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe	28
PID 2420 wrote to memory of 2572	2420	Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe	28
PID 2420 wrote to memory of 2572	2420	Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe	28

C:\Users\Admin\AppData\Local\Temp\67 options, mod required\Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\67 options, mod required\Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2420 -s 788
  2⤵
  PID:2572

memory/2420-0-0x00000000003F0000-0x0000000000422000-memory.dmp

Filesize
200KB

Download
memory/2420-1-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

Filesize
9.9MB

Download
memory/2420-2-0x0000000000150000-0x00000000001D0000-memory.dmp

Filesize
512KB

Download
memory/2420-3-0x0000000000150000-0x00000000001D0000-memory.dmp

Filesize
512KB

Download
memory/2420-4-0x0000000000150000-0x00000000001D0000-memory.dmp

Filesize
512KB

Download
memory/2420-8-0x0000000000150000-0x00000000001D0000-memory.dmp

Filesize
512KB

Download
memory/2420-9-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

Filesize
9.9MB

Download
memory/2420-10-0x0000000000150000-0x00000000001D0000-memory.dmp

Filesize
512KB

Download