afd25d0b0690efe0e519a962e279c520d9d4f227ce6fe342436ce95373787dc4

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-es
resource tags

arch:x64arch:x86image:win7-20231215-eslocale:es-esos:windows7-x64systemwindows
submitted
11-02-2024 20:07

Target

67 options, mod required/Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe
Size

1.6MB
MD5

d8d04a49a7ebe94d52daa21380c7f981
SHA1

c61619f51bb3ded298be6ff4f37d657c7f4dee88
SHA256

48000c42895041ab94da59597b322a9afeacac40cbd8d7654115df6eaed44708
SHA512

6aa11b73cbfc871ea23ecc136e2585de98ff2989f6ac20a9db8855df0657024990a4f87cf1dc2413fd49e66c8ce57246f7405911e1b24d22e49727a4aae035e0
SSDEEP

24576:zQIQoxsvHM5QR7iv5Drj43MlCEs9jaPECkDtGQjnEdpDS5C:zQWEHfcvaWs9E/kwonQ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3044	Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2808	3044	Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe	28
PID 3044 wrote to memory of 2808	3044	Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe	28
PID 3044 wrote to memory of 2808	3044	Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe	28

C:\Users\Admin\AppData\Local\Temp\67 options, mod required\Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\67 options, mod required\Monster Hunter World v20200109-v20201001 Plus 67 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3044 -s 764
  2⤵
  PID:2808

memory/3044-0-0x0000000000140000-0x0000000000172000-memory.dmp

Filesize
200KB

Download
memory/3044-1-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/3044-2-0x000000001B0A0000-0x000000001B120000-memory.dmp

Filesize
512KB

Download
memory/3044-3-0x000000001B0A0000-0x000000001B120000-memory.dmp

Filesize
512KB

Download
memory/3044-4-0x000000001B0A0000-0x000000001B120000-memory.dmp

Filesize
512KB

Download
memory/3044-5-0x000000001B0A0000-0x000000001B120000-memory.dmp

Filesize
512KB

Download
memory/3044-9-0x000000001B0A0000-0x000000001B120000-memory.dmp

Filesize
512KB

Download
memory/3044-10-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/3044-11-0x000000001B0A0000-0x000000001B120000-memory.dmp

Filesize
512KB

Download
memory/3044-12-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download