9c00e8dd5a6c9a8d22a4ae2e5a8bdeecf73b7ba6dbe12e787e5e8bf9bbb0c1c9

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 13:21

Reason

Machine shutdown

Target

MinecraftInstaller.exe
Size

32.3MB
MD5

cfd9316537bf9aebd4c98e4939085948
SHA1

2b2e14d098308c0204ab57f4c6abfb230ae19762
SHA256

9c00e8dd5a6c9a8d22a4ae2e5a8bdeecf73b7ba6dbe12e787e5e8bf9bbb0c1c9
SHA512

cb9fd36106b915811bcfaaa4359ac2cdd8caad562f4954b9cc21b09b60111c0fb3d2ce06714d0de5339ca7fd62cc658c494b873f4a7062e309746e6a92552975
SSDEEP

393216:kbekuyo9nMK50UGRXLePuq2ZWy/c5zFviMKe2OHmwv9CsTmsueFFza9y5:/Zn/G4Gqk1cWe2iTVCMue3X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2552	1580	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1580	MinecraftInstaller.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2552	1580	MinecraftInstaller.exe	28
PID 1580 wrote to memory of 2552	1580	MinecraftInstaller.exe	28
PID 1580 wrote to memory of 2552	1580	MinecraftInstaller.exe	28
PID 1580 wrote to memory of 2552	1580	MinecraftInstaller.exe	28

C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 1040
  2⤵
  - Program crash
  PID:2552

memory/1480-7-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1580-0-0x0000000074DF0000-0x00000000754DE000-memory.dmp

Filesize
6.9MB

Download
memory/1580-1-0x0000000001220000-0x000000000327A000-memory.dmp

Filesize
32.4MB

Download
memory/1580-3-0x0000000006D70000-0x0000000006F32000-memory.dmp

Filesize
1.8MB

Download
memory/1580-2-0x00000000069D0000-0x0000000006A10000-memory.dmp

Filesize
256KB

Download
memory/1580-5-0x0000000074DF0000-0x00000000754DE000-memory.dmp

Filesize
6.9MB

Download
memory/2336-6-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download