Overview

overview

10

Static

static

10

Baldurs Ga...er.exe

windows7-x64

1

Baldurs Ga...er.exe

windows10-2004-x64

1

Resubmissions

22-03-2024 21:36

240322-1fz11abg7s 10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-03-2024 21:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Baldurs Gate 3 v4.1.1 14 Trainer.exe

  • Size

    1.7MB

  • MD5

    fbc603ac06fd22574c2c3c5ffaf3a813

  • SHA1

    decfc2253e25bb5e267c8fdeca986c21da55940c

  • SHA256

    8ad7d3eeaf4b8271246719b0e548c3e261b00b5dd9bf66ae8f170f7caecbfe9a

  • SHA512

    cba68c96edec52396bda0112ccc510d01c9c933a7af9d865872b98a5cf2d2954c3dc955ee2a5871cadec66ffd08a03cd106d08e172bd6db4314bf1544cac9126

  • SSDEEP

    24576:Tr2BMB027PcmYfOcccMTJ4Gk9v34o7CnG3ICjB5nkTikoUPMMDSVXT5XbyFPPoya:Tr2yqP4o7uG37choUkhXT5Xoo1

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Baldurs Gate 3 v4.1.1 14 Trainer.exe
    "C:\Users\Admin\AppData\Local\Temp\Baldurs Gate 3 v4.1.1 14 Trainer.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4548-0-0x000001DFA5E90000-0x000001DFA5EC4000-memory.dmp

    Filesize

    208KB

    Download

  • memory/4548-1-0x00007FFD6A3A0000-0x00007FFD6AE61000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4548-2-0x000001DFBEA00000-0x000001DFBEA10000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4548-3-0x000001DFBEA00000-0x000001DFBEA10000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4548-4-0x000001DFBE9E0000-0x000001DFBE9E8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/4548-5-0x000001DFC4260000-0x000001DFC4298000-memory.dmp

    Filesize

    224KB

    Download

  • memory/4548-6-0x000001DFC4220000-0x000001DFC422E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4548-21-0x00007FFD6A3A0000-0x00007FFD6AE61000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4548-22-0x000001DFBEA00000-0x000001DFBEA10000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4548-23-0x000001DFBEA00000-0x000001DFBEA10000-memory.dmp

    Filesize

    64KB

    Download