Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05-05-2024 03:48

General

  • Target

    v2/Monster Hunter World v20200109-v20200205 Plus 62 Trainer v2.exe

  • Size

    1.9MB

  • MD5

    659dc23806039d40cf31e3f51b58f22d

  • SHA1

    6340aa3ae8716fe8ab9fb0e09df32aef0a57e088

  • SHA256

    bd4997b60aa9eeed5e873c58bb3bfea7bfad350b7d18395b8c70b168cbebbe20

  • SHA512

    817e8f0f0b0bd4f009ae6d649affb4629eff1f599bc063c9ce108678d69029a6e5a712c1917cd2d4e28086d4c85928d9d74b2982f74e5e9b4100fd0bf0404e42

  • SSDEEP

    24576:e48QH2Y50Z3FveltcoxQAm+zncaPECkDtGQjnEd6vVfacwDSfWB:/750J5scgxm+T/kwonPvtac

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\v2\Monster Hunter World v20200109-v20200205 Plus 62 Trainer v2.exe
    "C:\Users\Admin\AppData\Local\Temp\v2\Monster Hunter World v20200109-v20200205 Plus 62 Trainer v2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1956 -s 840
      2⤵
        PID:1996

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1956-0-0x000007FEF5953000-0x000007FEF5954000-memory.dmp

      Filesize

      4KB

    • memory/1956-1-0x0000000001D20000-0x0000000001D52000-memory.dmp

      Filesize

      200KB

    • memory/1956-2-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

      Filesize

      9.9MB

    • memory/1956-3-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

      Filesize

      9.9MB

    • memory/1956-4-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

      Filesize

      9.9MB

    • memory/1956-7-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

      Filesize

      9.9MB

    • memory/1956-9-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

      Filesize

      9.9MB

    • memory/1956-10-0x000007FEF5953000-0x000007FEF5954000-memory.dmp

      Filesize

      4KB