b6b1b399d94f9d433733d9ad8d7c66d408f64dba49b8ee409d1cae46e6f68460

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 23:16

Target

DOOM Eternal v1.0-v20200625 Plus 19 Trainer.exe
Size

1.3MB
MD5

ec8f0d05cda20a0043a4d541e47a1c72
SHA1

e8530a5023d0b3ec8e28321d92f6dd347935fa2e
SHA256

9b0d5f7bf785507dc57767de320de292bab992bb044639ce2a90f4c203d29b07
SHA512

b1b5133a48dec5fc084bba2cb7630d05988549ac7d25025364fb9c05a073223caca1fdd5989108463bfb1a737c79a865768e73cdb5a334a1f5b2744a641b8431
SSDEEP

24576:3R5B2L6njVJPc7BfSqwGuOb8uIMT3dIQjq8mYLEDSkl3Bx:ELeVJ0VqqltbB3dhjfwl3b

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2792	DOOM Eternal v1.0-v20200625 Plus 19 Trainer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	DOOM Eternal v1.0-v20200625 Plus 19 Trainer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2776	2792	DOOM Eternal v1.0-v20200625 Plus 19 Trainer.exe	28
PID 2792 wrote to memory of 2776	2792	DOOM Eternal v1.0-v20200625 Plus 19 Trainer.exe	28
PID 2792 wrote to memory of 2776	2792	DOOM Eternal v1.0-v20200625 Plus 19 Trainer.exe	28

C:\Users\Admin\AppData\Local\Temp\DOOM Eternal v1.0-v20200625 Plus 19 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\DOOM Eternal v1.0-v20200625 Plus 19 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2792 -s 844
  2⤵
  PID:2776

memory/2792-0-0x000007FEF5A33000-0x000007FEF5A34000-memory.dmp

Filesize
4KB

Download
memory/2792-1-0x0000000000350000-0x0000000000382000-memory.dmp

Filesize
200KB

Download
memory/2792-2-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2792-3-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2792-4-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2792-7-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2792-9-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2792-10-0x000007FEF5A33000-0x000007FEF5A34000-memory.dmp

Filesize
4KB

Download