194e630f2fd9c92859ae610c7556ca6e3d252897ed7a5b3aa664114471fa21a0

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 15:05

Target

Monster Hunter World v20200109-v20200126 Plus 58 Trainer.exe
Size

1.8MB
MD5

3bd2b7347fa78783d97e4c1370895f0c
SHA1

b8d1ed81c03faf5a57cf8ef87a267e593faebdfa
SHA256

37d62cf32275f647d2e5ffd71ce4f19a730b92769d325e9bfda7d78a23d49b63
SHA512

2cbc9a463433bbe56b2942b32201d8a9ee7ce85a25a2d352e42f622ce7295d74ab78de9f3e2529dc6f0f49f404932552bf2b2ae12d0d7350d7c8aa48586d7ab9
SSDEEP

24576:oMs+QByjaXTnVNKHOMHYmlFo5ASuv9+aPECkDtGQjnEdUaxVNDSfWB:w4aDVIHjYmlFSAS29B/kwontar

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Monster Hunter World v20200109-v20200126 Plus 58 Trainer.exe

pid process

2288 Monster Hunter World v20200109-v20200126 Plus 58 Trainer.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Monster Hunter World v20200109-v20200126 Plus 58 Trainer.exe

description pid process

Token: SeDebugPrivilege 2288 Monster Hunter World v20200109-v20200126 Plus 58 Trainer.exe

pid	process
2288	Monster Hunter World v20200109-v20200126 Plus 58 Trainer.exe

description	pid	process
Token: SeDebugPrivilege	2288	Monster Hunter World v20200109-v20200126 Plus 58 Trainer.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Monster Hunter World v20200109-v20200126 Plus 58 Trainer.exe

description	pid	process	target process
PID 2288 wrote to memory of 2628	2288	Monster Hunter World v20200109-v20200126 Plus 58 Trainer.exe	WerFault.exe
PID 2288 wrote to memory of 2628	2288	Monster Hunter World v20200109-v20200126 Plus 58 Trainer.exe	WerFault.exe
PID 2288 wrote to memory of 2628	2288	Monster Hunter World v20200109-v20200126 Plus 58 Trainer.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Monster Hunter World v20200109-v20200126 Plus 58 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Monster Hunter World v20200109-v20200126 Plus 58 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2288 -s 784
  2⤵
  PID:2628

memory/2288-0-0x000007FEF6183000-0x000007FEF6184000-memory.dmp

Filesize
4KB

Download
memory/2288-1-0x0000000000340000-0x0000000000372000-memory.dmp

Filesize
200KB

Download
memory/2288-2-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2288-3-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2288-4-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2288-8-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2288-9-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2288-10-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download