31c7fe3f77761b871be1b4bb46e58727344da47c579911be2f0a174582c34aa8

Analysis

max time kernel
140s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:20

Target

Path Of Wuxia Early Access Plus 27 Trainer.exe
Size

1.5MB
MD5

599198b40cce117d235f49cf175e3783
SHA1

82dae497a350ecb57b94b9bef6bcf1105eacd40b
SHA256

52ca7daba8db9b6c8fcc3360f78d09a9a2c02f5710cf7565941e1d2f8a590ceb
SHA512

130b153dc9f621c55bb511a9d581232d656d3d107d403436ee2210045c2044bb24f9f024659e67e7424e263f294c67e67e9eb791f8567ed0f630d16b1cd6e82a
SSDEEP

24576:V9WdsQfZG9++mFdcH53I98Hjfppg8mYLvx4hDS:cZa+jnchIOHbv9J4

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	Path Of Wuxia Early Access Plus 27 Trainer.exe

C:\Users\Admin\AppData\Local\Temp\Path Of Wuxia Early Access Plus 27 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Path Of Wuxia Early Access Plus 27 Trainer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:8
1⤵
PID:4540

memory/4292-1-0x00000224E0670000-0x00000224E06A2000-memory.dmp

Filesize
200KB

Download
memory/4292-0-0x00007FFE9C853000-0x00007FFE9C855000-memory.dmp

Filesize
8KB

Download
memory/4292-2-0x00007FFE9C850000-0x00007FFE9D311000-memory.dmp

Filesize
10.8MB

Download
memory/4292-3-0x00007FFE9C850000-0x00007FFE9D311000-memory.dmp

Filesize
10.8MB

Download
memory/4292-4-0x00007FFE9C850000-0x00007FFE9D311000-memory.dmp

Filesize
10.8MB

Download