Analysis
-
max time kernel
25s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 03:47
Behavioral task
behavioral1
Sample
Hollow Knight v1.5.68 Plus 11 Trainer.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Hollow Knight v1.5.68 Plus 11 Trainer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
Hollow Knight v1.5.68 Plus 11 Trainer.exe
-
Size
1.6MB
-
MD5
3134f7f217192edbcf704bf2310af360
-
SHA1
76cd774d5b8cbd291b4ca1cd0b36550ee4a5493e
-
SHA256
139129aca31da8a2adc0a79efbbe9460faf7e24e06e86c3f2b3740aa8cd836b8
-
SHA512
45e60f8c4c57cb7d5cf4fff07ee39a987a49275da9edb0856b82ae44766595aca65fa2bdf1895c54275fd68412950b3e7eddebdf2ff601f5b001f795e1df6ab9
-
SSDEEP
24576:OZpjkFTAE4w4JSSVCiWZwIEkE69peprjcMNnKDSJmJRbJ7mcx:Oq4w8f0iCE69pep8ESfV7mcx
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2372 Hollow Knight v1.5.68 Plus 11 Trainer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2372 Hollow Knight v1.5.68 Plus 11 Trainer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2776 2372 Hollow Knight v1.5.68 Plus 11 Trainer.exe 30 PID 2372 wrote to memory of 2776 2372 Hollow Knight v1.5.68 Plus 11 Trainer.exe 30 PID 2372 wrote to memory of 2776 2372 Hollow Knight v1.5.68 Plus 11 Trainer.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hollow Knight v1.5.68 Plus 11 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\Hollow Knight v1.5.68 Plus 11 Trainer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2372 -s 8322⤵PID:2776
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2720