388ff43a15d5094c7492af213e581133595439649099b1fefcba105deaac931d

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 11:26

Target

Iron Harvest v1.0 Plus 14 Trainer.exe
Size

1.5MB
MD5

36dbf31ebeb91a14647a90b41787c797
SHA1

684bc40f4530b2a79dee90548f924ad05d19dc01
SHA256

78418a50586f48abe84c38b627c0648299ca214623a70d4746c4317227b3c7c4
SHA512

4f2f5cca8d38d9f2d01d13972a1738b93979c673a493814e2e6fbed932b72c72b5366bbbd5607065a290ce9ade491c31f5f003310f8347a5cd5431ae0fbd6d59
SSDEEP

24576:3EJoeuu0atzfh9byZAivEhSyi2eHt+91rgLITZw6bJ7F2xDSN:3La1PbsAaE3ixt+4GnV7F2

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2972	Iron Harvest v1.0 Plus 14 Trainer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	Iron Harvest v1.0 Plus 14 Trainer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1752	2972	Iron Harvest v1.0 Plus 14 Trainer.exe	29
PID 2972 wrote to memory of 1752	2972	Iron Harvest v1.0 Plus 14 Trainer.exe	29
PID 2972 wrote to memory of 1752	2972	Iron Harvest v1.0 Plus 14 Trainer.exe	29

C:\Users\Admin\AppData\Local\Temp\Iron Harvest v1.0 Plus 14 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Iron Harvest v1.0 Plus 14 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2972 -s 824
  2⤵
  PID:1752

memory/2972-0-0x000007FEF5813000-0x000007FEF5814000-memory.dmp

Filesize
4KB

Download
memory/2972-1-0x0000000000150000-0x0000000000182000-memory.dmp

Filesize
200KB

Download
memory/2972-2-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download
memory/2972-3-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download
memory/2972-4-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download
memory/2972-7-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download
memory/2972-9-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download
memory/2972-10-0x000007FEF5813000-0x000007FEF5814000-memory.dmp

Filesize
4KB

Download
memory/2972-11-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download