4ec7dfe3818d650ed9adc12dc8127adb656bfcb42b779b7a4536502f291ce175

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 04:38

Target

GodofWarv1.0v1.0.2Plus15Trainer.exe
Size

1.4MB
MD5

9faacd1a138c7b8835ef20c59ac21108
SHA1

9d2273ffa0a4feca417aa77745b1c31931d67973
SHA256

4ec7dfe3818d650ed9adc12dc8127adb656bfcb42b779b7a4536502f291ce175
SHA512

14b0e1ad0a9db3f455723215b7467275c944370d18cce691706f8c368fcf806d7d3741af74c383334746239bf8cd7d58ae42c732a59dbb4aac2347c90c4c089a
SSDEEP

24576:bQdnyqwGxVsxD9m02dT4hqJDDfyNYpXDSv5bJ7:WeGHsxxmNEhq9qNYp+V7

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2080	GodofWarv1.0v1.0.2Plus15Trainer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	GodofWarv1.0v1.0.2Plus15Trainer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2960	2080	GodofWarv1.0v1.0.2Plus15Trainer.exe	31
PID 2080 wrote to memory of 2960	2080	GodofWarv1.0v1.0.2Plus15Trainer.exe	31
PID 2080 wrote to memory of 2960	2080	GodofWarv1.0v1.0.2Plus15Trainer.exe	31

C:\Users\Admin\AppData\Local\Temp\GodofWarv1.0v1.0.2Plus15Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\GodofWarv1.0v1.0.2Plus15Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2080 -s 1044
  2⤵
  PID:2960

memory/2080-0-0x000007FEF5963000-0x000007FEF5964000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000000360000-0x000000000039E000-memory.dmp

Filesize
248KB

Download
memory/2080-2-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

Filesize
9.9MB

Download
memory/2080-3-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

Filesize
9.9MB

Download
memory/2080-4-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

Filesize
9.9MB

Download
memory/2080-7-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

Filesize
9.9MB

Download
memory/2080-9-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

Filesize
9.9MB

Download
memory/2080-10-0x000007FEF5963000-0x000007FEF5964000-memory.dmp

Filesize
4KB

Download
memory/2080-11-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

Filesize
9.9MB

Download