eebd0ef5d59aa4d3212a369b747e185a326b61c766e4e0d1085b1d0c5aaaeffc

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 06:23

Target

The Last Stand Aftermath v1.0 Plus 22 Trainer.exe
Size

1.4MB
MD5

6bb5411a9f60c6058070b3100b235f65
SHA1

dd1cae6e1539a215eaaeb67ea2e8d93d3174f635
SHA256

8b96cd0721a8a2e8c647632fb6aa9ad94b518366edec57ed388f32defd716f37
SHA512

4bbb8bab6aa22908bfe97a2961eccb3fb66ce904386a2480bdeb4995f1b614645a0946fbffebd2519c5f611893f8509cc5b4a8f8630742b5379289a5ce2da57d
SSDEEP

24576:IDyxkhn8MrTUD2FSOPf5gKV0QEKBDSAnZceREWLbJ74A9:bih8MMD2MImK0Q9PnG14V779

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2592	The Last Stand Aftermath v1.0 Plus 22 Trainer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2592	The Last Stand Aftermath v1.0 Plus 22 Trainer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1948	2592	The Last Stand Aftermath v1.0 Plus 22 Trainer.exe	31
PID 2592 wrote to memory of 1948	2592	The Last Stand Aftermath v1.0 Plus 22 Trainer.exe	31
PID 2592 wrote to memory of 1948	2592	The Last Stand Aftermath v1.0 Plus 22 Trainer.exe	31

C:\Users\Admin\AppData\Local\Temp\The Last Stand Aftermath v1.0 Plus 22 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\The Last Stand Aftermath v1.0 Plus 22 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2592 -s 832
  2⤵
  PID:1948

memory/2592-0-0x000007FEF5623000-0x000007FEF5624000-memory.dmp

Filesize
4KB

Download
memory/2592-1-0x0000000001DC0000-0x0000000001DFE000-memory.dmp

Filesize
248KB

Download
memory/2592-2-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/2592-4-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/2592-3-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/2592-5-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/2592-8-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/2592-10-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/2592-11-0x000007FEF5623000-0x000007FEF5624000-memory.dmp

Filesize
4KB

Download
memory/2592-12-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download