81830016defdd03ae9756b258ef6fd458bdf657bb4a3aa35d1a00268e2ec19e7

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 12:38

Target

DaysGonev1.0v1.04Plus35Trainer.exe
Size

1.3MB
MD5

d06b29acf88fdcc2f5dd049b2311967b
SHA1

b9910bccd7546409a270f7299d9f1287311d6215
SHA256

81830016defdd03ae9756b258ef6fd458bdf657bb4a3aa35d1a00268e2ec19e7
SHA512

e50a2060e642fb7c823e53758a4ade6a96ea7f44ac8e17757c433b7a9a4dfe39ab39aade1e12773f9b13fb45d30eae0e5bffabb555987dd2c2757178b7788910
SSDEEP

24576:95G91srHmUv5pSTKoGB9pKYW3LGPdXR1r33tVDSDfsbJ7:DHmiTSGoapg36lhtdlV7

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1044	DaysGonev1.0v1.04Plus35Trainer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1044	DaysGonev1.0v1.04Plus35Trainer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2640	1044	DaysGonev1.0v1.04Plus35Trainer.exe	28
PID 1044 wrote to memory of 2640	1044	DaysGonev1.0v1.04Plus35Trainer.exe	28
PID 1044 wrote to memory of 2640	1044	DaysGonev1.0v1.04Plus35Trainer.exe	28

C:\Users\Admin\AppData\Local\Temp\DaysGonev1.0v1.04Plus35Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\DaysGonev1.0v1.04Plus35Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1044 -s 780
  2⤵
  PID:2640

memory/1044-0-0x000007FEF5233000-0x000007FEF5234000-memory.dmp

Filesize
4KB

Download
memory/1044-1-0x0000000001FF0000-0x000000000202E000-memory.dmp

Filesize
248KB

Download
memory/1044-2-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download
memory/1044-3-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download
memory/1044-4-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download
memory/1044-5-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download
memory/1044-8-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download
memory/1044-10-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download
memory/1044-11-0x000007FEF5233000-0x000007FEF5234000-memory.dmp

Filesize
4KB

Download
memory/1044-12-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download