Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
22/09/2024, 09:58
General
- Target 修改器/Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
- Size 1.6MB
- Sample240922-lzganstdmp
- SHA256 eabc658deece003f4e76ef76fd0932a0a2d91e63725bb11daf07dc7052689b76
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\修改器\Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\修改器\Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3420-0-0x00007FFBD0EF3000-0x00007FFBD0EF5000-memory.dmp
memory/3420-3-0x00000222FB420000-0x00000222FB454000-memory.dmp
memory/3420-6-0x00007FFBD0EF0000-0x00007FFBD19B1000-memory.dmp
memory/3420-7-0x00007FFBD0EF0000-0x00007FFBD19B1000-memory.dmp
memory/3420-8-0x00007FFBD0EF0000-0x00007FFBD19B1000-memory.dmp
memory/3420-9-0x00007FFBD0EF0000-0x00007FFBD19B1000-memory.dmp
memory/3420-10-0x00000222FEE90000-0x00000222FEE98000-memory.dmp
memory/3420-11-0x00000222FEEE0000-0x00000222FEF18000-memory.dmp
memory/3420-12-0x00000222FEEA0000-0x00000222FEEAE000-memory.dmp
memory/3420-13-0x00007FFBD0EF0000-0x00007FFBD19B1000-memory.dmp
memory/3420-26-0x00007FFBD0EF3000-0x00007FFBD0EF5000-memory.dmp
memory/3420-27-0x00007FFBD0EF0000-0x00007FFBD19B1000-memory.dmp
memory/3420-28-0x00007FFBD0EF0000-0x00007FFBD19B1000-memory.dmp
memory/3420-29-0x00007FFBD0EF0000-0x00007FFBD19B1000-memory.dmp
memory/3420-30-0x00007FFBD0EF0000-0x00007FFBD19B1000-memory.dmp