f25c90364dcb9482249ddaf92ac711f692254870c9fa009a40da87ef43ec7368

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 11:26

Target

Monster Hunter World v20200109-v20200126 Plus 62 Trainer.exe
Size

1.9MB
MD5

27158f4b2c32a0fe60c3cba6e118d7a7
SHA1

964db3cc32ccdca781ca9d1eba4a0312b2a7bc9a
SHA256

31d34bfeeee00043311a21b59914da20d68a4309a5cde46e4f80641c84b4236c
SHA512

951b393f147c208304a5d2d1bbe82f6c59ee1fd162e5cc44b2c67e92e0720713cd6d6ac4238e8575eac8c28fc2dbe4c28b558f1ddc5631eeaf32c8b6cbcbe854
SSDEEP

24576:hI1kgvJ/7yZUA241e0P7hso1LXomqqaisaPECkDtGQjnEd6vVfacRDSfWB:Gx7C/l1rjhy2ai3/kwonPvtac

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1812	Monster Hunter World v20200109-v20200126 Plus 62 Trainer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	Monster Hunter World v20200109-v20200126 Plus 62 Trainer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2012	1812	Monster Hunter World v20200109-v20200126 Plus 62 Trainer.exe	30
PID 1812 wrote to memory of 2012	1812	Monster Hunter World v20200109-v20200126 Plus 62 Trainer.exe	30
PID 1812 wrote to memory of 2012	1812	Monster Hunter World v20200109-v20200126 Plus 62 Trainer.exe	30

C:\Users\Admin\AppData\Local\Temp\Monster Hunter World v20200109-v20200126 Plus 62 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Monster Hunter World v20200109-v20200126 Plus 62 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1812 -s 772
  2⤵
  PID:2012

memory/1812-0-0x000007FEF5C53000-0x000007FEF5C54000-memory.dmp

Filesize
4KB

Download
memory/1812-1-0x0000000000370000-0x00000000003A2000-memory.dmp

Filesize
200KB

Download
memory/1812-2-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/1812-3-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/1812-4-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/1812-5-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/1812-8-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/1812-10-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/1812-11-0x000007FEF5C53000-0x000007FEF5C54000-memory.dmp

Filesize
4KB

Download
memory/1812-12-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download