74d605f499761efb73eb2e3b38b54383bf3c80511984a9908ff8eee23dc66f78

Analysis

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2244	Survivalcraft.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2244	Survivalcraft.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2736	2244	Survivalcraft.exe	30
PID 2244 wrote to memory of 2736	2244	Survivalcraft.exe	30
PID 2244 wrote to memory of 2736	2244	Survivalcraft.exe	30

C:\Users\Admin\AppData\Local\Temp\Survivalcraft.exe
"C:\Users\Admin\AppData\Local\Temp\Survivalcraft.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2244 -s 1704
  2⤵
  PID:2736

memory/2244-0-0x000007FEF55B3000-0x000007FEF55B4000-memory.dmp

Filesize
4KB

Download
memory/2244-1-0x00000000002A0000-0x00000000004C0000-memory.dmp

Filesize
2.1MB

Download
memory/2244-2-0x00000000004C0000-0x0000000000550000-memory.dmp

Filesize
576KB

Download
memory/2244-3-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download
memory/2244-4-0x000000001BBF0000-0x000000001BFC8000-memory.dmp

Filesize
3.8MB

Download
memory/2244-5-0x0000000002330000-0x0000000002346000-memory.dmp

Filesize
88KB

Download
memory/2244-6-0x000000006B600000-0x000000006B65D000-memory.dmp

Filesize
372KB

Download
memory/2244-7-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download