972745faaa8d8a01eb4eda5eb132ae3204db19ee685c9e889f1a6001f58fb58f

Analysis

max time kernel
164s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:38

Target
FCModInstaller/FC3ModInstaller.exe
Size 207KB
Sample260814-e9k82scq7t
SHA256 972745faaa8d8a01eb4eda5eb132ae3204db19ee685c9e889f1a6001f58fb58f
MD5 80879e98b156204a2e03bba0e1bbf498
SHA1 f7942cbdf8696c53dfabdc84adfa70de42fb021b
SHA512 9f7f6aaf023b9969416bd73f4724e8f7c3e7234f752911eb618b72f80ec8ad37f9a61c15d0baaaeb1c6497938f82a4b80312e8a9d51a7ab3d924d9ce4ce0a8e5
SSDEEP 3072:YUeTAilgOxMzR/YemgAQr0OGi7ktAwTLJdoRw/QqUrPKINEU9pJwEbu:YThIRK/QuwwLJD/bURNEUtG
TLSH
T1E324F11086D440B3F02D053E79906B2CCD7AAAF35B2187E3625FE11EAE7168C5BD9D87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4292	DuniaModInstaller.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	DuniaModInstaller.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4292	DuniaModInstaller.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 4292	3484	FC3ModInstaller.exe	89

C:\Users\Admin\AppData\Local\Temp\FCModInstaller\FC3ModInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\FCModInstaller\FC3ModInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Users\Admin\AppData\Local\Temp\FCModInstaller\bin\DuniaModInstaller.exe
  bin\DuniaModInstaller.exe -game=fc3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4292

2026-08-14.log

Path C:\Users\Admin\AppData\Local\Temp\FCModInstaller\logs\2026-08-14.log
Size 412B
SHA256 c273e143c06d73d9e832363e83a5d72034c55c16f0bc3d77eda680d0133dcab0
MD5 9478c65bceeaa322dcf73e205a910a79
SHA1 bcc62717cf01c6b4c581582740a2c10c54dc6e48
SHA512 d34ad5b4933460ab583409e612dec13ffec717df021ef4ab17b4cfea96ed328a0d9c98cc7329506525e0af70d7fc8206bdfc9f711f10f17bb8a4e7c2c106ba55
TLSH
T11BE08C0C0B254CB53776820E067A0CED813FC905210114FE31BE32C802CC101B1A4847
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4292-0-0x0000016C00220000-0x0000016C00230000-memory.dmp

Download