5c9817ba350156d0419beeb0005602ddce2d8b5b5d76f6b91d118b1b098df693 | Triage

Analysis

max time kernel
30s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2023, 00:15

Sharing

Report Analysis Logs

General

Target

RobloxPlayerBeta.exe
Size

57.9MB
MD5

bd4ff82af6ba0e876bebc0d41109c6cf
SHA1

ae61819bc5c27802583cad5bf9ef512b0dd131f4
SHA256

5c9817ba350156d0419beeb0005602ddce2d8b5b5d76f6b91d118b1b098df693
SHA512

2649fa51db1804efe0bae006a712d1a7fcd5b002dd3c663f68629ce389c1661fd9fd018b6f3797ce2961b526855a796c8aad95879f794f4debaa94fb8715d9f0
SSDEEP

1572864:sLd6awt8AQjM6EfLG1eX5iDprYSjb+xMzJ9IN5Yy4Z:i1eX5iDpLVTuP4Z

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4808	4844	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4844	RobloxPlayerBeta.exe
4844	RobloxPlayerBeta.exe
4844	RobloxPlayerBeta.exe
4844	RobloxPlayerBeta.exe

C:\Users\Admin\AppData\Local\Temp\RobloxPlayerBeta.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerBeta.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 896
  2⤵
  - Program crash
  PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4844 -ip 4844
1⤵
PID:4216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4844-132-0x00000000001D0000-0x0000000005925000-memory.dmp

Filesize
87.3MB

Download
memory/4844-135-0x00000000001D0000-0x0000000005925000-memory.dmp

Filesize
87.3MB

Download