7353e3e16cdb6517e4c40371ec89d676e9647db477815cd82f12c666bed9bb6f

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/06/2023, 03:51

Target

rbxfpsunlocker_MS.exe
Size

16.5MB
MD5

b9c1bf922dad24ab74a82431dac10f42
SHA1

0f0ead5c97a52a72c8c0eecb56cde46e3a34cbe4
SHA256

7353e3e16cdb6517e4c40371ec89d676e9647db477815cd82f12c666bed9bb6f
SHA512

f694f9e911e6aedc1508cf7fcd2971d982b15a1db68f867ca68fba3c3d741ab1190c4c245796e37a7f090d8ba9cee5d05aae8e96a926de38857b8e77d79e14c2
SSDEEP

393216:6AIFkLFcQWXGznVPmpFqyYgsST02uEiD:9dFcQJnVPmW98fud

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1604	rbxfpsunlocker_MS.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001871e-155.dat	upx
behavioral1/files/0x000500000001871e-156.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1604	1448	rbxfpsunlocker_MS.exe	27
PID 1448 wrote to memory of 1604	1448	rbxfpsunlocker_MS.exe	27
PID 1448 wrote to memory of 1604	1448	rbxfpsunlocker_MS.exe	27

C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker_MS.exe
"C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker_MS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker_MS.exe
  "C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker_MS.exe"
  2⤵
  - Loads dropped DLL
  PID:1604

C:\Users\Admin\AppData\Local\Temp\_MEI14482\python310.dll

Filesize
1.4MB

MD5
bbcb74867bd3f8a691b1f0a394336908

SHA1
aea4b231b9f09bedcd5ce02e1962911edd4b35ad

SHA256
800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41

SHA512
00745ddd468504b3652bdda757d42ebe756e419d6432ceb029ed3ccde3b99c8ae21b4fc004938bb0babaa169768db385374b29ac121608c5630047e55c40f481

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI14482\python310.dll

Filesize
1.4MB

MD5
bbcb74867bd3f8a691b1f0a394336908

SHA1
aea4b231b9f09bedcd5ce02e1962911edd4b35ad

SHA256
800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41

SHA512
00745ddd468504b3652bdda757d42ebe756e419d6432ceb029ed3ccde3b99c8ae21b4fc004938bb0babaa169768db385374b29ac121608c5630047e55c40f481

Download Submit
memory/1604-157-0x000007FEF5C50000-0x000007FEF60BE000-memory.dmp

Filesize
4.4MB

Download