45a98498ec64c1209bed4d01207a0a2909ef4ec531d9729ef95244770b8aad50

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 04:21

Target

Roblox Imagination.exe
Size

14.9MB
MD5

3f43df3838ddcc81e8e5857792ad3766
SHA1

960fbad52f95d15bc165c566209575d43c048c48
SHA256

45a98498ec64c1209bed4d01207a0a2909ef4ec531d9729ef95244770b8aad50
SHA512

12f17532d9a79fccc5ae36f3e888c9c0dd6ff03d224d890ad55d64eea47890310b699b47d57f12325e710c32d704bc4f5441d78ffec0c703556d2a5d750c5610
SSDEEP

393216:zYu7L/1/QCdQuslSq9RoWOv+9fgfP5R0ApkV/ue:zYCLt/QCdQuSborvSYv0FV

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2828	Roblox Imagination.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2828	3020	Roblox Imagination.exe	30
PID 3020 wrote to memory of 2828	3020	Roblox Imagination.exe	30
PID 3020 wrote to memory of 2828	3020	Roblox Imagination.exe	30

C:\Users\Admin\AppData\Local\Temp\Roblox Imagination.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox Imagination.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\Roblox Imagination.exe
  "C:\Users\Admin\AppData\Local\Temp\Roblox Imagination.exe"
  2⤵
  - Loads dropped DLL
  PID:2828

C:\Users\Admin\AppData\Local\Temp\_MEI30202\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30202\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit