180b76c60983cedb631488578eb781a3783e25e39a68bc4c2bdeeec7fa70d52e

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24/10/2023, 15:35

Target

Roblox-2.597.663-hyperion-secured-.exe
Size

76.4MB
MD5

ad594652ababfacfbbeb1f7ce9366302
SHA1

b935b3b0723006b0409d7af8af268dc16c5b8f83
SHA256

180b76c60983cedb631488578eb781a3783e25e39a68bc4c2bdeeec7fa70d52e
SHA512

1f2e9f49762a85a24ab1acedd4d85ec88a06ace0454569287ebc06ca10eea6e0c014e2fa45b19cdc096b0c1b2ee4b9446dd6c6e3c45d103834ae026422bd3a25
SSDEEP

1572864:h2MTiQYHRLpqSk8IpG7V+VPhq2+OME7D5+HpuWlXxTa9k4VPIOWBaUbBpIUTD:hZTixx4SkB05aw2+OpIJ93Ty9VPVOaUZ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2712	Roblox-2.597.663-hyperion-secured-.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001ccf4-1247.dat	upx
behavioral1/files/0x000400000001ccf4-1248.dat	upx
behavioral1/memory/2712-1249-0x000007FEF6160000-0x000007FEF6749000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2712	2068	Roblox-2.597.663-hyperion-secured-.exe	28
PID 2068 wrote to memory of 2712	2068	Roblox-2.597.663-hyperion-secured-.exe	28
PID 2068 wrote to memory of 2712	2068	Roblox-2.597.663-hyperion-secured-.exe	28

C:\Users\Admin\AppData\Local\Temp\Roblox-2.597.663-hyperion-secured-.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox-2.597.663-hyperion-secured-.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\Roblox-2.597.663-hyperion-secured-.exe
  "C:\Users\Admin\AppData\Local\Temp\Roblox-2.597.663-hyperion-secured-.exe"
  2⤵
  - Loads dropped DLL
  PID:2712

C:\Users\Admin\AppData\Local\Temp\_MEI20682\python311.dll

Filesize
1.6MB

MD5
0b66c50e563d74188a1e96d6617261e8

SHA1
cfd778b3794b4938e584078cbfac0747a8916d9e

SHA256
02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

SHA512
37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20682\python311.dll

Filesize
1.6MB

MD5
0b66c50e563d74188a1e96d6617261e8

SHA1
cfd778b3794b4938e584078cbfac0747a8916d9e

SHA256
02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

SHA512
37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

Download Submit
memory/2712-1249-0x000007FEF6160000-0x000007FEF6749000-memory.dmp

Filesize
5.9MB

Download