7e7d03f158fce1f7091aa06129fe42da6fd4c5ddeedd75fdc5490edf3903b6f5

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 22:22

Target

Ro-Booster-FPS.exe
Size

63.6MB
MD5

5d37205de38ba919f946b8f1a6430a7b
SHA1

a812b8aeef11754bd1a2c2b1d1f8ac71246ab519
SHA256

7e7d03f158fce1f7091aa06129fe42da6fd4c5ddeedd75fdc5490edf3903b6f5
SHA512

9ae2d115962698801019568c8b2a9bc47d6bea6f65a756fa64add4e914cfa8a46f62c55bc9988942fa225837b38920e434b5e3b9b0338537540fa2c014044530
SSDEEP

786432:P9AOQm7QqMoknvNpA+vIlo0FdGgrWYjUqPvYAwdLmKvIjjk3ESWqEp+0/pWTf0cM:FAOQcQqMrlpA+Ql4z/nvIswqrSIfa+6

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1584	Ro-Booster-FPS.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000300000002087a-737.dat	upx
behavioral1/memory/1584-739-0x000007FEF6070000-0x000007FEF6658000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 1584	2720	Ro-Booster-FPS.exe	30
PID 2720 wrote to memory of 1584	2720	Ro-Booster-FPS.exe	30
PID 2720 wrote to memory of 1584	2720	Ro-Booster-FPS.exe	30

C:\Users\Admin\AppData\Local\Temp\Ro-Booster-FPS.exe
"C:\Users\Admin\AppData\Local\Temp\Ro-Booster-FPS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\Ro-Booster-FPS.exe
  "C:\Users\Admin\AppData\Local\Temp\Ro-Booster-FPS.exe"
  2⤵
  - Loads dropped DLL
  PID:1584

C:\Users\Admin\AppData\Local\Temp\_MEI27202\python311.dll

Filesize
1.6MB

MD5
4fcf14c7837f8b127156b8a558db0bb2

SHA1
8de2711d00bef7b5f2dcf8a2c6871fa1db67cf1f

SHA256
a67df621a383f4ce5a408e0debe3ebc49ffc766d6a1d6d9a7942120b8ec054dc

SHA512
7a6195495b48f66c35b273a2c9d7ff59e96a4180ea8503f31c8b131167c6cdddd8d6fe77388a34096964a73c85eab504281a14ae3d05350cfee5c51d2491cec8

Download Submit
memory/1584-739-0x000007FEF6070000-0x000007FEF6658000-memory.dmp

Filesize
5.9MB

Download