b746e19479039c8bd13f00abcc2211980b82f3cfc3f2f3c87a2c7f493859b86f

Resubmissions

14-07-2024 04:21

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 04:21

Target

Roblox Cheat/installer.exe
Size

537KB
MD5

ebdd0abfd39913aaf11664d6a783202c
SHA1

47dbc17c8c9d98fe6a508df2eb237140f330dec7
SHA256

92d57e1a822b9a90683dbce8686201de189daa25188f1e33248277d8a59b31b2
SHA512

ce529c6fdef4bbf63933bbe41c0177bc58926334c55d66e47ba0aacd31fb4ca025dba4e746c980622b6bc21501acf7e6de63ad6f30de9c82e30b59cf3f5e921e
SSDEEP

6144:tQGkh+2NkT8MwUFNF+g5wAAp+Hb5tATcz6C/kAceTlb1kLdRozzNOgM54cck5AYs:mNkT8Mw4qb+Hbjg+/5n260LX5AQeR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	2504	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1700	2504	installer.exe	30
PID 2504 wrote to memory of 1700	2504	installer.exe	30
PID 2504 wrote to memory of 1700	2504	installer.exe	30
PID 2504 wrote to memory of 1700	2504	installer.exe	30

C:\Users\Admin\AppData\Local\Temp\Roblox Cheat\installer.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox Cheat\installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 112
  2⤵
  - Program crash
  PID:1700

memory/2504-0-0x00000000001F0000-0x000000000024B000-memory.dmp

Filesize
364KB

Download
memory/2504-1-0x00000000001F0000-0x000000000024B000-memory.dmp

Filesize
364KB

Download