3e2799c991b8db4d7cf6c6b26f70c891e24e85ce094bf421fe400e8deb177e71

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 21:08

Target

roblox-pin-guesser/rblx-pin.exe
Size

17.7MB
MD5

8951881aaf4bad63d87a58590b906008
SHA1

0d3179b17ba748834da070d3ddd4bbb1eb14632f
SHA256

cccb213274e190798f25ce3fd814ec14cbde60ff7007b57881d76050bbabd852
SHA512

e93524cb599e64ecf797f43b76669ebc09ad486fd35527abc4826a873a8cc8f304dda6101e62e7e880301bb0ba274410f35495f615158759e9f1dea7fa66e39e
SSDEEP

393216:aqPnLFXlrjQpDOETgsvfGA+gIUvEWZHBrLp:vPLFXNjQoEezNuZ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1624	rblx-pin.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a523-112.dat	upx
behavioral1/memory/1624-114-0x000007FEF5C90000-0x000007FEF60FE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1624	1444	rblx-pin.exe	30
PID 1444 wrote to memory of 1624	1444	rblx-pin.exe	30
PID 1444 wrote to memory of 1624	1444	rblx-pin.exe	30

C:\Users\Admin\AppData\Local\Temp\roblox-pin-guesser\rblx-pin.exe
"C:\Users\Admin\AppData\Local\Temp\roblox-pin-guesser\rblx-pin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\roblox-pin-guesser\rblx-pin.exe
  "C:\Users\Admin\AppData\Local\Temp\roblox-pin-guesser\rblx-pin.exe"
  2⤵
  - Loads dropped DLL
  PID:1624

C:\Users\Admin\AppData\Local\Temp\_MEI14442\python310.dll

Filesize
1.4MB

MD5
69d4f13fbaeee9b551c2d9a4a94d4458

SHA1
69540d8dfc0ee299a7ff6585018c7db0662aa629

SHA256
801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

SHA512
8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

Download Submit
memory/1624-114-0x000007FEF5C90000-0x000007FEF60FE000-memory.dmp

Filesize
4.4MB

Download