3dd79aae39424af50214505ed41d44df3605f4cd35ee3838535bcbe568c104d7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 13:17

Target

NezurRobloxCheat.exe
Size

5.9MB
MD5

a65d27cf610f1063d6724756c8354caa
SHA1

7556b597904e7520e32384a9ca987492b67cbebd
SHA256

3dd79aae39424af50214505ed41d44df3605f4cd35ee3838535bcbe568c104d7
SHA512

1441fdd3900dc703d3ccea09d04a23bb2c8db2b1bad398a03d6430475fe4420d647244345180b5b1aae0be3ae9dd63ad72f25d8c649021700a98b2a6961f2656
SSDEEP

98304:WzmoDUN43W2SjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6aUOoyAKk:WzumWVOjmFwDRxtYSHdK34kdai7bN3mq

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2116	NezurRobloxCheat.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000195c7-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2116	3028	NezurRobloxCheat.exe	30
PID 3028 wrote to memory of 2116	3028	NezurRobloxCheat.exe	30
PID 3028 wrote to memory of 2116	3028	NezurRobloxCheat.exe	30

C:\Users\Admin\AppData\Local\Temp\NezurRobloxCheat.exe
"C:\Users\Admin\AppData\Local\Temp\NezurRobloxCheat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\NezurRobloxCheat.exe
  "C:\Users\Admin\AppData\Local\Temp\NezurRobloxCheat.exe"
  2⤵
  - Loads dropped DLL
  PID:2116

C:\Users\Admin\AppData\Local\Temp\_MEI30282\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/2116-23-0x000007FEF56E0000-0x000007FEF5B46000-memory.dmp

Filesize
4.4MB

Download