7f1f1eec4f8ed6b7cfd9e6ff5d4f12df88ebc2cf64bbca12dec72da570b5b55a

Analysis

max time kernel
83s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 15:24

Target

RoShade.Installer.exe
Size

5.8MB
MD5

a009d18ad6b1ad27d3bfe34af2523c89
SHA1

efe133b7259a700a1c838af989468ab65df1ca7b
SHA256

be59ff484a7fa035caee41f9c6c70572250960f09768818b7cf9256013e2a007
SHA512

9b33219a9b98eaa55a347cdd3a231e36c63d83653e2cda39cea36c3e4ffa1e4b45e317f4b15ceeb3c5a8933a996ace45fe3dc0524e1ab383a59df65126de5c38
SSDEEP

98304:LimDSuXXOa7RHtJQi9UWvGfqD8WOxfmjaa15uXaDvdCK/blzFS03iw7FwXR6n3eX:LimDZtRHvUWvozWOxu9kXwvdbDlA03N4

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2788	RoShade.Installer.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4bf-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2788	2320	RoShade.Installer.exe	29
PID 2320 wrote to memory of 2788	2320	RoShade.Installer.exe	29
PID 2320 wrote to memory of 2788	2320	RoShade.Installer.exe	29

C:\Users\Admin\AppData\Local\Temp\RoShade.Installer.exe
"C:\Users\Admin\AppData\Local\Temp\RoShade.Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\RoShade.Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\RoShade.Installer.exe"
  2⤵
  - Loads dropped DLL
  PID:2788

C:\Users\Admin\AppData\Local\Temp\_MEI23202\python310.dll

Filesize
1.4MB

MD5
b3ae142a88ff3760a852ba7facb901bc

SHA1
ad23e5f2f0cc6415086d8c8273c356d35fa4e3ee

SHA256
2291ce67c4be953a0b7c56d790b6cc8075ec8166b1b2e05d71f684c59fdd91a5

SHA512
3b60b8b7197079d629d01440ed78a589c6a18803cc63cdeac1382dc76201767f18190e694d2c1839a72f6318e39dba6217c48a130903f72e47fa1db504810c1c

Download Submit
memory/2788-23-0x000007FEF6070000-0x000007FEF64DA000-memory.dmp

Filesize
4.4MB

Download