f26b7a4ccbf395693ad089998eb038cb01f22a6b993f670f9bddeea676758440

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-11-2024 19:30

Target

gen steam.roblox/gen-(1).exe
Size

7.4MB
MD5

ccf3d3e9e629990d4dcfa3fec7f3ec1e
SHA1

479f853bf161ddff64a044b486d70e96654c923e
SHA256

f332235072e8ab37ec7c472f04e1d919be8a841cdc7bc3c3a19f1deb0ad2d700
SHA512

83a0458a3ebbf70b26e2e3324c836cc2b82748b2a17e195334b4a31a43ee0c35a288eb2e375cf440564ad9ba78f9d908ff178290354207a004ee98899776863d
SSDEEP

98304:wGSi8TR8WnurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EwKhOh112mY:wBcgurErvI9pWjgfPvzm6gsFEF4fC

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

gen-(1).exe

pid	Process
2396	gen-(1).exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral3/files/0x0005000000019217-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

gen-(1).exe

description	pid	Process	procid_target
PID 1984 wrote to memory of 2396	1984	gen-(1).exe	30
PID 1984 wrote to memory of 2396	1984	gen-(1).exe	30
PID 1984 wrote to memory of 2396	1984	gen-(1).exe	30

C:\Users\Admin\AppData\Local\Temp\gen steam.roblox\gen-(1).exe
"C:\Users\Admin\AppData\Local\Temp\gen steam.roblox\gen-(1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\gen steam.roblox\gen-(1).exe
  "C:\Users\Admin\AppData\Local\Temp\gen steam.roblox\gen-(1).exe"
  2⤵
  - Loads dropped DLL
  PID:2396

C:\Users\Admin\AppData\Local\Temp\_MEI19842\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2396-23-0x000007FEF6200000-0x000007FEF67F2000-memory.dmp

Filesize
5.9MB

Download