b9c1b9b0080c47159b024c8cdabeac604e66aeec4022a89b120300290ae4a733

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 19:11

Target

RobloxInjector.zip
Size

24.8MB
MD5

139ae6a2e4392f33471bf8d48df3063e
SHA1

43efbb3a695775907f10b11ba39f65d598711d6f
SHA256

b9c1b9b0080c47159b024c8cdabeac604e66aeec4022a89b120300290ae4a733
SHA512

d611e0307091cefbcfd57729634674a783d2c289fe69d6218ad55448c572a59cd4aa9f84763cdcc758f596d924ec5314a1dd2859b38240cee64622197380adbf
SSDEEP

786432:tzVPgXm96ziTA5+DPYWA6mjuPei9z2eXcGQH:tzV0mEziE5+be6mjti/cVH

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

Roblox.exe

pid	Process
2808	Roblox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid	Process
2104	7zFM.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

7zFM.exeRoblox.exeAUDIODG.EXE

description	pid	Process
Token: SeRestorePrivilege	2104	7zFM.exe
Token: 35	2104	7zFM.exe
Token: SeSecurityPrivilege	2104	7zFM.exe
Token: SeSecurityPrivilege	2104	7zFM.exe
Token: SeDebugPrivilege	2808	Roblox.exe
Token: 33	1820	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1820	AUDIODG.EXE
Token: 33	1820	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1820	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7zFM.exe

description	pid	Process	procid_target
PID 2104 wrote to memory of 2808	2104	7zFM.exe	31
PID 2104 wrote to memory of 2808	2104	7zFM.exe	31
PID 2104 wrote to memory of 2808	2104	7zFM.exe	31

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820

memory/2808-12-0x0000000000180000-0x0000000001180000-memory.dmp

Filesize
16.0MB

Download