e4a8dc5c1d78a6721b7d3bd4678bd921d41f36618902a78e5634badaaa194fca | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 04:25

Sharing

Report Analysis Logs

General

Target

Roblox.exe
Size

17.0MB
MD5

cdb735f997ef92e7abb6a2538043dda1
SHA1

576d910e9b80ea127082353eb6418816e9f42e19
SHA256

e4a8dc5c1d78a6721b7d3bd4678bd921d41f36618902a78e5634badaaa194fca
SHA512

c315479c538688d5eaa2f57ee04f84eb51bba1d36dd63073c13c7f49e3ec2b53f3275b57d365128ba0c26a25046b7c91f17135581c6da782aee5ed0662141f44
SSDEEP

393216:uQts9Y2pYDfDllpfaMPg5Rt81zd0zdCU:uQts9Y2abhHf9Pg5fGP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2912	Roblox.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2912	1884	Roblox.exe	30
PID 1884 wrote to memory of 2912	1884	Roblox.exe	30
PID 1884 wrote to memory of 2912	1884	Roblox.exe	30

C:\Users\Admin\AppData\Local\Temp\Roblox.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\Roblox.exe
  "C:\Users\Admin\AppData\Local\Temp\Roblox.exe"
  2⤵
  - Loads dropped DLL
  PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI18842\python311.dll

Filesize
5.5MB

MD5
e2bd5ae53427f193b42d64b8e9bf1943

SHA1
7c317aad8e2b24c08d3b8b3fba16dd537411727f

SHA256
c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400

SHA512
ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036

Download Submit