f33f4b5d2ec9e421f0d5b2b9f70b2caef04f24f3188e5198933cbbd3c487daa6

Resubmissions

21/01/2025, 01:54

20/01/2025, 22:23

max time kernel
7s
max time network
1s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/01/2025, 01:54

Target

RoFix.exe
Size

35.5MB
MD5

c685da925e0d4cd81253fc2a862bcacd
SHA1

524fb7ceb23455fba9a1178227df36c63649cd17
SHA256

f33f4b5d2ec9e421f0d5b2b9f70b2caef04f24f3188e5198933cbbd3c487daa6
SHA512

5cd7381fb350037ed0b2fddd6dfc90dfcbb6129fc9ca38435301ecf886b240b61b4f75f48e5f7821c111ce698052eff937a24ec40dd34764a7f68d91e70919ff
SSDEEP

786432:T6VjlxwW8bKLXm1NwO8zcY876MlXRXuBBjWx8vWnWGmVtRJ8rn2k:eVjlCWK2XmwlE71lh+BBy7njQtzMn

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2452	RoFix.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020aed-1163.dat	upx
behavioral1/memory/2452-1165-0x000007FEF6070000-0x000007FEF6735000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2452	628	RoFix.exe	31
PID 628 wrote to memory of 2452	628	RoFix.exe	31
PID 628 wrote to memory of 2452	628	RoFix.exe	31

C:\Users\Admin\AppData\Local\Temp\RoFix.exe
"C:\Users\Admin\AppData\Local\Temp\RoFix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Users\Admin\AppData\Local\Temp\RoFix.exe
  "C:\Users\Admin\AppData\Local\Temp\RoFix.exe"
  2⤵
  - Loads dropped DLL
  PID:2452

C:\Users\Admin\AppData\Local\Temp\_MEI6282\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2452-1165-0x000007FEF6070000-0x000007FEF6735000-memory.dmp

Filesize
6.8MB

Download