340ecb20720b5f00ede8f9aa46ab82a835d9b41e1ab96cad8e516912db60a5f5

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 07:04

Target
public/Fixes/connectionFix.exe
Size 21KB
Sample260604-hv7ehsay8x
SHA256 340ecb20720b5f00ede8f9aa46ab82a835d9b41e1ab96cad8e516912db60a5f5
MD5 5f73432e5976137fd2b431853f44d7df
SHA1 80ee9158d76b1722c1ff6ea724698628ae347918
SHA512 074090de5ca03c16060ae745251dc67881504547fc2fd1f529142235202e8f55c3914791553c4ae584fc5b6ae28a8cd2ad9558dc72d0163009f0ff33ca2d396f
SSDEEP 384:JE/wg4EDGmlywEYAdpPprHER/i8JpbG379k:o4EDGmy7YAdcli8fS37
TLSH
T1BFA23C57FB4608EAF26A927DC6E66A15F231B8085B32D6CF1781506F1E763C0A87EC41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

pid	Process
5004	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3444	3668	connectionFix.exe	81
PID 3444 wrote to memory of 5004	3444	cmd.exe	82
PID 3444 wrote to memory of 4892	3444	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\public\Fixes\connectionFix.exe
"C:\Users\Admin\AppData\Local\Temp\public\Fixes\connectionFix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name=all verbose | findstr /I "RobloxPlayerBeta.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name=all verbose
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5004
- - C:\Windows\system32\findstr.exe
    findstr /I "RobloxPlayerBeta.exe"
    3⤵
    PID:4892