340ecb20720b5f00ede8f9aa46ab82a835d9b41e1ab96cad8e516912db60a5f5

Analysis

user interaction
yes
max time kernel
24s
max time network
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:24

Target
public/other/Fixes/connectionFix.exe
Size 21KB
Sample260930-nhy59s1thy
SHA256 340ecb20720b5f00ede8f9aa46ab82a835d9b41e1ab96cad8e516912db60a5f5
MD5 5f73432e5976137fd2b431853f44d7df
SHA1 80ee9158d76b1722c1ff6ea724698628ae347918
SHA512 074090de5ca03c16060ae745251dc67881504547fc2fd1f529142235202e8f55c3914791553c4ae584fc5b6ae28a8cd2ad9558dc72d0163009f0ff33ca2d396f
SSDEEP 384:JE/wg4EDGmlywEYAdpPprHER/i8JpbG379k:o4EDGmy7YAdcli8fS37
TLSH
T1BFA23C57FB4608EAF26A927DC6E66A15F231B8085B32D6CF1781506F1E763C0A87EC41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

pid	Process
2220	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
3376	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3376	4112	connectionFix.exe	90
PID 3376 wrote to memory of 2220	3376	cmd.exe	91
PID 3376 wrote to memory of 4640	3376	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\public\other\Fixes\connectionFix.exe
"C:\Users\Admin\AppData\Local\Temp\public\other\Fixes\connectionFix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name=all verbose | findstr /I "RobloxPlayerBeta.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name=all verbose
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2220
- - C:\Windows\system32\findstr.exe
    findstr /I "RobloxPlayerBeta.exe"
    3⤵
    PID:4640