573c9b416bcae65fe3dd9202632302b1686761fea2c87188b5df1a3d81c10190

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 19:03

Target

this obese kid of spigg got everything off.exe
Size

9.6MB
MD5

06ae6b63c80b3da385b1ad1937ec1b75
SHA1

88f9b349cde9e16cd9f14e55191604ab4934b535
SHA256

573c9b416bcae65fe3dd9202632302b1686761fea2c87188b5df1a3d81c10190
SHA512

79ff0fc2d1f3ebcf3532ec5c76f589b1b00731070af813ac61559f8d9b22ea436a8ab07c333fce875ee40fc341fa813cc9af35a8ba0c9973f7342397dcfb579e
SSDEEP

196608:1secpqbsJdPY71DkTeNrYFJMIDJ+gsAGKpRZQgqDkXZfygcG2:hQ3c1b8Fqy+gsiFNJr

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2776	this obese kid of spigg got everything off.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4ef-45.dat	upx
behavioral1/memory/2776-47-0x000007FEF5D70000-0x000007FEF61DE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2776	2296	this obese kid of spigg got everything off.exe	30
PID 2296 wrote to memory of 2776	2296	this obese kid of spigg got everything off.exe	30
PID 2296 wrote to memory of 2776	2296	this obese kid of spigg got everything off.exe	30

C:\Users\Admin\AppData\Local\Temp\this obese kid of spigg got everything off.exe
"C:\Users\Admin\AppData\Local\Temp\this obese kid of spigg got everything off.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\this obese kid of spigg got everything off.exe
  "C:\Users\Admin\AppData\Local\Temp\this obese kid of spigg got everything off.exe"
  2⤵
  - Loads dropped DLL
  PID:2776

C:\Users\Admin\AppData\Local\Temp\_MEI22962\python310.dll

Filesize
1.4MB

MD5
196deb9a74e6e9e242f04008ea80f7d3

SHA1
a54373ebad306f3e6f585bcdf1544fbdcf9c0386

SHA256
20b004bfe69166c4961fee93163e795746df39fb31dc67399c0fde57f551eb75

SHA512
8c226d3ef21f3ddeee14a098c60ef030fa78590e9505d015ce63ea5e5bbcea2e105ff818e94653df1bddc9ba6ed3b376a1dff5c19266b623fa22cd75ac263b68

Download Submit
memory/2776-47-0x000007FEF5D70000-0x000007FEF61DE000-memory.dmp

Filesize
4.4MB

Download