d21b3b16905c598240ce7d21a84e3c792ae1f265203c0cb8ad1cd705cbd775d3

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 01:50

Target

TRAGICPOOPEXE.exe
Size

5.9MB
MD5

dfa189c79f54bcbf8ce3bc6532b92778
SHA1

68e1e70d9fdf3a53cb0aefbc31536fc16e9efa98
SHA256

d21b3b16905c598240ce7d21a84e3c792ae1f265203c0cb8ad1cd705cbd775d3
SHA512

9b7d980861d200dc8e8b50150974e6fb370acea704ae03af92478d65a2e68d3b6faa81e3b5e9ee639bc25fb2b27be9178cd3651877baf6086b3e99adb0bd5e3a
SSDEEP

98304:gbmoDUN43WQqHejOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6attMLP:gbumWQzOjmFwDRxtYSHdK34kdai7bN3J

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2108	TRAGICPOOPEXE.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000016d0b-21.dat	upx
behavioral1/memory/2108-23-0x000007FEF6490000-0x000007FEF68F6000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2108	2428	TRAGICPOOPEXE.exe	30
PID 2428 wrote to memory of 2108	2428	TRAGICPOOPEXE.exe	30
PID 2428 wrote to memory of 2108	2428	TRAGICPOOPEXE.exe	30

C:\Users\Admin\AppData\Local\Temp\TRAGICPOOPEXE.exe
"C:\Users\Admin\AppData\Local\Temp\TRAGICPOOPEXE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\TRAGICPOOPEXE.exe
  "C:\Users\Admin\AppData\Local\Temp\TRAGICPOOPEXE.exe"
  2⤵
  - Loads dropped DLL
  PID:2108

C:\Users\Admin\AppData\Local\Temp\_MEI24282\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/2108-23-0x000007FEF6490000-0x000007FEF68F6000-memory.dmp

Filesize
4.4MB

Download