3f9182e10ec211dcbec310ff12e05388f87fdfd9213b3b723d4eb888fd796847

Analysis

max time kernel
143s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2023 23:54

Target

itubego_pd.exe
Size

86.6MB
MD5

0dd0028e7f7ae8a2d2e191a9eea8140e
SHA1

3c5b77216120d24333a0600f9b08cafc4770b5ca
SHA256

3f9182e10ec211dcbec310ff12e05388f87fdfd9213b3b723d4eb888fd796847
SHA512

7b5d9144c5e75d9c72a879e7f721aeef433523b8573fd2a47ada0d3a7c2339bccd05a5b67e9f389438d584814758a551757eaea2c50fc2135f0ed07a0f42822d
SSDEEP

1572864:L1pKJ/QCCXwsYssykS2D+WutvgdQUc3mKen9f+97ZAD5TcBJJHYJjy3bzv8T:LDKJYCCXwsfsykS0GSc3mxfouc/JKQzI

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

itubego_pd.tmp

pid process

3864 itubego_pd.tmp

pid	process
3864	itubego_pd.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

itubego_pd.exe

description	pid	process	target process
PID 1320 wrote to memory of 3864	1320	itubego_pd.exe	itubego_pd.tmp
PID 1320 wrote to memory of 3864	1320	itubego_pd.exe	itubego_pd.tmp
PID 1320 wrote to memory of 3864	1320	itubego_pd.exe	itubego_pd.tmp

C:\Users\Admin\AppData\Local\Temp\itubego_pd.exe
"C:\Users\Admin\AppData\Local\Temp\itubego_pd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320

C:\Users\Admin\AppData\Local\Temp\is-ANIKR.tmp\itubego_pd.tmp
"C:\Users\Admin\AppData\Local\Temp\is-ANIKR.tmp\itubego_pd.tmp" /SL5="$A01C0,89968061,733696,C:\Users\Admin\AppData\Local\Temp\itubego_pd.exe"
2⤵
- Executes dropped EXE
PID:3864

C:\Users\Admin\AppData\Local\Temp\is-ANIKR.tmp\itubego_pd.tmp
Filesize
2.4MB

MD5
47bb561a0504895bf52056b2f8f1e15e

SHA1
423e45d22a832ff6c8294fc8f9e4aed663333920

SHA256
c97b4256642f8e53001dfd069da54899693c91a5f60bd9adb480d5148a4ba637

SHA512
5e54476da418a3b48c47f716379091e5e9357a31592dd09589f85f936334af71c8137044ecb8429bd6e1d6662075fd085f4adcd1fb8a4cd3fd4762caf7e4fe51

Download Submit
memory/1320-133-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/1320-140-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3864-138-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/3864-141-0x0000000000400000-0x000000000067C000-memory.dmp

Filesize
2.5MB

Download
memory/3864-142-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download