b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13

Analysis

max time kernel
139s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 06:07

Target
b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe
Size 1.6MB
Sample241018-gvtb8athpl
SHA256 b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13
MD5 263c57d5c64e5932e024b98b1a4ae5f1
SHA1 5085b990b299666dd6e2565ee16e320da64c5e74
SHA512 bb0d901a0be8416e639c72e250fd12fe50b1444403c582b5026c5def6f0c8cc5fb142f7606d3475f3f056c19f2c832da809a9c03ac166ee3f835d9df7afa96d1
SSDEEP 24576:BP6+D3feaaibg5UpjbRkYEDLT+Ls2QPP3CAhCd:BPh3zaiDJb5EPT+4PP3Ci
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 3068	808	b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe	84
PID 808 wrote to memory of 3068	808	b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe	84
PID 808 wrote to memory of 3680	808	b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe	85
PID 808 wrote to memory of 3680	808	b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe	85
PID 808 wrote to memory of 320	808	b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe	86
PID 808 wrote to memory of 320	808	b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe	86
PID 320 wrote to memory of 724	320	cmd.exe	90
PID 320 wrote to memory of 724	320	cmd.exe	90
PID 724 wrote to memory of 3104	724	b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe	91
PID 724 wrote to memory of 3104	724	b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe	91

C:\Users\Admin\AppData\Local\Temp\b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe
"C:\Users\Admin\AppData\Local\Temp\b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c mkdir C:\ProgramData\Citrix
  2⤵
  PID:3068
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c mkdir C:\ProgramData\Citrix\j9DJl12J3Zc400IM7
  2⤵
  PID:3680
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe" C:\ProgramData\Citrix\j9DJl12J3Zc400IM7 C:\ProgramData\Citrix\j9DJl12J3Zc400IM7
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe
    C:\Users\Admin\AppData\Local\Temp\b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13.exe C:\ProgramData\Citrix\j9DJl12J3Zc400IM7 C:\ProgramData\Citrix\j9DJl12J3Zc400IM7
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c C:\ProgramData\Citrix\j9DJl12J3Zc400IM7\4B0yXZpiV.exe
      4⤵
      PID:3104