b9cae0739fc6daee051551b3e1dfabd39db41c2996f3a905254a71def555ba36

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

603d00b49e0ee1b9c5022174ab248b6c.exe
Size

18KB
MD5

603d00b49e0ee1b9c5022174ab248b6c
SHA1

fd93a10b32cced522ca6274f781066a9fab8af17
SHA256

8d19be51751f0c459874ae1dc1be93fb7e667bc916f5b11eeb67943b479cb0e9
SHA512

226f971bb04ba4f0548ad207a308567a5dc7ee1aea5ff933e020e457c38e53a7c8c899e8cd036060c4f1aca7e157c6d076c22422f318cd626b323e558e57f865
SSDEEP

384:6d+cgTYymL0Tybt/yLp3Ejf0TgShmWTkK6aHv+P:qpxwTyBcEjylTA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2528	2532	603d00b49e0ee1b9c5022174ab248b6c.exe	31
PID 2532 wrote to memory of 2528	2532	603d00b49e0ee1b9c5022174ab248b6c.exe	31
PID 2532 wrote to memory of 2528	2532	603d00b49e0ee1b9c5022174ab248b6c.exe	31
PID 2528 wrote to memory of 1724	2528	csc.exe	32
PID 2528 wrote to memory of 1724	2528	csc.exe	32
PID 2528 wrote to memory of 1724	2528	csc.exe	32

C:\Users\Admin\AppData\Local\Temp\603d00b49e0ee1b9c5022174ab248b6c.exe
"C:\Users\Admin\AppData\Local\Temp\603d00b49e0ee1b9c5022174ab248b6c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kiv4z3dn\kiv4z3dn.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE59.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC812DAC4DDD8A497590E31331F88CB03A.TMP"
    3⤵
    PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESAE59.tmp

Filesize
1KB

MD5
c9d2dfb2b2590acebb1502a723a54aee

SHA1
d38ef4482637d35a95b4f90def6792ffc090fd4a

SHA256
2189cb5af104689a9580970592a9447bf247c66d014ab7a6273c9f980d19f7b3

SHA512
502adde42389be43fe1dd3b9a7231f62393cc76bede6ff4bc813dfe4420f7843878f70ef8138be07bc99746ca110b936056ccffebfbb3e235f27f959389b7ba9

Download Submit
C:\Users\Admin\AppData\Local\Temp\e4f7dd67-d20b-4252-888b-2c9fcfac385c.exe

Filesize
18KB

MD5
e022aff12b90540cbbc8f82a173263c7

SHA1
2cd1fa2d7ca2f60fa0333a411c03186101be02ca

SHA256
54e330bdb47a9358253ae525c0a8404096c2df47e20a980fc2e725c284c861a3

SHA512
5fe2c5bb34da69720114a514ec2e6751c77f29a2fdd3501a86eb1be638ef5ee223e43a794237e31dbcd59e122e4ceede305bbb36422f2150ec60c3520c62674a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC812DAC4DDD8A497590E31331F88CB03A.TMP

Filesize
1KB

MD5
ce60c5fa1ec56ce72027cd7a09882cbe

SHA1
ac22326affcdac83696522a4241e5c47643e8f16

SHA256
21b96e2f7b36df65d73644fbdf45a7a636b36b5c86ba60777e94f5e6b6d8b175

SHA512
8e7bb868ad39ffb9a6a04e9442cab114645db79d2bd8be9b447d609cc3cf3a2a32bc46343d8bf4077c85540bc1972e08b80fcd16ed4c57878ba8a58881b8a222

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kiv4z3dn\kiv4z3dn.0.cs

Filesize
41KB

MD5
0a312d1eda047415714e778032a4896b

SHA1
b4041cb75f172b3c99cd189673b01f7eda6844ce

SHA256
d1f1eecb7adf265c49104074b6cc8f13e2d093018f06952e57225dadfd5a3fdd

SHA512
2addca9cfba42e2fe35150e75cdfc5685d7cfd9f266ac728a39286b7a9f88414c77792577d192c25e1d851a919ae68561b9b93dcadc431f37aabf6550ca95860

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kiv4z3dn\kiv4z3dn.cmdline

Filesize
377B

MD5
89f42a8ffce11854fcad8ad8cc6426f3

SHA1
072b5c75ac02ea6830a2207b53600382fc90b2a6

SHA256
e055cace36001065a03cf9f4b65aa061917f80c000bc284371b751489d74e9b3

SHA512
95358dae35995fcebcb44723c4f6cecb0127b77aa9bf65bafee23929303d51a75a2535366106e8dec0cdf5dfaa84510af033f84998740bb9a1d7a0b102127195

Download Submit
memory/2532-0-0x000007FEF59A3000-0x000007FEF59A4000-memory.dmp

Filesize
4KB

Download
memory/2532-1-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/2532-3-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

Filesize
9.9MB

Download
memory/2532-16-0x0000000000320000-0x000000000032A000-memory.dmp

Filesize
40KB

Download
memory/2532-18-0x000007FEF59A3000-0x000007FEF59A4000-memory.dmp

Filesize
4KB

Download
memory/2532-19-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads