c4dd5514c42110629dee90c23c5ec4186da39140dc23a952a57085687d6c6a71

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 05:43

Target

StreamList.exe
Size

733KB
MD5

16b814f5d97faeb7f388fa00626a6f5d
SHA1

f1ddab5c0553bcad26056d64e3037e7c5bc7391c
SHA256

c4dd5514c42110629dee90c23c5ec4186da39140dc23a952a57085687d6c6a71
SHA512

f811e92f263db7dba10b107d693e0c64afda509b8c9573f826b2931475dea91675e735bc4f60837b932782fedc2dabad5f31fe6533fec8c3dca24b1ec29504b3
SSDEEP

12288:Rh18k70TnvjcUxhzQKo6VxgCgxa5yT2owiJh2:uk70TrcUJfVxScyT2oweh

Score

7^/10

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2104-2-0x00000000048E0000-0x0000000004920000-memory.dmp	net_reactor
behavioral1/memory/2104-0-0x00000000020C0000-0x0000000002122000-memory.dmp	net_reactor
behavioral1/memory/2104-5-0x0000000004700000-0x0000000004760000-memory.dmp	net_reactor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	2104	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2372	2104	StreamList.exe	28
PID 2104 wrote to memory of 2372	2104	StreamList.exe	28
PID 2104 wrote to memory of 2372	2104	StreamList.exe	28
PID 2104 wrote to memory of 2372	2104	StreamList.exe	28

C:\Users\Admin\AppData\Local\Temp\StreamList.exe
"C:\Users\Admin\AppData\Local\Temp\StreamList.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 600
  2⤵
  - Program crash
  PID:2372

memory/2104-2-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/2104-1-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2104-0-0x00000000020C0000-0x0000000002122000-memory.dmp

Filesize
392KB

Download
memory/2104-3-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/2104-4-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/2104-5-0x0000000004700000-0x0000000004760000-memory.dmp

Filesize
384KB

Download
memory/2104-8-0x0000000002330000-0x0000000004330000-memory.dmp

Filesize
32.0MB

Download
memory/2104-9-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2104-10-0x0000000002330000-0x0000000004330000-memory.dmp

Filesize
32.0MB

Download