b324c53ae8b37753405563df1e4a0375758c9b9c2d9368ad807a6e8cda957c6a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 15:38

Target

nlinjector.exe
Size

733KB
MD5

16b814f5d97faeb7f388fa00626a6f5d
SHA1

f1ddab5c0553bcad26056d64e3037e7c5bc7391c
SHA256

c4dd5514c42110629dee90c23c5ec4186da39140dc23a952a57085687d6c6a71
SHA512

f811e92f263db7dba10b107d693e0c64afda509b8c9573f826b2931475dea91675e735bc4f60837b932782fedc2dabad5f31fe6533fec8c3dca24b1ec29504b3
SSDEEP

12288:Rh18k70TnvjcUxhzQKo6VxgCgxa5yT2owiJh2:uk70TrcUJfVxScyT2oweh

Score

7^/10

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/2572-2-0x0000000004740000-0x0000000004780000-memory.dmp	net_reactor
behavioral1/memory/2572-0-0x00000000046A0000-0x0000000004702000-memory.dmp	net_reactor
behavioral1/memory/2572-3-0x0000000004780000-0x00000000047E0000-memory.dmp	net_reactor

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2916 2572 WerFault.exe nlinjector.exe

pid	pid_target	process	target process
2916	2572	WerFault.exe	nlinjector.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

nlinjector.exe

description	pid	process	target process
PID 2572 wrote to memory of 2916	2572	nlinjector.exe	WerFault.exe
PID 2572 wrote to memory of 2916	2572	nlinjector.exe	WerFault.exe
PID 2572 wrote to memory of 2916	2572	nlinjector.exe	WerFault.exe
PID 2572 wrote to memory of 2916	2572	nlinjector.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\nlinjector.exe
"C:\Users\Admin\AppData\Local\Temp\nlinjector.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 596
2⤵
- Program crash
PID:2916

memory/2572-1-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/2572-2-0x0000000004740000-0x0000000004780000-memory.dmp

Filesize
256KB

Download
memory/2572-0-0x00000000046A0000-0x0000000004702000-memory.dmp

Filesize
392KB

Download
memory/2572-3-0x0000000004780000-0x00000000047E0000-memory.dmp

Filesize
384KB

Download
memory/2572-6-0x0000000002190000-0x0000000004190000-memory.dmp

Filesize
32.0MB

Download
memory/2572-8-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download