Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
25-01-2024 19:03
General
-
Target
file.exe
-
Size
727KB
-
MD5
8b5cf3d102548da37888f34d3d468e27
-
SHA1
823aa91b6e4ecf3bb68a2154a122e6a9ffc7bf89
-
SHA256
3e8e1eae92427c05d36bbc665721382af5972780e0a7cd44e33f63684b1cf3e2
-
SHA512
da525ea8b851739940fcce41fae69b4fa7942c21e2ac7fca79fd468e247c5ce0e8fc105a9288290ff79c064a5d200e7214f67ea070114da1fb335b152a5ac10b
-
SSDEEP
12288:mh1Fk70TnvjcXHKkdNTYkpfxQmclBuFTEAtvqsuIGnyd30w4KA9LdX+/UwS0iSbq:Ak70Trc31dNckBxQmUBuFTEAtCsuI9d8
Score
7/10
Malware Config
Signatures
-
.NET Reactor proctector 24 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 6082⤵
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
664KB
-
Filesize
256KB
-
Filesize
664KB
-
Filesize
636KB
-
Filesize
256KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
32.0MB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
32.0MB