Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-01-2024 22:36
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231215-en
General
-
Target
file.exe
-
Size
471KB
-
MD5
810da00c69d55e89dca3bfe9a6f6a420
-
SHA1
ca02bdce48ac20f7b40ab720079009894f369990
-
SHA256
64a21d074850a4e8dd28a846e8f9e5d72d5549dc68d9ded2e9bff99f730f4d80
-
SHA512
453f25595db97195c6211a07c821977e1db5015906865fcbb535172c5fc1733a131eafc512dc896f4c8726c9d58cf2aa6b354d7e33ae3afd9371a0c5432b3034
-
SSDEEP
12288:Lh1Fk70Tnvjc52gSbBJKrk+bLcIW1SIoQT79Y4AyGItHYO2E89:Rk70Trcu2oqLISIoQT7C8pHFRQ
Malware Config
Signatures
-
.NET Reactor proctector 3 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral1/memory/2496-0-0x00000000021B0000-0x0000000002212000-memory.dmp net_reactor behavioral1/memory/2496-4-0x0000000002210000-0x0000000002270000-memory.dmp net_reactor behavioral1/memory/2496-9-0x00000000020C0000-0x0000000002100000-memory.dmp net_reactor -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2400 2496 WerFault.exe file.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
file.exedescription pid process target process PID 2496 wrote to memory of 2400 2496 file.exe WerFault.exe PID 2496 wrote to memory of 2400 2496 file.exe WerFault.exe PID 2496 wrote to memory of 2400 2496 file.exe WerFault.exe PID 2496 wrote to memory of 2400 2496 file.exe WerFault.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2496-1-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/2496-0-0x00000000021B0000-0x0000000002212000-memory.dmpFilesize
392KB
-
memory/2496-2-0x00000000020C0000-0x0000000002100000-memory.dmpFilesize
256KB
-
memory/2496-3-0x00000000020C0000-0x0000000002100000-memory.dmpFilesize
256KB
-
memory/2496-4-0x0000000002210000-0x0000000002270000-memory.dmpFilesize
384KB
-
memory/2496-7-0x0000000002340000-0x0000000004340000-memory.dmpFilesize
32.0MB
-
memory/2496-8-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/2496-9-0x00000000020C0000-0x0000000002100000-memory.dmpFilesize
256KB
-
memory/2496-10-0x0000000002340000-0x0000000004340000-memory.dmpFilesize
32.0MB