699773d2bcf852aa7bc135e626fe5a08a9b284aac090df12dd754c184c8a2063

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 17:00

Target

file.exe
Size

2.3MB
MD5

76d4a943f3e5287c78f094237f3562b2
SHA1

33e08d867ef636a3e8f6b5d2d98e55212793e45b
SHA256

699773d2bcf852aa7bc135e626fe5a08a9b284aac090df12dd754c184c8a2063
SHA512

07f3d6c07505ac88efb74e935d0e4348c62897482bedde93ee6f0ac4d487a8952597895aae53cc77f85b9f52bd390265fd9c6a71d132e46c0515e8c166d18dad
SSDEEP

49152:AkQTAktLCMiS7dLdIm6RjwZuHB1eWn0N7I4hNVsJZkwoGCURHz:AakZCMF7JC3RMEWy0NdsP+URHz

Score

7^/10

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2044-2-0x0000000005180000-0x00000000053AC000-memory.dmp	net_reactor
behavioral1/memory/2044-4-0x0000000004F50000-0x000000000517C000-memory.dmp	net_reactor
behavioral1/memory/2044-11-0x0000000004F10000-0x0000000004F50000-memory.dmp	net_reactor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2332	2044	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2332	2044	file.exe	28
PID 2044 wrote to memory of 2332	2044	file.exe	28
PID 2044 wrote to memory of 2332	2044	file.exe	28
PID 2044 wrote to memory of 2332	2044	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 616
  2⤵
  - Program crash
  PID:2332

memory/2044-0-0x00000000741C0000-0x00000000748AE000-memory.dmp

Filesize
6.9MB

Download
memory/2044-1-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/2044-2-0x0000000005180000-0x00000000053AC000-memory.dmp

Filesize
2.2MB

Download
memory/2044-3-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/2044-4-0x0000000004F50000-0x000000000517C000-memory.dmp

Filesize
2.2MB

Download
memory/2044-5-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/2044-8-0x0000000002A90000-0x0000000004A90000-memory.dmp

Filesize
32.0MB

Download
memory/2044-9-0x00000000741C0000-0x00000000748AE000-memory.dmp

Filesize
6.9MB

Download
memory/2044-10-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/2044-11-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/2044-12-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/2044-13-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/2044-14-0x0000000002A90000-0x0000000004A90000-memory.dmp

Filesize
32.0MB

Download