207c4f9e62528d693f096220ad365f5124918efc7994c537c956f9a79bcbadd3

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-01-2024 02:23

Target

file.exe
Size

698KB
MD5

bf2a3e48b0ea897e1cb01f8e2d37a995
SHA1

4e7cd01f8126099d550e126ff1c44b9f60f79b70
SHA256

207c4f9e62528d693f096220ad365f5124918efc7994c537c956f9a79bcbadd3
SHA512

78769b0130eed100e2bb1d0794f371b0fa1286d0c644337bc2d9bbe24f6467fd89aa8acf92ac719cc3c045d57097665fe8f3f567f2d4297a7ee7968bbab58b91
SSDEEP

12288:mh1Fk70TnvjcDopmEUd4+rL4VZvvApKFuzWMfJoacb7hj30Cq7rc4p/2:Ak70TrcDopfE+wUFuzW3NFgdrJx2

Score

7^/10

.NET Reactor proctector 4 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/1372-0-0x0000000004920000-0x00000000049B8000-memory.dmp	net_reactor
behavioral1/memory/1372-2-0x00000000048E0000-0x0000000004920000-memory.dmp	net_reactor
behavioral1/memory/1372-4-0x0000000004810000-0x00000000048A8000-memory.dmp	net_reactor
behavioral1/memory/1372-5-0x00000000048E0000-0x0000000004920000-memory.dmp	net_reactor

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2680 1372 WerFault.exe file.exe

pid	pid_target	process	target process
2680	1372	WerFault.exe	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1372 wrote to memory of 2680	1372	file.exe	WerFault.exe
PID 1372 wrote to memory of 2680	1372	file.exe	WerFault.exe
PID 1372 wrote to memory of 2680	1372	file.exe	WerFault.exe
PID 1372 wrote to memory of 2680	1372	file.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 600
2⤵
- Program crash
PID:2680

memory/1372-0-0x0000000004920000-0x00000000049B8000-memory.dmp

Filesize
608KB

Download
memory/1372-1-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/1372-2-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/1372-3-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/1372-4-0x0000000004810000-0x00000000048A8000-memory.dmp

Filesize
608KB

Download
memory/1372-5-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/1372-8-0x0000000002260000-0x0000000004260000-memory.dmp

Filesize
32.0MB

Download
memory/1372-9-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/1372-10-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/1372-11-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/1372-12-0x0000000002260000-0x0000000004260000-memory.dmp

Filesize
32.0MB

Download