e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 05:01

Target

e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe
Size

473KB
MD5

0ed83b921910401b1fe81d739957d364
SHA1

283a4c1e65dbedd256c8b63d3329585573a26cca
SHA256

e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85
SHA512

17b8c12b33992673f2b93e631cc8b012e246028dd5f60491e386576a58f4c3d163d118c7526cb7b92f9c21732f73e36195527b4764d1289845063f6d745986ab
SSDEEP

12288:Vh1Fk70Tnvjc/pZcQAgUl1QrBxOKw5fmjMy0hAXAMvJEQyUl:nk70TrcfcQAgUluSYTBEQyA

Score

7^/10

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/2140-5-0x00000000046F0000-0x0000000004730000-memory.dmp	net_reactor
behavioral1/memory/2140-4-0x0000000004790000-0x00000000047F0000-memory.dmp	net_reactor
behavioral1/memory/2140-0-0x0000000004730000-0x0000000004790000-memory.dmp	net_reactor

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2660 2140 WerFault.exe e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe

pid	pid_target	process	target process
2660	2140	WerFault.exe	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe

description	pid	process	target process
PID 2140 wrote to memory of 2660	2140	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe	WerFault.exe
PID 2140 wrote to memory of 2660	2140	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe	WerFault.exe
PID 2140 wrote to memory of 2660	2140	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe	WerFault.exe
PID 2140 wrote to memory of 2660	2140	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe
"C:\Users\Admin\AppData\Local\Temp\e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 600
2⤵
- Program crash
PID:2660

memory/2140-3-0x00000000046F0000-0x0000000004730000-memory.dmp

Filesize
256KB

Download
memory/2140-2-0x00000000046F0000-0x0000000004730000-memory.dmp

Filesize
256KB

Download
memory/2140-5-0x00000000046F0000-0x0000000004730000-memory.dmp

Filesize
256KB

Download
memory/2140-4-0x0000000004790000-0x00000000047F0000-memory.dmp

Filesize
384KB

Download
memory/2140-1-0x0000000074130000-0x000000007481E000-memory.dmp

Filesize
6.9MB

Download
memory/2140-0-0x0000000004730000-0x0000000004790000-memory.dmp

Filesize
384KB

Download
memory/2140-8-0x0000000002400000-0x0000000004400000-memory.dmp

Filesize
32.0MB

Download
memory/2140-9-0x0000000074130000-0x000000007481E000-memory.dmp

Filesize
6.9MB

Download
memory/2140-10-0x0000000002400000-0x0000000004400000-memory.dmp

Filesize
32.0MB

Download